_

internal/domain/models.go

@@ -113,6 +113,7 @@ type VerifyRequest struct {
 // VerifyResponse represents a token verification response
 type VerifyResponse struct {
 	Valid               bool              `json:"valid"`
+	Permitted           bool              `json:"permitted"`
 	UserID              string            `json:"user_id,omitempty"`
 	Permissions         []string          `json:"permissions"`
 	PermissionResults   map[string]bool   `json:"permission_results,omitempty"`

internal/services/token_service.go

@@ -212,6 +212,7 @@ func (s *tokenService) VerifyToken(ctx context.Context, req *domain.VerifyReques
 	if req.Token == "" {
 		return &domain.VerifyResponse{
 			Valid:     false,
+			Permitted: false,
 			Error:     "Token is required",
 		}, nil
 	}
@@ -222,6 +223,7 @@ func (s *tokenService) VerifyToken(ctx context.Context, req *domain.VerifyReques
 		s.logger.Error("Failed to get application", zap.Error(err), zap.String("app_id", req.AppID))
 		return &domain.VerifyResponse{
 			Valid:     false,
+			Permitted: false,
 			Error:     "Invalid application",
 		}, nil
 	}
@@ -234,6 +236,7 @@ func (s *tokenService) VerifyToken(ctx context.Context, req *domain.VerifyReques
 	default:
 		return &domain.VerifyResponse{
 			Valid:     false,
+			Permitted: false,
 			Error:     "Invalid token type",
 		}, nil
 	}
@@ -248,6 +251,7 @@ func (s *tokenService) verifyStaticToken(ctx context.Context, req *domain.Verify
 		s.logger.Warn("Invalid token format", zap.String("app_id", req.AppID))
 		return &domain.VerifyResponse{
 			Valid:     false,
+			Permitted: false,
 			Error:     "Invalid token format",
 		}, nil
 	}
@@ -258,6 +262,7 @@ func (s *tokenService) verifyStaticToken(ctx context.Context, req *domain.Verify
 		s.logger.Error("Failed to get tokens for app", zap.Error(err), zap.String("app_id", req.AppID))
 		return &domain.VerifyResponse{
 			Valid:     false,
+			Permitted: false,
 			Error:     "Token verification failed",
 		}, nil
 	}
@@ -274,6 +279,7 @@ func (s *tokenService) verifyStaticToken(ctx context.Context, req *domain.Verify
 		s.logger.Warn("Token not found or invalid", zap.String("app_id", req.AppID))
 		return &domain.VerifyResponse{
 			Valid:     false,
+			Permitted: false,
 			Error:     "Invalid token",
 		}, nil
 	}
@@ -284,30 +290,44 @@ func (s *tokenService) verifyStaticToken(ctx context.Context, req *domain.Verify
 		s.logger.Error("Failed to get token permissions", zap.Error(err), zap.String("token_id", matchedToken.ID.String()))
 		return &domain.VerifyResponse{
 			Valid:     false,
+			Permitted: false,
 			Error:     "Failed to retrieve permissions",
 		}, nil
 	}
 
 	// Check specific permissions if requested
 	var permissionResults map[string]bool
+	var permitted bool = true // Default to true if no specific permissions requested
+	
 	if len(req.Permissions) > 0 {
 		permissionResults, err = s.grantRepo.HasAnyPermission(ctx, domain.TokenTypeStatic, matchedToken.ID, req.Permissions)
 		if err != nil {
 			s.logger.Error("Failed to check specific permissions", zap.Error(err))
 			return &domain.VerifyResponse{
 				Valid:     false,
+				Permitted: false,
 				Error:     "Failed to check permissions",
 			}, nil
 		}
+		
+		// Check if all requested permissions are granted
+		for _, requestedPerm := range req.Permissions {
+			if hasPermission, exists := permissionResults[requestedPerm]; !exists || !hasPermission {
+				permitted = false
+				break
+			}
+		}
 	}
 
 	s.logger.Info("Static token verified successfully", 
 		zap.String("token_id", matchedToken.ID.String()),
 		zap.String("app_id", req.AppID),
-		zap.Strings("permissions", permissions))
+		zap.Strings("permissions", permissions),
+		zap.Bool("permitted", permitted))
 
 	return &domain.VerifyResponse{
 		Valid:             true,
+		Permitted:         permitted,
 		Permissions:       permissions,
 		PermissionResults: permissionResults,
 		TokenType:         domain.TokenTypeStatic,
@@ -322,6 +342,7 @@ func (s *tokenService) verifyUserToken(ctx context.Context, req *domain.VerifyRe
 	// For now, return an error since user tokens are not fully implemented
 	return &domain.VerifyResponse{
 		Valid:     false,
+		Permitted: false,
 		Error:     "User token verification not yet implemented",
 	}, nil
 }