87 lines
3.0 KiB
TypeScript
87 lines
3.0 KiB
TypeScript
import type { FastifyRequest, FastifyReply } from 'fastify';
|
|
import type { Pool } from 'pg';
|
|
|
|
export const SYSTEM_ORG_ID = '00000000-0000-0000-0000-000000000000';
|
|
|
|
export function getUser(req: FastifyRequest): { id: string } | null {
|
|
return ((req as unknown) as Record<string, unknown>).user as { id: string } | null ?? null;
|
|
}
|
|
|
|
export function getOrgScope(req: FastifyRequest, reply: FastifyReply, required = true): string[] | null {
|
|
const single = req.headers['x-org-id'];
|
|
const singleVal = Array.isArray(single) ? single[0] : (single ?? null);
|
|
if (singleVal) return [singleVal];
|
|
|
|
const multi = req.headers['x-org-ids'];
|
|
const multiVal = Array.isArray(multi) ? multi[0] : (multi ?? null);
|
|
if (multiVal) {
|
|
const ids = multiVal.split(',').map((s) => s.trim()).filter(Boolean);
|
|
if (ids.length > 0) return ids;
|
|
}
|
|
|
|
if (required) {
|
|
reply.code(400).send({ error: 'X-Org-Id header is required' });
|
|
return null;
|
|
}
|
|
return [];
|
|
}
|
|
|
|
export function orgScopeExpr(orgIds: string[], column: string, paramOffset = 0): { expr: string; params: string[] } {
|
|
if (orgIds.length === 0) return { expr: '', params: [] };
|
|
const parts = orgIds.map((_, i) =>
|
|
`SELECT org_id FROM morbac.get_org_scope($${paramOffset + i + 1}::UUID, 'subtree')`,
|
|
);
|
|
return { expr: `${column} IN (${parts.join(' UNION ')})`, params: orgIds };
|
|
}
|
|
|
|
export function viewForType(type: 'user' | 'service'): string {
|
|
return type === 'service' ? 'service_users' : 'users';
|
|
}
|
|
|
|
export async function getAccountType(
|
|
db: Pool,
|
|
id: string,
|
|
): Promise<'user' | 'system' | 'service' | null> {
|
|
const { rows } = await db.query<{ account_type: 'user' | 'system' | 'service' }>(
|
|
'SELECT account_type FROM app.users WHERE id = $1',
|
|
[id],
|
|
);
|
|
return rows[0]?.account_type ?? null;
|
|
}
|
|
|
|
export type ApiKeyScope = 'inherit' | Array<{ activity: string; view: string }>;
|
|
|
|
function scopeAllows(scope: ApiKeyScope | undefined, activity: string, target: string): boolean {
|
|
if (!scope || scope === 'inherit') return true;
|
|
return scope.some((p) => p.activity === activity && p.view === target);
|
|
}
|
|
|
|
export async function hasPermission(
|
|
db: Pool,
|
|
req: FastifyRequest,
|
|
reply: FastifyReply,
|
|
orgId: string | null,
|
|
activity: string,
|
|
target: string,
|
|
): Promise<boolean> {
|
|
const user = getUser(req);
|
|
if (!user) {
|
|
reply.code(401).send({ error: 'Authentication required' });
|
|
return false;
|
|
}
|
|
const apiKeyScope = ((req as unknown) as Record<string, unknown>).apiKeyScope as ApiKeyScope | undefined;
|
|
if (!scopeAllows(apiKeyScope, activity, target)) {
|
|
reply.code(403).send({ error: 'Insufficient permissions' });
|
|
return false;
|
|
}
|
|
const { rows } = await db.query<{ allowed: boolean }>(
|
|
'SELECT morbac.is_allowed($1::UUID, $2::UUID, $3, $4) AS allowed',
|
|
[user.id, orgId, activity, target],
|
|
);
|
|
if (!rows[0]?.allowed) {
|
|
reply.code(403).send({ error: 'Insufficient permissions' });
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|