refac: debt on role backend

internal/domain/role/roleDomain.go

@@ -11,6 +11,7 @@ var (
 	ErrRoleConflict      = errors.New("role was modified concurrently")
 	ErrInvalidScope      = errors.New("invalid scope for permission")
 	ErrOwnerOnlyGrant    = errors.New("owner-only permission granted to a non-owner role")
+	ErrDuplicateGrant    = errors.New("permission granted more than once")
 
 	ErrMissingPermission = errors.New("missing permission")
 )
@@ -38,55 +39,6 @@ type Role struct {
 	Grants      []Grant `json:"grants"`
 }
 
-func (r Role) scopeOf(key string) Scope {
-	for _, grant := range r.Grants {
-		if grant.Key == key {
-			return grant.Scope
-		}
-	}
-	return ScopeNone
-}
-
-func (r Role) Allows(key string, owned bool) bool {
-	permission, err := Lookup(key)
-	if err != nil {
-		return false
-	}
-	if permission.OwnerOnly && !r.Locked {
-		return false
-	}
-	return scopeAllows(permission.Kind, r.scopeOf(key), owned)
-}
-
-func (r Role) AllowsFor(key string, typeKey string, owned bool) bool {
-	if typeKey == "" {
-		return r.Allows(key, owned)
-	}
-	composite := key + typeSeparator + typeKey
-	base, _, err := ParseTypedKey(composite)
-	if err != nil {
-		return false
-	}
-	permission, _ := Lookup(base)
-	for _, grant := range r.Grants {
-		if grant.Key == composite {
-			return scopeAllows(permission.Kind, grant.Scope, owned)
-		}
-	}
-	return r.Allows(key, owned)
-}
-
-func scopeAllows(kind Kind, scope Scope, owned bool) bool {
-	switch scope {
-	case ScopeAll:
-		return true
-	case ScopeOwn:
-		return kind == KindScoped && owned
-	default:
-		return false
-	}
-}
-
 func resolveGrantKey(key string) (Permission, error) {
 	if strings.Contains(key, typeSeparator) {
 		base, _, err := ParseTypedKey(key)
@@ -99,6 +51,7 @@ func resolveGrantKey(key string) (Permission, error) {
 }
 
 func ValidateGrants(locked bool, grants []Grant) error {
+	seen := make(map[string]bool, len(grants))
 	for _, grant := range grants {
 		permission, err := resolveGrantKey(grant.Key)
 		if err != nil {
@@ -107,14 +60,25 @@ func ValidateGrants(locked bool, grants []Grant) error {
 		if permission.OwnerOnly && !locked {
 			return ErrOwnerOnlyGrant
 		}
-		if !scopeValidFor(permission.Kind, grant.Scope) {
+		if !scopeValidFor(permission.Kind, grant.Scope, isTypedKey(grant.Key)) {
 			return ErrInvalidScope
 		}
+		if seen[grant.Key] {
+			return ErrDuplicateGrant
+		}
+		seen[grant.Key] = true
 	}
 	return nil
 }
 
-func scopeValidFor(kind Kind, scope Scope) bool {
+func isTypedKey(key string) bool {
+	return strings.Contains(key, typeSeparator)
+}
+
+func scopeValidFor(kind Kind, scope Scope, typed bool) bool {
+	if typed && scope == ScopeNone {
+		return true
+	}
 	if kind == KindToggle {
 		return scope == ScopeAll
 	}