PermissionSetAuthority.cs

Go to the documentation of this file.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading;
using System.Threading.Tasks;
 
using GreenDonut;
 
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Logging;
 
using Tgstation.Server.Api.Rights;
using Tgstation.Server.Host.Authority.Core;
using Tgstation.Server.Host.Database;
using Tgstation.Server.Host.Extensions;
using Tgstation.Server.Host.Models;
using Tgstation.Server.Host.Security;
 
namespace Tgstation.Server.Host.Authority
{
    sealed class PermissionSetAuthority : AuthorityBase, IPermissionSetAuthority
    {
        readonly IPermissionSetsDataLoader permissionSetsDataLoader;
 
        readonly IClaimsPrincipalAccessor claimsPrincipalAccessor;
 
        [DataLoader]
        public static async ValueTask<Dictionary<(long Id, PermissionSetLookupType LookupType), PermissionSet>> GetPermissionSets(
            IReadOnlyList<(long Id, PermissionSetLookupType LookupType)> ids,
            IDatabaseContext databaseContext,
            CancellationToken cancellationToken)
        {
            ArgumentNullException.ThrowIfNull(ids);
            ArgumentNullException.ThrowIfNull(databaseContext);
 
            var idLookups = new List<long>(ids.Count);
            var userIdLookups = new List<long>(ids.Count);
            var groupIdLookups = new List<long>(ids.Count);
 
            foreach (var (id, lookupType) in ids)
                switch (lookupType)
                {
                    case PermissionSetLookupType.Id:
                        idLookups.Add(id);
                        break;
                    case PermissionSetLookupType.UserId:
                        userIdLookups.Add(id);
                        break;
                    case PermissionSetLookupType.GroupId:
                        groupIdLookups.Add(id);
                        break;
                    default:
                        throw new InvalidOperationException($"Invalid {nameof(PermissionSetLookupType)}: {lookupType}");
                }
 
            var selectedPermissionSets = await databaseContext
                .PermissionSets
                .Where(dbModel => idLookups.Contains(dbModel.Id!.Value)
                    || (dbModel.UserId.HasValue && userIdLookups.Contains(dbModel.UserId.Value))
                    || (dbModel.GroupId.HasValue && groupIdLookups.Contains(dbModel.GroupId.Value)))
                .ToListAsync(cancellationToken);
 
            var results = new Dictionary<(long Id, PermissionSetLookupType LookupType), PermissionSet>(selectedPermissionSets.Count * 2);
            foreach (var permissionSet in selectedPermissionSets)
            {
                results.Add((permissionSet.Id!.Value, PermissionSetLookupType.Id), permissionSet);
                if (permissionSet.GroupId.HasValue)
                    results.Add((permissionSet.GroupId.Value, PermissionSetLookupType.GroupId), permissionSet);
                if (permissionSet.UserId.HasValue)
                    results.Add((permissionSet.UserId.Value, PermissionSetLookupType.UserId), permissionSet);
            }
 
            return results;
        }
 
        public PermissionSetAuthority(
            IDatabaseContext databaseContext,
            ILogger<AuthorityBase> logger,
            IPermissionSetsDataLoader permissionSetsDataLoader,
            IClaimsPrincipalAccessor claimsPrincipalAccessor)
            : base(
                  databaseContext,
                  logger)
        {
            this.permissionSetsDataLoader = permissionSetsDataLoader ?? throw new ArgumentNullException(nameof(permissionSetsDataLoader));
            this.claimsPrincipalAccessor = claimsPrincipalAccessor ?? throw new ArgumentNullException(nameof(claimsPrincipalAccessor));
        }
 
        public RequirementsGated<AuthorityResponse<PermissionSet>> GetId(long id, PermissionSetLookupType lookupType, CancellationToken cancellationToken)
        {
            var permissionSetTask = permissionSetsDataLoader.LoadAsync((Id: id, LookupType: lookupType), cancellationToken);
            return new(
                async () =>
                {
                    var userId = claimsPrincipalAccessor.User.GetTgsUserId();
 
                    var groupIdQuery = DatabaseContext
                        .Users
                        .Where(user => user.Id == userId)
                        .Select(user => user.GroupId);
 
                    var permissionSetId = await DatabaseContext
                        .PermissionSets
                        .Where(permissionSet => permissionSet.UserId == userId
                            || groupIdQuery.Contains(permissionSet.GroupId))
                        .Select(permissionSet => permissionSet.Id!.Value)
                        .FirstAsync(cancellationToken);
 
                    if (permissionSetId == id)
                        return null;
 
                    return Flag(AdministrationRights.ReadUsers);
                },
                async () =>
                {
                    var permissionSet = await permissionSetTask;
 
                    if (permissionSet == null)
                        return NotFound<PermissionSet>();
 
                    return new AuthorityResponse<PermissionSet>(permissionSet);
                });
        }
    }
}