refac: debt on role backend

internal/domain/role/roleGrantSet.go

@@ -12,29 +12,103 @@ func (e MissingPermissionError) Is(target error) bool {
 	return target == ErrMissingPermission
 }
 
-type GrantSet map[string]Scope
-
-func NewGrantSet(grants []Grant) GrantSet {
-	set := make(GrantSet, len(grants))
-	for _, grant := range grants {
-		set[grant.Key] = grant.Scope
-	}
-	return set
+type GrantSet struct {
+	scopes map[string]Scope
 }
 
-func (g GrantSet) Scope(key string) Scope {
-	scope, present := g[key]
+func (r Role) GrantSet() GrantSet {
+	scopes := make(map[string]Scope, len(r.Grants))
+	for _, grant := range r.Grants {
+		permission, err := resolveGrantKey(grant.Key)
+		if err != nil || permission.OwnerOnly && !r.Locked {
+			continue
+		}
+		scope := effectiveScope(permission.Kind, grant.Scope)
+		if held, present := scopes[grant.Key]; present {
+			scope = mostRestrictive(held, scope)
+		}
+		scopes[grant.Key] = scope
+	}
+	return GrantSet{scopes: scopes}
+}
+
+func effectiveScope(kind Kind, scope Scope) Scope {
+	switch {
+	case scope == ScopeAll:
+		return ScopeAll
+	case scope == ScopeOwn && kind == KindScoped:
+		return ScopeOwn
+	default:
+		return ScopeNone
+	}
+}
+
+func scopeRank(scope Scope) int {
+	switch scope {
+	case ScopeAll:
+		return 2
+	case ScopeOwn:
+		return 1
+	default:
+		return 0
+	}
+}
+
+func mostRestrictive(left Scope, right Scope) Scope {
+	if scopeRank(left) <= scopeRank(right) {
+		return left
+	}
+	return right
+}
+
+func (g GrantSet) ScopeFor(key string, typeKey string) Scope {
+	if typeKey == "" {
+		return g.wildcard(key)
+	}
+	composite := key + typeSeparator + typeKey
+	if _, _, err := ParseTypedKey(composite); err != nil {
+		return ScopeNone
+	}
+	if scope, present := g.scopes[composite]; present {
+		return scope
+	}
+	return g.wildcard(key)
+}
+
+func (g GrantSet) wildcard(key string) Scope {
+	if isTypedKey(key) {
+		return ScopeNone
+	}
+	scope, present := g.scopes[key]
 	if !present {
 		return ScopeNone
 	}
 	return scope
 }
 
+func (g GrantSet) Permits(key string, typeKey string, callerID uint32, createdBy uint32) bool {
+	return ScopePermits(g.ScopeFor(key, typeKey), callerID, createdBy)
+}
+
+func ScopePermits(scope Scope, callerID uint32, createdBy uint32) bool {
+	switch scope {
+	case ScopeAll:
+		return true
+	case ScopeOwn:
+		return callerID != 0 && callerID == createdBy
+	default:
+		return false
+	}
+}
+
+func (g GrantSet) HoldsFor(key string, typeKey string) bool {
+	return g.ScopeFor(key, typeKey) != ScopeNone
+}
+
 func (g GrantSet) Holds(key string) bool {
-	scope := g.Scope(key)
-	return scope == ScopeOwn || scope == ScopeAll
+	return g.HoldsFor(key, "")
 }
 
 func (g GrantSet) HoldsAll(key string) bool {
-	return g.Scope(key) == ScopeAll
+	return g.ScopeFor(key, "") == ScopeAll
 }