Files
skybridge/kms/internal/repository/postgres/permission_repository.go
2025-08-26 19:16:41 -04:00

694 lines
19 KiB
Go

package postgres
import (
"context"
"database/sql"
"fmt"
"time"
"github.com/google/uuid"
"github.com/kms/api-key-service/internal/domain"
"github.com/kms/api-key-service/internal/repository"
"github.com/lib/pq"
)
// PermissionRepository implements the PermissionRepository interface for PostgreSQL
type PermissionRepository struct {
db repository.DatabaseProvider
}
// NewPermissionRepository creates a new PostgreSQL permission repository
func NewPermissionRepository(db repository.DatabaseProvider) repository.PermissionRepository {
return &PermissionRepository{db: db}
}
// CreateAvailablePermission creates a new available permission
func (r *PermissionRepository) CreateAvailablePermission(ctx context.Context, permission *domain.AvailablePermission) error {
query := `
INSERT INTO available_permissions (
id, scope, name, description, category, parent_scope,
is_system, created_by, updated_by, created_at, updated_at
) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
`
db := r.db.GetDB().(*sql.DB)
now := time.Now()
if permission.ID == uuid.Nil {
permission.ID = uuid.New()
}
_, err := db.ExecContext(ctx, query,
permission.ID,
permission.Scope,
permission.Name,
permission.Description,
permission.Category,
permission.ParentScope,
permission.IsSystem,
permission.CreatedBy,
permission.UpdatedBy,
now,
now,
)
if err != nil {
return fmt.Errorf("failed to create available permission: %w", err)
}
permission.CreatedAt = now
permission.UpdatedAt = now
return nil
}
// GetAvailablePermission retrieves an available permission by ID
func (r *PermissionRepository) GetAvailablePermission(ctx context.Context, permissionID uuid.UUID) (*domain.AvailablePermission, error) {
query := `
SELECT id, scope, name, description, category, parent_scope,
is_system, created_at, created_by, updated_at, updated_by
FROM available_permissions
WHERE id = $1
`
db := r.db.GetDB().(*sql.DB)
row := db.QueryRowContext(ctx, query, permissionID)
permission := &domain.AvailablePermission{}
err := row.Scan(
&permission.ID,
&permission.Scope,
&permission.Name,
&permission.Description,
&permission.Category,
&permission.ParentScope,
&permission.IsSystem,
&permission.CreatedAt,
&permission.CreatedBy,
&permission.UpdatedAt,
&permission.UpdatedBy,
)
if err != nil {
if err == sql.ErrNoRows {
return nil, fmt.Errorf("permission with ID '%s' not found", permissionID)
}
return nil, fmt.Errorf("failed to get available permission: %w", err)
}
return permission, nil
}
// GetAvailablePermissionByScope retrieves an available permission by scope
func (r *PermissionRepository) GetAvailablePermissionByScope(ctx context.Context, scope string) (*domain.AvailablePermission, error) {
query := `
SELECT id, scope, name, description, category, parent_scope,
is_system, created_at, created_by, updated_at, updated_by
FROM available_permissions
WHERE scope = $1
`
db := r.db.GetDB().(*sql.DB)
row := db.QueryRowContext(ctx, query, scope)
permission := &domain.AvailablePermission{}
err := row.Scan(
&permission.ID,
&permission.Scope,
&permission.Name,
&permission.Description,
&permission.Category,
&permission.ParentScope,
&permission.IsSystem,
&permission.CreatedAt,
&permission.CreatedBy,
&permission.UpdatedAt,
&permission.UpdatedBy,
)
if err != nil {
if err == sql.ErrNoRows {
return nil, fmt.Errorf("permission with scope '%s' not found", scope)
}
return nil, fmt.Errorf("failed to get available permission by scope: %w", err)
}
return permission, nil
}
// ListAvailablePermissions retrieves available permissions with pagination and filtering
func (r *PermissionRepository) ListAvailablePermissions(ctx context.Context, category string, includeSystem bool, limit, offset int) ([]*domain.AvailablePermission, error) {
var args []interface{}
var whereClauses []string
argIndex := 1
// Build WHERE clause based on filters
if category != "" {
whereClauses = append(whereClauses, fmt.Sprintf("category = $%d", argIndex))
args = append(args, category)
argIndex++
}
if !includeSystem {
whereClauses = append(whereClauses, fmt.Sprintf("is_system = $%d", argIndex))
args = append(args, false)
argIndex++
}
whereClause := ""
if len(whereClauses) > 0 {
whereClause = "WHERE " + fmt.Sprintf("%s", whereClauses[0])
for i := 1; i < len(whereClauses); i++ {
whereClause += " AND " + whereClauses[i]
}
}
query := fmt.Sprintf(`
SELECT id, scope, name, description, category, parent_scope,
is_system, created_at, created_by, updated_at, updated_by
FROM available_permissions
%s
ORDER BY category, scope
LIMIT $%d OFFSET $%d
`, whereClause, argIndex, argIndex+1)
args = append(args, limit, offset)
db := r.db.GetDB().(*sql.DB)
rows, err := db.QueryContext(ctx, query, args...)
if err != nil {
return nil, fmt.Errorf("failed to list available permissions: %w", err)
}
defer rows.Close()
var permissions []*domain.AvailablePermission
for rows.Next() {
permission := &domain.AvailablePermission{}
err := rows.Scan(
&permission.ID,
&permission.Scope,
&permission.Name,
&permission.Description,
&permission.Category,
&permission.ParentScope,
&permission.IsSystem,
&permission.CreatedAt,
&permission.CreatedBy,
&permission.UpdatedAt,
&permission.UpdatedBy,
)
if err != nil {
return nil, fmt.Errorf("failed to scan available permission: %w", err)
}
permissions = append(permissions, permission)
}
if err = rows.Err(); err != nil {
return nil, fmt.Errorf("failed to iterate available permissions: %w", err)
}
return permissions, nil
}
// UpdateAvailablePermission updates an available permission
func (r *PermissionRepository) UpdateAvailablePermission(ctx context.Context, permissionID uuid.UUID, permission *domain.AvailablePermission) error {
query := `
UPDATE available_permissions
SET scope = $2, name = $3, description = $4, category = $5,
parent_scope = $6, is_system = $7, updated_by = $8, updated_at = $9
WHERE id = $1
`
db := r.db.GetDB().(*sql.DB)
now := time.Now()
result, err := db.ExecContext(ctx, query,
permissionID,
permission.Scope,
permission.Name,
permission.Description,
permission.Category,
permission.ParentScope,
permission.IsSystem,
permission.UpdatedBy,
now,
)
if err != nil {
return fmt.Errorf("failed to update available permission: %w", err)
}
rowsAffected, err := result.RowsAffected()
if err != nil {
return fmt.Errorf("failed to get rows affected: %w", err)
}
if rowsAffected == 0 {
return fmt.Errorf("permission with ID %s not found", permissionID)
}
permission.UpdatedAt = now
return nil
}
// DeleteAvailablePermission deletes an available permission
func (r *PermissionRepository) DeleteAvailablePermission(ctx context.Context, permissionID uuid.UUID) error {
// First check if the permission has any child permissions
checkChildrenQuery := `
SELECT COUNT(*) FROM available_permissions
WHERE parent_scope = (SELECT scope FROM available_permissions WHERE id = $1)
`
db := r.db.GetDB().(*sql.DB)
var childCount int
err := db.QueryRowContext(ctx, checkChildrenQuery, permissionID).Scan(&childCount)
if err != nil {
return fmt.Errorf("failed to check for child permissions: %w", err)
}
if childCount > 0 {
return fmt.Errorf("cannot delete permission: it has %d child permissions", childCount)
}
// Check if the permission is granted to any tokens
checkGrantsQuery := `
SELECT COUNT(*) FROM granted_permissions
WHERE permission_id = $1 AND revoked = false
`
var grantCount int
err = db.QueryRowContext(ctx, checkGrantsQuery, permissionID).Scan(&grantCount)
if err != nil {
return fmt.Errorf("failed to check for active grants: %w", err)
}
if grantCount > 0 {
return fmt.Errorf("cannot delete permission: it is currently granted to %d tokens", grantCount)
}
// Delete the permission
deleteQuery := `DELETE FROM available_permissions WHERE id = $1`
result, err := db.ExecContext(ctx, deleteQuery, permissionID)
if err != nil {
return fmt.Errorf("failed to delete available permission: %w", err)
}
rowsAffected, err := result.RowsAffected()
if err != nil {
return fmt.Errorf("failed to get rows affected: %w", err)
}
if rowsAffected == 0 {
return fmt.Errorf("permission with ID %s not found", permissionID)
}
return nil
}
// ValidatePermissionScopes checks if all given scopes exist and are valid
func (r *PermissionRepository) ValidatePermissionScopes(ctx context.Context, scopes []string) ([]string, error) {
if len(scopes) == 0 {
return []string{}, nil
}
query := `
SELECT scope
FROM available_permissions
WHERE scope = ANY($1)
`
db := r.db.GetDB().(*sql.DB)
rows, err := db.QueryContext(ctx, query, pq.Array(scopes))
if err != nil {
return nil, fmt.Errorf("failed to validate permission scopes: %w", err)
}
defer rows.Close()
validScopes := make(map[string]bool)
for rows.Next() {
var scope string
if err := rows.Scan(&scope); err != nil {
return nil, fmt.Errorf("failed to scan scope: %w", err)
}
validScopes[scope] = true
}
if err = rows.Err(); err != nil {
return nil, fmt.Errorf("error iterating scopes: %w", err)
}
var result []string
for _, scope := range scopes {
if validScopes[scope] {
result = append(result, scope)
}
}
return result, nil
}
// GetPermissionHierarchy returns all parent and child permissions for given scopes
func (r *PermissionRepository) GetPermissionHierarchy(ctx context.Context, scopes []string) ([]*domain.AvailablePermission, error) {
if len(scopes) == 0 {
return []*domain.AvailablePermission{}, nil
}
// Use recursive CTE to get full hierarchy
query := `
WITH RECURSIVE permission_hierarchy AS (
-- Base case: get permissions matching the input scopes
SELECT id, scope, name, description, category, parent_scope,
is_system, created_at, created_by, updated_at, updated_by, 0 as level
FROM available_permissions
WHERE scope = ANY($1)
UNION ALL
-- Recursive case: get all parents and children
SELECT ap.id, ap.scope, ap.name, ap.description, ap.category, ap.parent_scope,
ap.is_system, ap.created_at, ap.created_by, ap.updated_at, ap.updated_by,
ph.level + 1 as level
FROM available_permissions ap
JOIN permission_hierarchy ph ON (
-- Get parents (where ap.scope = ph.parent_scope)
ap.scope = ph.parent_scope
OR
-- Get children (where ap.parent_scope = ph.scope)
ap.parent_scope = ph.scope
)
WHERE ph.level < 5 -- Prevent infinite recursion
)
SELECT DISTINCT id, scope, name, description, category, parent_scope,
is_system, created_at, created_by, updated_at, updated_by
FROM permission_hierarchy
ORDER BY scope
`
db := r.db.GetDB().(*sql.DB)
rows, err := db.QueryContext(ctx, query, pq.Array(scopes))
if err != nil {
return nil, fmt.Errorf("failed to get permission hierarchy: %w", err)
}
defer rows.Close()
var permissions []*domain.AvailablePermission
for rows.Next() {
permission := &domain.AvailablePermission{}
err := rows.Scan(
&permission.ID,
&permission.Scope,
&permission.Name,
&permission.Description,
&permission.Category,
&permission.ParentScope,
&permission.IsSystem,
&permission.CreatedAt,
&permission.CreatedBy,
&permission.UpdatedAt,
&permission.UpdatedBy,
)
if err != nil {
return nil, fmt.Errorf("failed to scan permission hierarchy: %w", err)
}
permissions = append(permissions, permission)
}
if err = rows.Err(); err != nil {
return nil, fmt.Errorf("failed to iterate permission hierarchy: %w", err)
}
return permissions, nil
}
// GrantedPermissionRepository implements the GrantedPermissionRepository interface for PostgreSQL
type GrantedPermissionRepository struct {
db repository.DatabaseProvider
}
// NewGrantedPermissionRepository creates a new PostgreSQL granted permission repository
func NewGrantedPermissionRepository(db repository.DatabaseProvider) repository.GrantedPermissionRepository {
return &GrantedPermissionRepository{db: db}
}
// GrantPermissions grants multiple permissions to a token
func (r *GrantedPermissionRepository) GrantPermissions(ctx context.Context, grants []*domain.GrantedPermission) error {
if len(grants) == 0 {
return nil
}
db := r.db.GetDB().(*sql.DB)
tx, err := db.BeginTx(ctx, nil)
if err != nil {
return fmt.Errorf("failed to begin transaction: %w", err)
}
defer tx.Rollback()
query := `
INSERT INTO granted_permissions (
id, token_type, token_id, permission_id, scope, created_by, created_at
) VALUES ($1, $2, $3, $4, $5, $6, $7)
ON CONFLICT (token_type, token_id, permission_id) DO NOTHING
`
stmt, err := tx.PrepareContext(ctx, query)
if err != nil {
return fmt.Errorf("failed to prepare statement: %w", err)
}
defer stmt.Close()
now := time.Now()
for _, grant := range grants {
if grant.ID == uuid.Nil {
grant.ID = uuid.New()
}
_, err = stmt.ExecContext(ctx,
grant.ID,
string(grant.TokenType),
grant.TokenID,
grant.PermissionID,
grant.Scope,
grant.CreatedBy,
now,
)
if err != nil {
return fmt.Errorf("failed to grant permission: %w", err)
}
grant.CreatedAt = now
}
if err = tx.Commit(); err != nil {
return fmt.Errorf("failed to commit transaction: %w", err)
}
return nil
}
// GetGrantedPermissions retrieves all granted permissions for a token
func (r *GrantedPermissionRepository) GetGrantedPermissions(ctx context.Context, tokenType domain.TokenType, tokenID uuid.UUID) ([]*domain.GrantedPermission, error) {
query := `
SELECT id, token_type, token_id, permission_id, scope, created_at, created_by, revoked
FROM granted_permissions
WHERE token_type = $1 AND token_id = $2 AND revoked = false
ORDER BY created_at ASC
`
db := r.db.GetDB().(*sql.DB)
rows, err := db.QueryContext(ctx, query, string(tokenType), tokenID)
if err != nil {
return nil, fmt.Errorf("failed to query granted permissions: %w", err)
}
defer rows.Close()
var permissions []*domain.GrantedPermission
for rows.Next() {
perm := &domain.GrantedPermission{}
var tokenTypeStr string
err := rows.Scan(
&perm.ID,
&tokenTypeStr,
&perm.TokenID,
&perm.PermissionID,
&perm.Scope,
&perm.CreatedAt,
&perm.CreatedBy,
&perm.Revoked,
)
if err != nil {
return nil, fmt.Errorf("failed to scan granted permission: %w", err)
}
perm.TokenType = domain.TokenType(tokenTypeStr)
permissions = append(permissions, perm)
}
if err = rows.Err(); err != nil {
return nil, fmt.Errorf("error iterating granted permissions: %w", err)
}
return permissions, nil
}
// GetGrantedPermissionScopes retrieves only the scopes for a token (more efficient)
func (r *GrantedPermissionRepository) GetGrantedPermissionScopes(ctx context.Context, tokenType domain.TokenType, tokenID uuid.UUID) ([]string, error) {
query := `
SELECT scope
FROM granted_permissions
WHERE token_type = $1 AND token_id = $2 AND revoked = false
ORDER BY scope ASC
`
db := r.db.GetDB().(*sql.DB)
rows, err := db.QueryContext(ctx, query, string(tokenType), tokenID)
if err != nil {
return nil, fmt.Errorf("failed to query granted permission scopes: %w", err)
}
defer rows.Close()
var scopes []string
for rows.Next() {
var scope string
if err := rows.Scan(&scope); err != nil {
return nil, fmt.Errorf("failed to scan permission scope: %w", err)
}
scopes = append(scopes, scope)
}
if err = rows.Err(); err != nil {
return nil, fmt.Errorf("error iterating permission scopes: %w", err)
}
return scopes, nil
}
// RevokePermission revokes a specific permission from a token
func (r *GrantedPermissionRepository) RevokePermission(ctx context.Context, grantID uuid.UUID, revokedBy string) error {
query := `
UPDATE granted_permissions
SET revoked = true, revoked_by = $2, revoked_at = $3
WHERE id = $1 AND revoked = false
`
db := r.db.GetDB().(*sql.DB)
now := time.Now()
result, err := db.ExecContext(ctx, query, grantID, revokedBy, now)
if err != nil {
return fmt.Errorf("failed to revoke permission: %w", err)
}
rowsAffected, err := result.RowsAffected()
if err != nil {
return fmt.Errorf("failed to get rows affected: %w", err)
}
if rowsAffected == 0 {
return fmt.Errorf("permission grant with ID %s not found or already revoked", grantID)
}
return nil
}
// RevokeAllPermissions revokes all permissions from a token
func (r *GrantedPermissionRepository) RevokeAllPermissions(ctx context.Context, tokenType domain.TokenType, tokenID uuid.UUID, revokedBy string) error {
query := `
UPDATE granted_permissions
SET revoked = true, revoked_by = $3, revoked_at = $4
WHERE token_type = $1 AND token_id = $2 AND revoked = false
`
db := r.db.GetDB().(*sql.DB)
now := time.Now()
result, err := db.ExecContext(ctx, query, tokenType, tokenID, revokedBy, now)
if err != nil {
return fmt.Errorf("failed to revoke all permissions: %w", err)
}
rowsAffected, err := result.RowsAffected()
if err != nil {
return fmt.Errorf("failed to get rows affected: %w", err)
}
// Note: rowsAffected being 0 is not necessarily an error here -
// the token might not have had any active permissions
_ = rowsAffected
return nil
}
// HasPermission checks if a token has a specific permission
func (r *GrantedPermissionRepository) HasPermission(ctx context.Context, tokenType domain.TokenType, tokenID uuid.UUID, scope string) (bool, error) {
query := `
SELECT 1
FROM granted_permissions gp
JOIN available_permissions ap ON gp.permission_id = ap.id
WHERE gp.token_type = $1
AND gp.token_id = $2
AND gp.scope = $3
AND gp.revoked = false
LIMIT 1
`
db := r.db.GetDB().(*sql.DB)
var exists int
err := db.QueryRowContext(ctx, query, string(tokenType), tokenID, scope).Scan(&exists)
if err != nil {
if err == sql.ErrNoRows {
return false, nil
}
return false, fmt.Errorf("failed to check permission: %w", err)
}
return true, nil
}
// HasAnyPermission checks if a token has any of the specified permissions
func (r *GrantedPermissionRepository) HasAnyPermission(ctx context.Context, tokenType domain.TokenType, tokenID uuid.UUID, scopes []string) (map[string]bool, error) {
if len(scopes) == 0 {
return make(map[string]bool), nil
}
query := `
SELECT gp.scope
FROM granted_permissions gp
JOIN available_permissions ap ON gp.permission_id = ap.id
WHERE gp.token_type = $1
AND gp.token_id = $2
AND gp.scope = ANY($3)
AND gp.revoked = false
`
db := r.db.GetDB().(*sql.DB)
rows, err := db.QueryContext(ctx, query, string(tokenType), tokenID, pq.Array(scopes))
if err != nil {
return nil, fmt.Errorf("failed to check permissions: %w", err)
}
defer rows.Close()
result := make(map[string]bool)
// Initialize all scopes as false
for _, scope := range scopes {
result[scope] = false
}
// Mark found permissions as true
for rows.Next() {
var scope string
if err := rows.Scan(&scope); err != nil {
return nil, fmt.Errorf("failed to scan permission scope: %w", err)
}
result[scope] = true
}
if err = rows.Err(); err != nil {
return nil, fmt.Errorf("error iterating permission results: %w", err)
}
return result, nil
}