167 lines
8.7 KiB
TypeScript
167 lines
8.7 KiB
TypeScript
import type { FastifyInstance } from 'fastify';
|
|
import type { Pool } from 'pg';
|
|
import { getUser, getOrgScope, orgScopeExpr, hasPermission, canGrantRule, isActivityViewBound, SYSTEM_ORG_ID } from '../permissions.js';
|
|
import { ruleResponse, notFound, forbidden, unauthorized, badRequest } from '../schemas.js';
|
|
|
|
export function createRoleRuleRoutes(db: Pool) {
|
|
return async function roleRuleRoutes(app: FastifyInstance) {
|
|
app.get('/rules', {
|
|
schema: {
|
|
tags: ['Management'],
|
|
summary: 'List role rules',
|
|
description: 'Returns role-based permission rules within the scoped org subtree.',
|
|
security: [{ oauth2: [] }],
|
|
response: {
|
|
200: { type: 'array', items: ruleResponse },
|
|
400: badRequest, 401: unauthorized, 403: forbidden,
|
|
},
|
|
},
|
|
}, async (req, reply) => {
|
|
const user = getUser(req);
|
|
if (!user) return reply.code(401).send({ error: 'Authentication required' });
|
|
|
|
const orgIds = getOrgScope(req, reply, false);
|
|
if (orgIds === null) return reply;
|
|
|
|
if (!await hasPermission(db, req, reply, orgIds[0] ?? null, 'read', 'rules')) return reply;
|
|
|
|
const { expr, params } = orgScopeExpr(orgIds, 'r.org_id');
|
|
const { rows } = await db.query(
|
|
`SELECT r.id, r.role_id, r.org_id, o.name AS org_name, ro.name AS role_name,
|
|
r.activity, r.view, r.modality, r.priority, r.scope,
|
|
r.valid_from, r.valid_until,
|
|
(r.valid_from IS NULL OR r.valid_from <= now())
|
|
AND (r.valid_until IS NULL OR r.valid_until > now()) AS is_active
|
|
FROM morbac.rules r
|
|
JOIN morbac.orgs o ON o.id = r.org_id
|
|
JOIN morbac.roles ro ON ro.id = r.role_id
|
|
${expr ? `WHERE ${expr}` : ''}
|
|
ORDER BY o.name, ro.name, r.activity, r.view`,
|
|
params,
|
|
);
|
|
return rows;
|
|
});
|
|
|
|
app.post('/rules', {
|
|
schema: {
|
|
tags: ['Management'],
|
|
summary: 'Create a role rule',
|
|
description: 'Adds a role-based permission rule. Scope is stored natively and evaluated at query time.',
|
|
security: [{ oauth2: [] }],
|
|
body: {
|
|
type: 'object',
|
|
required: ['org_id', 'role_id', 'activity', 'view', 'modality'],
|
|
properties: {
|
|
org_id: { type: 'string', format: 'uuid' },
|
|
role_id: { type: 'string', format: 'uuid' },
|
|
activity: { type: 'string' },
|
|
view: { type: 'string' },
|
|
modality: { type: 'string', enum: ['permission', 'prohibition'] },
|
|
priority: { type: 'integer' },
|
|
scope: {
|
|
type: 'string',
|
|
enum: ['self', 'children', 'descendants', 'subtree', 'parent', 'ancestors', 'lineage', 'root', 'unattributed', 'all'],
|
|
default: 'self',
|
|
description:
|
|
'Which objects the rule reaches: a specific org via the tree scopes, '
|
|
+ 'unattributed for objects with no org, or all for every org including unattributed.',
|
|
},
|
|
},
|
|
},
|
|
response: {
|
|
201: ruleResponse,
|
|
400: badRequest, 401: unauthorized, 403: forbidden, 404: notFound,
|
|
409: { description: 'Rule already exists.' },
|
|
},
|
|
},
|
|
}, async (req, reply) => {
|
|
const user = getUser(req);
|
|
if (!user) return reply.code(401).send({ error: 'Authentication required' });
|
|
|
|
const { org_id, role_id, activity, view, modality, priority, scope = 'self' } = req.body as {
|
|
org_id: string; role_id: string; activity: string;
|
|
view: string; modality: 'permission' | 'prohibition'; priority?: number; scope?: string;
|
|
};
|
|
|
|
if (!await hasPermission(db, req, reply, org_id, 'create', 'rules')) return reply;
|
|
|
|
if (!await isActivityViewBound(db, activity, view)) {
|
|
return reply.code(400).send({ error: `Activity "${activity}" is not valid for view "${view}"` });
|
|
}
|
|
|
|
const { rows: [roleRow] } = await db.query<{ org_id: string }>(
|
|
'SELECT org_id FROM morbac.roles WHERE id = $1', [role_id],
|
|
);
|
|
if (!roleRow) return reply.code(404).send({ error: 'Not found' });
|
|
|
|
// Anti-escalation: only permission rules are constrained (prohibitions
|
|
// only ever reduce access). A caller may not grant, via any scope, a
|
|
// permission they do not themselves hold on every org that scope covers.
|
|
if (modality === 'permission'
|
|
&& !await canGrantRule(db, user.id, org_id, scope, activity, view)) {
|
|
return reply.code(403).send({ error: 'Cannot grant a permission you do not hold on the target orgs' });
|
|
}
|
|
|
|
try {
|
|
const { rows } = await db.query(
|
|
`INSERT INTO morbac.rules
|
|
(org_id, role_id, activity, view, context_id, modality, scope, priority, is_active)
|
|
VALUES (
|
|
$1, $2, $3, $4,
|
|
(SELECT id FROM morbac.contexts WHERE name = 'always'),
|
|
$5::morbac.modality, $6, $7, TRUE
|
|
)
|
|
RETURNING id, $2::UUID AS role_id, $1::UUID AS org_id,
|
|
(SELECT name FROM morbac.orgs WHERE id = $1) AS org_name,
|
|
(SELECT name FROM morbac.roles WHERE id = $2) AS role_name,
|
|
activity, view, modality, priority, scope,
|
|
valid_from, valid_until, is_active`,
|
|
[org_id, role_id, activity, view, modality, scope, priority ?? null],
|
|
);
|
|
// The morbac AFTER trigger only clears cache for the rule's own org.
|
|
// A non-self scope also affects other orgs (ancestors/descendants), so
|
|
// flush the whole cache to avoid stale grant/revocation decisions.
|
|
if (scope !== 'self') await db.query('SELECT morbac.invalidate_cache()');
|
|
return reply.code(201).send(rows[0]);
|
|
} catch (e: unknown) {
|
|
const code = (e as { code?: string }).code;
|
|
if (code === '23505') return reply.code(409).send({ error: 'Rule already exists' });
|
|
if (code === '23503') return reply.code(400).send({ error: 'Unknown activity or view' });
|
|
if (code === 'P0001') return reply.code(400).send({ error: `Activity "${activity}" is not valid for view "${view}"` });
|
|
throw e;
|
|
}
|
|
});
|
|
|
|
app.delete('/rules/:id', {
|
|
schema: {
|
|
tags: ['Management'],
|
|
summary: 'Delete a role rule',
|
|
description: "Removes a role-based permission rule. Requires `delete`/`rules` in the rule's org.",
|
|
security: [{ oauth2: [] }],
|
|
params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } },
|
|
response: {
|
|
204: { type: 'null', description: 'Rule deleted.' },
|
|
400: badRequest, 401: unauthorized, 403: forbidden, 404: notFound,
|
|
},
|
|
},
|
|
}, async (req, reply) => {
|
|
const user = getUser(req);
|
|
if (!user) return reply.code(401).send({ error: 'Authentication required' });
|
|
|
|
const { id } = req.params as { id: string };
|
|
const { rows: [rule] } = await db.query<{ org_id: string; scope: string }>(
|
|
'SELECT org_id, scope FROM morbac.rules WHERE id = $1', [id],
|
|
);
|
|
if (!rule) return reply.code(404).send({ error: 'Not found' });
|
|
if (rule.org_id === SYSTEM_ORG_ID) return reply.code(403).send({ error: 'System entities are immutable' });
|
|
if (!await hasPermission(db, req, reply, rule.org_id, 'delete', 'rules')) return reply;
|
|
|
|
await db.query('DELETE FROM morbac.rules WHERE id = $1', [id]);
|
|
// See POST: a non-self scope revocation must flush cache for the
|
|
// affected orgs, which the morbac trigger does not cover.
|
|
if (rule.scope !== 'self') await db.query('SELECT morbac.invalidate_cache()');
|
|
return reply.code(204).send();
|
|
});
|
|
};
|
|
}
|