init
This commit is contained in:
@@ -1,18 +1,17 @@
|
||||
use crate::models::{
|
||||
category, channel, computed_permission, group, group_member, group_permission, server, user,
|
||||
user_permission,
|
||||
channel, channel_role_permission, channel_user_permission, computed_permission, role_user,
|
||||
server_role_permission, server_user,
|
||||
};
|
||||
use crate::permissions::{ChannelPermission, ServerPermission};
|
||||
use crate::repositories::{AnyResult, RepositoryContext};
|
||||
// use sea_orm::prelude::*;
|
||||
use sea_orm::{ActiveModelTrait, ColumnTrait, EntityTrait, QueryFilter, Set, TransactionTrait};
|
||||
use std::collections::HashMap;
|
||||
|
||||
use crate::models::channel::ChannelType;
|
||||
use crate::models::computed_permission::PermissionScopeType;
|
||||
use crate::permissions::{ChannelPermission, ServerPermission, VoicePermission};
|
||||
use sea_orm::{ColumnTrait, EntityTrait, QueryFilter, QuerySelect, Set, TransactionTrait};
|
||||
use std::collections::HashMap;
|
||||
use std::sync::Arc;
|
||||
use uuid::Uuid;
|
||||
|
||||
use crate::models::computed_permission::PermissionScopeType;
|
||||
|
||||
#[derive(Clone, Debug)]
|
||||
pub struct ComputedPermissionRepository {
|
||||
pub context: Arc<RepositoryContext>,
|
||||
@@ -20,171 +19,178 @@ pub struct ComputedPermissionRepository {
|
||||
|
||||
impl ComputedPermissionRepository {
|
||||
pub async fn get_all(&self) -> AnyResult<Vec<computed_permission::Model>> {
|
||||
let result = computed_permission::Entity::find()
|
||||
Ok(computed_permission::Entity::find()
|
||||
.all(&self.context.db)
|
||||
.await?;
|
||||
Ok(result)
|
||||
.await?)
|
||||
}
|
||||
|
||||
/// Recalcule le cache de permissions pour tous les utilisateurs du serveur.
|
||||
pub async fn full_sync_server(&self, server_id: Uuid) -> AnyResult<()> {
|
||||
let user_ids = server_user::Entity::find()
|
||||
.filter(server_user::Column::ServerId.eq(server_id))
|
||||
.select_only()
|
||||
.column(server_user::Column::UserId)
|
||||
.into_tuple::<Uuid>()
|
||||
.all(&self.context.db)
|
||||
.await?;
|
||||
|
||||
for user_id in user_ids {
|
||||
self.full_sync_user(user_id, server_id).await?;
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Recalcule le cache de permissions d'un utilisateur sur un serveur.
|
||||
///
|
||||
/// Les permissions effectives sont composées de :
|
||||
///
|
||||
/// - permissions serveur accordées aux rôles de l'utilisateur ;
|
||||
/// - permissions de canal accordées aux rôles de l'utilisateur ;
|
||||
/// - permissions directes de l'utilisateur dans les canaux.
|
||||
pub async fn full_sync_user(&self, user_id: Uuid, server_id: Uuid) -> AnyResult<()> {
|
||||
// 1. Récupérer la structure (tous les salons + catégories du serveur)
|
||||
// 2. Récupérer les sources de vérité (Groupes de l'user + Perms individuelles)
|
||||
// 3. Calculer pour l'UUID du serveur (Pseudo-salon pour le Kick/Ban)
|
||||
// 4. Pour chaque salon, calculer la fusion des bits
|
||||
// 5. Tout enregistrer en une seule transaction dans `computed_permission`
|
||||
// ---------------------------------------------------------------------
|
||||
// Rôles de l'utilisateur
|
||||
// ---------------------------------------------------------------------
|
||||
|
||||
// Récupération du serveur
|
||||
let server = server::Entity::find_by_id(server_id)
|
||||
.one(&self.context.db)
|
||||
.await?;
|
||||
|
||||
// Récupération de l'utilisateur
|
||||
let user = user::Entity::find_by_id(user_id)
|
||||
.one(&self.context.db)
|
||||
.await?;
|
||||
|
||||
// Récupération des groupes de l'utilisateur
|
||||
let groups = group::Entity::find()
|
||||
.filter(group::Column::ServerId.eq(server_id))
|
||||
.filter(group_member::Column::UserId.eq(user_id))
|
||||
let role_ids = role_user::Entity::find()
|
||||
.filter(role_user::Column::UserId.eq(user_id))
|
||||
.select_only()
|
||||
.column(role_user::Column::RoleId)
|
||||
.into_tuple::<Uuid>()
|
||||
.all(&self.context.db)
|
||||
.await?;
|
||||
|
||||
// Récupération de toutes les catégories du serveur
|
||||
let categories = category::Entity::find()
|
||||
.filter(category::Column::ServerId.eq(server_id))
|
||||
.all(&self.context.db)
|
||||
.await?;
|
||||
// ---------------------------------------------------------------------
|
||||
// Permissions serveur des rôles
|
||||
// ---------------------------------------------------------------------
|
||||
|
||||
let mut server_permissions = ServerPermission::empty();
|
||||
|
||||
if !role_ids.is_empty() {
|
||||
let role_permissions = server_role_permission::Entity::find()
|
||||
.filter(server_role_permission::Column::ServerId.eq(server_id))
|
||||
.filter(server_role_permission::Column::RoleId.is_in(role_ids.clone()))
|
||||
.all(&self.context.db)
|
||||
.await?;
|
||||
|
||||
for permission in role_permissions {
|
||||
server_permissions |=
|
||||
ServerPermission::from_bits_retain(permission.permission as u64);
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------
|
||||
// Canaux du serveur
|
||||
// ---------------------------------------------------------------------
|
||||
|
||||
// Récupération de toutes les channels du serveur
|
||||
let channels = channel::Entity::find()
|
||||
.filter(channel::Column::ServerId.eq(server_id))
|
||||
.all(&self.context.db)
|
||||
.await?;
|
||||
|
||||
// retrieve permissions
|
||||
let user_permissions = user_permission::Entity::find()
|
||||
.filter(user_permission::Column::UserId.eq(user_id))
|
||||
.filter(user_permission::Column::ServerId.eq(server_id))
|
||||
.all(&self.context.db)
|
||||
.await?;
|
||||
let channel_ids: Vec<Uuid> = channels.iter().map(|channel| channel.id).collect();
|
||||
|
||||
let group_permissions = group_permission::Entity::find()
|
||||
.filter(group_permission::Column::ServerId.eq(server_id))
|
||||
.filter(group_member::Column::UserId.eq(user_id))
|
||||
.all(&self.context.db)
|
||||
.await?;
|
||||
// ---------------------------------------------------------------------
|
||||
// Permissions de rôles pour tous les canaux
|
||||
// ---------------------------------------------------------------------
|
||||
|
||||
// computed existing permissions
|
||||
struct VirtualComputedPermission {
|
||||
server_permissions: i64,
|
||||
channel_permissions: i64,
|
||||
voice_permissions: i64,
|
||||
}
|
||||
let mut all_permissions: HashMap<Uuid, Vec<VirtualComputedPermission>> = HashMap::new();
|
||||
let role_channel_permissions = if role_ids.is_empty() || channel_ids.is_empty() {
|
||||
Vec::new()
|
||||
} else {
|
||||
channel_role_permission::Entity::find()
|
||||
.filter(channel_role_permission::Column::ChannelId.is_in(channel_ids.clone()))
|
||||
.filter(channel_role_permission::Column::RoleId.is_in(role_ids))
|
||||
.all(&self.context.db)
|
||||
.await?
|
||||
};
|
||||
|
||||
user_permissions.into_iter().for_each(|user_permission| {
|
||||
let permission = VirtualComputedPermission {
|
||||
server_permissions: user_permission.server_permissions,
|
||||
channel_permissions: user_permission.channel_permissions,
|
||||
voice_permissions: user_permission.voice_permissions,
|
||||
};
|
||||
let mut permissions_by_channel: HashMap<Uuid, ChannelPermission> = HashMap::new();
|
||||
|
||||
all_permissions
|
||||
.entry(user_permission.scope_id) // vérifier que la clé existe dans la HashMap
|
||||
.or_default() // appel Vec::new() automatiquement
|
||||
.push(permission); // insert la permission dans le Vec
|
||||
});
|
||||
|
||||
group_permissions.into_iter().for_each(|group_permission| {
|
||||
let permission = VirtualComputedPermission {
|
||||
server_permissions: group_permission.server_permissions,
|
||||
channel_permissions: group_permission.channel_permissions,
|
||||
voice_permissions: group_permission.voice_permissions,
|
||||
};
|
||||
|
||||
all_permissions
|
||||
.entry(group_permission.scope_id)
|
||||
for permission in role_channel_permissions {
|
||||
permissions_by_channel
|
||||
.entry(permission.channel_id)
|
||||
.or_default()
|
||||
.push(permission);
|
||||
});
|
||||
|
||||
// Compute permissions
|
||||
let mut computed_permissions: Vec<computed_permission::ActiveModel> = Vec::new();
|
||||
// server
|
||||
let mut server_permissions = ServerPermission::empty();
|
||||
match all_permissions.get(&server_id) {
|
||||
Some(perm) => {
|
||||
for permission in perm {
|
||||
server_permissions |=
|
||||
ServerPermission::from_bits_retain(permission.server_permissions as u64);
|
||||
}
|
||||
|
||||
computed_permissions.push(computed_permission::ActiveModel {
|
||||
user_id: Set(user_id),
|
||||
server_id: Set(server_id),
|
||||
scope_type: Set(PermissionScopeType::Server),
|
||||
resource_id: Set(server_id),
|
||||
server_permissions: Set(server_permissions.bits() as i64),
|
||||
channel_permissions: Set(ChannelPermission::empty().bits() as i64),
|
||||
voice_permissions: Set(ChannelPermission::empty().bits() as i64),
|
||||
});
|
||||
}
|
||||
None => {}
|
||||
.insert(ChannelPermission::from_bits_retain(
|
||||
permission.permission as u64,
|
||||
));
|
||||
}
|
||||
|
||||
// Category
|
||||
// todo : à faire
|
||||
// ---------------------------------------------------------------------
|
||||
// Permissions directes de l'utilisateur pour tous les canaux
|
||||
// ---------------------------------------------------------------------
|
||||
|
||||
let user_channel_permissions = if channel_ids.is_empty() {
|
||||
Vec::new()
|
||||
} else {
|
||||
channel_user_permission::Entity::find()
|
||||
.filter(channel_user_permission::Column::UserId.eq(user_id))
|
||||
.filter(channel_user_permission::Column::ChannelId.is_in(channel_ids))
|
||||
.all(&self.context.db)
|
||||
.await?
|
||||
};
|
||||
|
||||
for permission in user_channel_permissions {
|
||||
permissions_by_channel
|
||||
.entry(permission.channel_id)
|
||||
.or_default()
|
||||
.insert(ChannelPermission::from_bits_retain(
|
||||
permission.permission as u64,
|
||||
));
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------
|
||||
// Construction du cache
|
||||
// ---------------------------------------------------------------------
|
||||
|
||||
let mut computed_permissions = Vec::with_capacity(channels.len().saturating_add(1));
|
||||
|
||||
// Permissions au niveau serveur.
|
||||
computed_permissions.push(computed_permission::ActiveModel {
|
||||
user_id: Set(user_id),
|
||||
server_id: Set(server_id),
|
||||
scope_type: Set(PermissionScopeType::Server),
|
||||
resource_id: Set(server_id),
|
||||
server_permissions: Set(server_permissions.bits() as i64),
|
||||
..Default::default()
|
||||
});
|
||||
|
||||
// Permissions au niveau canal.
|
||||
for channel in channels {
|
||||
let channel_permissions = permissions_by_channel
|
||||
.remove(&channel.id)
|
||||
.unwrap_or_else(ChannelPermission::empty);
|
||||
|
||||
// channels
|
||||
channels.into_iter().for_each(|channel| {
|
||||
let mut channel_permissions = ChannelPermission::empty();
|
||||
let mut voice_permissions = VoicePermission::empty();
|
||||
match all_permissions.get(&channel.id) {
|
||||
Some(perm) => {
|
||||
for permission in perm {
|
||||
channel_permissions |= ChannelPermission::from_bits_retain(
|
||||
permission.channel_permissions as u64,
|
||||
);
|
||||
if channel.channel_type == ChannelType::Voice {
|
||||
voice_permissions |= VoicePermission::from_bits_retain(
|
||||
permission.voice_permissions as u64,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
None => {}
|
||||
}
|
||||
computed_permissions.push(computed_permission::ActiveModel {
|
||||
user_id: Set(user_id),
|
||||
server_id: Set(server_id),
|
||||
scope_type: Set(PermissionScopeType::Channel),
|
||||
resource_id: Set(channel.id),
|
||||
server_permissions: Set(ServerPermission::empty().bits() as i64),
|
||||
channel_permissions: Set(channel_permissions.bits() as i64),
|
||||
voice_permissions: Set(voice_permissions.bits() as i64),
|
||||
..Default::default()
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------
|
||||
// Remplacement atomique du cache
|
||||
// ---------------------------------------------------------------------
|
||||
|
||||
// apply in the DB
|
||||
self.context
|
||||
.db
|
||||
.transaction::<_, (), anyhow::Error>(|txn| {
|
||||
.transaction::<_, (), anyhow::Error>(|transaction| {
|
||||
Box::pin(async move {
|
||||
computed_permission::Entity::delete_many()
|
||||
.filter(computed_permission::Column::UserId.eq(user_id))
|
||||
.filter(computed_permission::Column::ServerId.eq(server_id))
|
||||
.exec(txn)
|
||||
.exec(transaction)
|
||||
.await?;
|
||||
|
||||
if !computed_permissions.is_empty() {
|
||||
computed_permission::Entity::insert_many(computed_permissions)
|
||||
.exec(txn)
|
||||
.exec(transaction)
|
||||
.await?;
|
||||
}
|
||||
|
||||
Ok(())
|
||||
})
|
||||
})
|
||||
|
||||
Reference in New Issue
Block a user