refacto: cleanup

src/routes/rule-role.ts

@@ -0,0 +1,132 @@
+import type { FastifyInstance } from 'fastify';
+import type { Pool } from 'pg';
+import { getUser, getOrgScope, orgScopeExpr, hasPermission, SYSTEM_ORG_ID } from '../permissions.js';
+import { ruleResponse, notFound, forbidden, unauthorized, badRequest } from '../schemas.js';
+
+export function createRoleRuleRoutes(db: Pool) {
+    return async function roleRuleRoutes(app: FastifyInstance) {
+        app.get('/rules', {
+            schema: {
+                tags: ['Management'],
+                summary: 'List role rules',
+                description: 'Returns role-based permission rules within the scoped org subtree.',
+                security: [{ oauth2: [] }],
+                response: {
+                    200: { type: 'array', items: ruleResponse },
+                    400: badRequest, 401: unauthorized, 403: forbidden,
+                },
+            },
+        }, async (req, reply) => {
+            const user = getUser(req);
+            if (!user) return reply.code(401).send({ error: 'Authentication required' });
+
+            const orgIds = getOrgScope(req, reply, false);
+            if (orgIds === null) return reply;
+
+            if (!await hasPermission(db, req, reply, orgIds[0] ?? null, 'read', 'rules')) return reply;
+
+            const { expr, params } = orgScopeExpr(orgIds, 'r.org_id');
+            const { rows } = await db.query(
+                `SELECT r.id, r.role_id, r.org_id, o.name AS org_name, ro.name AS role_name,
+                        r.activity, r.view, r.modality, r.priority, r.scope
+                 FROM morbac.rules r
+                 JOIN morbac.orgs  o  ON o.id  = r.org_id
+                 JOIN morbac.roles ro ON ro.id = r.role_id
+                 ${expr ? `WHERE ${expr}` : ''}
+                 ORDER BY o.name, ro.name, r.activity, r.view`,
+                params,
+            );
+            return rows;
+        });
+
+        app.post('/rules', {
+            schema: {
+                tags: ['Management'],
+                summary: 'Create a role rule',
+                description: 'Adds a role-based permission rule. Scope is stored natively and evaluated at query time.',
+                security: [{ oauth2: [] }],
+                body: {
+                    type: 'object',
+                    required: ['org_id', 'role_id', 'activity', 'view', 'modality'],
+                    properties: {
+                        org_id:   { type: 'string', format: 'uuid' },
+                        role_id:  { type: 'string', format: 'uuid' },
+                        activity: { type: 'string' },
+                        view:     { type: 'string' },
+                        modality: { type: 'string', enum: ['permission', 'prohibition'] },
+                        priority: { type: 'integer' },
+                        scope: {
+                            type: 'string',
+                            enum: ['self', 'children', 'descendants', 'subtree', 'parent', 'ancestors', 'lineage', 'root'],
+                            default: 'self',
+                        },
+                    },
+                },
+                response: {
+                    201: ruleResponse,
+                    400: badRequest, 401: unauthorized, 403: forbidden, 404: notFound,
+                    409: { description: 'Rule already exists.' },
+                },
+            },
+        }, async (req, reply) => {
+            const user = getUser(req);
+            if (!user) return reply.code(401).send({ error: 'Authentication required' });
+
+            const { org_id, role_id, activity, view, modality, priority, scope = 'self' } = req.body as {
+                org_id: string; role_id: string; activity: string;
+                view: string; modality: 'permission' | 'prohibition'; priority?: number; scope?: string;
+            };
+
+            if (!await hasPermission(db, req, reply, org_id, 'create', 'rules')) return reply;
+
+            try {
+                const { rows } = await db.query(
+                    `INSERT INTO morbac.rules
+                         (org_id, role_id, activity, view, context_id, modality, scope, priority, is_active)
+                     VALUES (
+                         $1, $2, $3, $4,
+                         (SELECT id FROM morbac.contexts WHERE name = 'always'),
+                         $5::morbac.modality, $6, $7, TRUE
+                     )
+                     RETURNING id, $2::UUID AS role_id, $1::UUID AS org_id,
+                         (SELECT name FROM morbac.orgs  WHERE id = $1) AS org_name,
+                         (SELECT name FROM morbac.roles WHERE id = $2) AS role_name,
+                         activity, view, modality, priority, scope`,
+                    [org_id, role_id, activity, view, modality, scope, priority ?? null],
+                );
+                return reply.code(201).send(rows[0]);
+            } catch (e: unknown) {
+                if ((e as { code?: string }).code === '23505') return reply.code(409).send({ error: 'Rule already exists' });
+                throw e;
+            }
+        });
+
+        app.delete('/rules/:id', {
+            schema: {
+                tags: ['Management'],
+                summary: 'Delete a role rule',
+                description: "Removes a role-based permission rule. Requires `delete`/`rules` in the rule's org.",
+                security: [{ oauth2: [] }],
+                params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } },
+                response: {
+                    204: { type: 'null', description: 'Rule deleted.' },
+                    400: badRequest, 401: unauthorized, 403: forbidden, 404: notFound,
+                },
+            },
+        }, async (req, reply) => {
+            const user = getUser(req);
+            if (!user) return reply.code(401).send({ error: 'Authentication required' });
+
+            const { id } = req.params as { id: string };
+            const { rows: [rule] } = await db.query<{ org_id: string }>(
+                'SELECT org_id FROM morbac.rules WHERE id = $1', [id],
+            );
+            if (!rule) return reply.code(404).send({ error: 'Not found' });
+            if (rule.org_id === SYSTEM_ORG_ID) return reply.code(403).send({ error: 'System entities are immutable' });
+            if (!await hasPermission(db, req, reply, rule.org_id, 'delete', 'rules')) return reply;
+
+            await db.query('DELETE FROM morbac.rules WHERE id = $1', [id]);
+            return reply.code(204).send();
+        });
+    };
+}