service backend

api/pkg/mutil/db/auth/accountbound.go

@@ -0,0 +1,89 @@
+// Package mutil provides utility functions for working with account-bound objects
+// with permission enforcement.
+//
+// Example usage:
+//
+//	// Using the low-level repository approach
+//	objects, err := mutil.GetAccountBoundObjects[model.ProjectFilter](
+//		ctx, logger, accountRef, orgRef, model.ActionRead,
+//		repository.Query(), &model.ViewCursor{Limit: &limit, Offset: &offset, IsArchived: &isArchived},
+//		enforcer, repo)
+//
+//	// Using the AccountBoundDB interface approach
+//	objects, err := mutil.GetAccountBoundObjectsFromDB[model.ProjectFilter](
+//		ctx, logger, accountRef, orgRef,
+//		repository.Query(), &model.ViewCursor{Limit: &limit, Offset: &offset, IsArchived: &isArchived},
+//		accountBoundDB)
+package mutil
+
+import (
+	"context"
+	"errors"
+
+	"github.com/tech/sendico/pkg/auth"
+	"github.com/tech/sendico/pkg/db/repository"
+	"github.com/tech/sendico/pkg/db/repository/builder"
+	"github.com/tech/sendico/pkg/merrors"
+	"github.com/tech/sendico/pkg/mlogger"
+	"github.com/tech/sendico/pkg/model"
+	mutil "github.com/tech/sendico/pkg/mutil/db"
+	"github.com/tech/sendico/pkg/mutil/mzap"
+	"go.mongodb.org/mongo-driver/bson/primitive"
+	"go.uber.org/zap"
+)
+
+// GetAccountBoundObjects retrieves account-bound objects with permission enforcement.
+// This function handles the complex logic of:
+// 1. Finding objects where accountRef matches OR is null/absent
+// 2. Checking organization-level permissions for each object
+// 3. Filtering to only objects the account has permission to read
+func GetAccountBoundObjects[T any](
+	ctx context.Context,
+	logger mlogger.Logger,
+	accountRef, organizationRef primitive.ObjectID,
+	filter builder.Query,
+	cursor *model.ViewCursor,
+	enforcer auth.Enforcer,
+	repo repository.Repository,
+) ([]T, error) {
+	// Build query to find objects where accountRef matches OR is null/absent
+	accountQuery := repository.WithOrg(accountRef, organizationRef)
+
+	// Get all account-bound objects that match the criteria
+	allObjects, err := repo.ListAccountBound(ctx, repository.ApplyCursor(accountQuery, cursor))
+	if err != nil {
+		if !errors.Is(err, merrors.ErrNoData) {
+			logger.Warn("Failed to fetch account bound objects", zap.Error(err),
+				mzap.ObjRef("account_ref", accountRef),
+				mzap.ObjRef("organization_ref", organizationRef),
+			)
+		} else {
+			logger.Debug("No matching account bound objects found", zap.Error(err),
+				mzap.ObjRef("account_ref", accountRef),
+				mzap.ObjRef("organization_ref", organizationRef),
+			)
+		}
+		return nil, err
+	}
+
+	if len(allObjects) == 0 {
+		return nil, merrors.NoData("no_account_bound_objects_found")
+	}
+
+	allowed := make([]primitive.ObjectID, 0, len(allObjects))
+	for _, ref := range allObjects {
+		allowed = append(allowed, *ref.GetID())
+	}
+	if len(allowed) == 0 {
+		return nil, merrors.NoData("no_data_found_or_allowed")
+	}
+
+	logger.Debug("Successfully retrieved account bound objects",
+		zap.Int("total_count", len(allObjects)),
+		mzap.ObjRef("account_ref", accountRef),
+		mzap.ObjRef("organization_ref", organizationRef),
+		zap.Any("objs", allObjects),
+	)
+
+	return mutil.GetObjects[T](ctx, logger, repository.Query().In(repository.IDField(), allowed), cursor, repo)
+}

api/pkg/mutil/db/auth/protected.go

@@ -0,0 +1,58 @@
+package mutil
+
+import (
+	"context"
+	"errors"
+
+	"github.com/tech/sendico/pkg/auth"
+	"github.com/tech/sendico/pkg/db/repository"
+	"github.com/tech/sendico/pkg/db/repository/builder"
+	"github.com/tech/sendico/pkg/merrors"
+	"github.com/tech/sendico/pkg/mlogger"
+	"github.com/tech/sendico/pkg/model"
+	mutil "github.com/tech/sendico/pkg/mutil/db"
+	"github.com/tech/sendico/pkg/mutil/mzap"
+	"go.mongodb.org/mongo-driver/bson/primitive"
+	"go.uber.org/zap"
+)
+
+func GetProtectedObjects[T any](
+	ctx context.Context,
+	logger mlogger.Logger,
+	accountRef, organizationRef primitive.ObjectID,
+	action model.Action,
+	filter builder.Query,
+	cursor *model.ViewCursor,
+	enforcer auth.Enforcer,
+	repo repository.Repository,
+) ([]T, error) {
+	refs, err := repo.ListPermissionBound(ctx, repository.ApplyCursor(filter, cursor))
+	if err != nil {
+		if !errors.Is(err, merrors.ErrNoData) {
+			logger.Warn("Failed to fetch object IDs", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+				mzap.ObjRef("organization_ref", organizationRef), zap.String("action", string(action)))
+		} else {
+			logger.Debug("No matching IDs found", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+				mzap.ObjRef("organization_ref", organizationRef), zap.String("action", string(action)))
+		}
+		return nil, err
+	}
+	res, err := enforcer.EnforceBatch(ctx, refs, accountRef, action)
+	if err != nil {
+		logger.Warn("Failed to enforce object IDs", zap.Error(err), mzap.ObjRef("account_ref", accountRef),
+			mzap.ObjRef("organization_ref", organizationRef), zap.String("action", string(action)))
+		return nil, err
+	}
+
+	allowed := make([]primitive.ObjectID, 0, len(res))
+	for _, ref := range refs {
+		if ok := res[*ref.GetID()]; ok {
+			allowed = append(allowed, *ref.GetID())
+		}
+	}
+	if len(allowed) == 0 {
+		return nil, merrors.NoData("no_data_found_or_allowed")
+	}
+
+	return mutil.GetObjects[T](ctx, logger, repository.Query().In(repository.IDField(), allowed), cursor, repo)
+}