This commit is contained in:
2026-07-13 01:38:36 +02:00
parent ede38cc042
commit 09cf5f37fb
16 changed files with 747 additions and 644 deletions
+134 -128
View File
@@ -1,18 +1,17 @@
use crate::models::{
category, channel, computed_permission, group, group_member, group_permission, server, user,
user_permission,
channel, channel_role_permission, channel_user_permission, computed_permission, role_user,
server_role_permission, server_user,
};
use crate::permissions::{ChannelPermission, ServerPermission};
use crate::repositories::{AnyResult, RepositoryContext};
// use sea_orm::prelude::*;
use sea_orm::{ActiveModelTrait, ColumnTrait, EntityTrait, QueryFilter, Set, TransactionTrait};
use std::collections::HashMap;
use crate::models::channel::ChannelType;
use crate::models::computed_permission::PermissionScopeType;
use crate::permissions::{ChannelPermission, ServerPermission, VoicePermission};
use sea_orm::{ColumnTrait, EntityTrait, QueryFilter, QuerySelect, Set, TransactionTrait};
use std::collections::HashMap;
use std::sync::Arc;
use uuid::Uuid;
use crate::models::computed_permission::PermissionScopeType;
#[derive(Clone, Debug)]
pub struct ComputedPermissionRepository {
pub context: Arc<RepositoryContext>,
@@ -20,171 +19,178 @@ pub struct ComputedPermissionRepository {
impl ComputedPermissionRepository {
pub async fn get_all(&self) -> AnyResult<Vec<computed_permission::Model>> {
let result = computed_permission::Entity::find()
Ok(computed_permission::Entity::find()
.all(&self.context.db)
.await?;
Ok(result)
.await?)
}
/// Recalcule le cache de permissions pour tous les utilisateurs du serveur.
pub async fn full_sync_server(&self, server_id: Uuid) -> AnyResult<()> {
let user_ids = server_user::Entity::find()
.filter(server_user::Column::ServerId.eq(server_id))
.select_only()
.column(server_user::Column::UserId)
.into_tuple::<Uuid>()
.all(&self.context.db)
.await?;
for user_id in user_ids {
self.full_sync_user(user_id, server_id).await?;
}
Ok(())
}
/// Recalcule le cache de permissions d'un utilisateur sur un serveur.
///
/// Les permissions effectives sont composées de :
///
/// - permissions serveur accordées aux rôles de l'utilisateur ;
/// - permissions de canal accordées aux rôles de l'utilisateur ;
/// - permissions directes de l'utilisateur dans les canaux.
pub async fn full_sync_user(&self, user_id: Uuid, server_id: Uuid) -> AnyResult<()> {
// 1. Récupérer la structure (tous les salons + catégories du serveur)
// 2. Récupérer les sources de vérité (Groupes de l'user + Perms individuelles)
// 3. Calculer pour l'UUID du serveur (Pseudo-salon pour le Kick/Ban)
// 4. Pour chaque salon, calculer la fusion des bits
// 5. Tout enregistrer en une seule transaction dans `computed_permission`
// ---------------------------------------------------------------------
// Rôles de l'utilisateur
// ---------------------------------------------------------------------
// Récupération du serveur
let server = server::Entity::find_by_id(server_id)
.one(&self.context.db)
.await?;
// Récupération de l'utilisateur
let user = user::Entity::find_by_id(user_id)
.one(&self.context.db)
.await?;
// Récupération des groupes de l'utilisateur
let groups = group::Entity::find()
.filter(group::Column::ServerId.eq(server_id))
.filter(group_member::Column::UserId.eq(user_id))
let role_ids = role_user::Entity::find()
.filter(role_user::Column::UserId.eq(user_id))
.select_only()
.column(role_user::Column::RoleId)
.into_tuple::<Uuid>()
.all(&self.context.db)
.await?;
// Récupération de toutes les catégories du serveur
let categories = category::Entity::find()
.filter(category::Column::ServerId.eq(server_id))
.all(&self.context.db)
.await?;
// ---------------------------------------------------------------------
// Permissions serveur des rôles
// ---------------------------------------------------------------------
let mut server_permissions = ServerPermission::empty();
if !role_ids.is_empty() {
let role_permissions = server_role_permission::Entity::find()
.filter(server_role_permission::Column::ServerId.eq(server_id))
.filter(server_role_permission::Column::RoleId.is_in(role_ids.clone()))
.all(&self.context.db)
.await?;
for permission in role_permissions {
server_permissions |=
ServerPermission::from_bits_retain(permission.permission as u64);
}
}
// ---------------------------------------------------------------------
// Canaux du serveur
// ---------------------------------------------------------------------
// Récupération de toutes les channels du serveur
let channels = channel::Entity::find()
.filter(channel::Column::ServerId.eq(server_id))
.all(&self.context.db)
.await?;
// retrieve permissions
let user_permissions = user_permission::Entity::find()
.filter(user_permission::Column::UserId.eq(user_id))
.filter(user_permission::Column::ServerId.eq(server_id))
.all(&self.context.db)
.await?;
let channel_ids: Vec<Uuid> = channels.iter().map(|channel| channel.id).collect();
let group_permissions = group_permission::Entity::find()
.filter(group_permission::Column::ServerId.eq(server_id))
.filter(group_member::Column::UserId.eq(user_id))
.all(&self.context.db)
.await?;
// ---------------------------------------------------------------------
// Permissions de rôles pour tous les canaux
// ---------------------------------------------------------------------
// computed existing permissions
struct VirtualComputedPermission {
server_permissions: i64,
channel_permissions: i64,
voice_permissions: i64,
}
let mut all_permissions: HashMap<Uuid, Vec<VirtualComputedPermission>> = HashMap::new();
let role_channel_permissions = if role_ids.is_empty() || channel_ids.is_empty() {
Vec::new()
} else {
channel_role_permission::Entity::find()
.filter(channel_role_permission::Column::ChannelId.is_in(channel_ids.clone()))
.filter(channel_role_permission::Column::RoleId.is_in(role_ids))
.all(&self.context.db)
.await?
};
user_permissions.into_iter().for_each(|user_permission| {
let permission = VirtualComputedPermission {
server_permissions: user_permission.server_permissions,
channel_permissions: user_permission.channel_permissions,
voice_permissions: user_permission.voice_permissions,
};
let mut permissions_by_channel: HashMap<Uuid, ChannelPermission> = HashMap::new();
all_permissions
.entry(user_permission.scope_id) // vérifier que la clé existe dans la HashMap
.or_default() // appel Vec::new() automatiquement
.push(permission); // insert la permission dans le Vec
});
group_permissions.into_iter().for_each(|group_permission| {
let permission = VirtualComputedPermission {
server_permissions: group_permission.server_permissions,
channel_permissions: group_permission.channel_permissions,
voice_permissions: group_permission.voice_permissions,
};
all_permissions
.entry(group_permission.scope_id)
for permission in role_channel_permissions {
permissions_by_channel
.entry(permission.channel_id)
.or_default()
.push(permission);
});
// Compute permissions
let mut computed_permissions: Vec<computed_permission::ActiveModel> = Vec::new();
// server
let mut server_permissions = ServerPermission::empty();
match all_permissions.get(&server_id) {
Some(perm) => {
for permission in perm {
server_permissions |=
ServerPermission::from_bits_retain(permission.server_permissions as u64);
}
computed_permissions.push(computed_permission::ActiveModel {
user_id: Set(user_id),
server_id: Set(server_id),
scope_type: Set(PermissionScopeType::Server),
resource_id: Set(server_id),
server_permissions: Set(server_permissions.bits() as i64),
channel_permissions: Set(ChannelPermission::empty().bits() as i64),
voice_permissions: Set(ChannelPermission::empty().bits() as i64),
});
}
None => {}
.insert(ChannelPermission::from_bits_retain(
permission.permission as u64,
));
}
// Category
// todo : à faire
// ---------------------------------------------------------------------
// Permissions directes de l'utilisateur pour tous les canaux
// ---------------------------------------------------------------------
let user_channel_permissions = if channel_ids.is_empty() {
Vec::new()
} else {
channel_user_permission::Entity::find()
.filter(channel_user_permission::Column::UserId.eq(user_id))
.filter(channel_user_permission::Column::ChannelId.is_in(channel_ids))
.all(&self.context.db)
.await?
};
for permission in user_channel_permissions {
permissions_by_channel
.entry(permission.channel_id)
.or_default()
.insert(ChannelPermission::from_bits_retain(
permission.permission as u64,
));
}
// ---------------------------------------------------------------------
// Construction du cache
// ---------------------------------------------------------------------
let mut computed_permissions = Vec::with_capacity(channels.len().saturating_add(1));
// Permissions au niveau serveur.
computed_permissions.push(computed_permission::ActiveModel {
user_id: Set(user_id),
server_id: Set(server_id),
scope_type: Set(PermissionScopeType::Server),
resource_id: Set(server_id),
server_permissions: Set(server_permissions.bits() as i64),
..Default::default()
});
// Permissions au niveau canal.
for channel in channels {
let channel_permissions = permissions_by_channel
.remove(&channel.id)
.unwrap_or_else(ChannelPermission::empty);
// channels
channels.into_iter().for_each(|channel| {
let mut channel_permissions = ChannelPermission::empty();
let mut voice_permissions = VoicePermission::empty();
match all_permissions.get(&channel.id) {
Some(perm) => {
for permission in perm {
channel_permissions |= ChannelPermission::from_bits_retain(
permission.channel_permissions as u64,
);
if channel.channel_type == ChannelType::Voice {
voice_permissions |= VoicePermission::from_bits_retain(
permission.voice_permissions as u64,
);
}
}
}
None => {}
}
computed_permissions.push(computed_permission::ActiveModel {
user_id: Set(user_id),
server_id: Set(server_id),
scope_type: Set(PermissionScopeType::Channel),
resource_id: Set(channel.id),
server_permissions: Set(ServerPermission::empty().bits() as i64),
channel_permissions: Set(channel_permissions.bits() as i64),
voice_permissions: Set(voice_permissions.bits() as i64),
..Default::default()
});
});
}
// ---------------------------------------------------------------------
// Remplacement atomique du cache
// ---------------------------------------------------------------------
// apply in the DB
self.context
.db
.transaction::<_, (), anyhow::Error>(|txn| {
.transaction::<_, (), anyhow::Error>(|transaction| {
Box::pin(async move {
computed_permission::Entity::delete_many()
.filter(computed_permission::Column::UserId.eq(user_id))
.filter(computed_permission::Column::ServerId.eq(server_id))
.exec(txn)
.exec(transaction)
.await?;
if !computed_permissions.is_empty() {
computed_permission::Entity::insert_many(computed_permissions)
.exec(txn)
.exec(transaction)
.await?;
}
Ok(())
})
})