oxspeak_server/src/http/permissions.rs

// Unused

use super::context::CurrentUser;
use super::error::HTTPError;
use crate::core::AppState;
use crate::permissions::{ChannelPermission, ServerPermission};
use axum::extract::FromRequestParts;
use axum::http::request::Parts;
use std::ops::Deref;
use uuid::Uuid;

/// An Axum extractor that ensures the currently authenticated user has the specified
/// server permission(s) on a target server.
///
/// The target `server_id` is automatically extracted from path parameters (supporting
/// path parameters named `server_id` or `id`).
///
/// # Superuser Bypass
/// If the user is a superuser (`is_superuser == true`), the permission check automatically passes.
///
/// # Usage Example
/// ```rust
/// use axum::extract::State;
/// use uuid::Uuid;
/// use crate::http::permissions::RequireServerPermission;
/// use crate::permissions::ServerPermission;
/// use crate::core::AppState;
///
/// pub async fn update_server_settings(
///     RequireServerPermission::<{ ServerPermission::MANAGE_SERVER.bits() }>(user): RequireServerPermission<{ ServerPermission::MANAGE_SERVER.bits() }>,
///     State(state): State<AppState>,
///     Path(server_id): Path<Uuid>,
/// ) -> Result<(), HTTPError> {
///     // User has MANAGE_SERVER or is a superuser
///     Ok(())
/// }
/// ```
#[derive(Clone, Debug)]
pub struct RequireServerPermission<const PERM: u64>(pub CurrentUser);

impl<const PERM: u64> Deref for RequireServerPermission<PERM> {
    type Target = CurrentUser;

    fn deref(&self) -> &Self::Target {
        &self.0
    }
}

impl<S, const PERM: u64> FromRequestParts<S> for RequireServerPermission<PERM>
where
    S: Send + Sync,
{
    type Rejection = HTTPError;

    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {
        // 1. Extract CurrentUser (which validates authentication and returns 401 if missing)
        let current_user = CurrentUser::from_request_parts(parts, state).await?;

        // 2. Superuser bypasses all checks
        if current_user.is_superuser {
            return Ok(RequireServerPermission(current_user));
        }

        // 3. Get AppState from extensions
        let app_state = match parts.extensions.get::<AppState>() {
            Some(s) => s.clone(),
            None => {
                return Err(HTTPError::InternalServerError(
                    "AppState missing in request extensions".to_string(),
                ));
            }
        };

        // 4. Extract server_id from path parameters.
        let server_id = match extract_path_param_uuid(parts, &["server_id", "id"]) {
            Some(id) => id,
            None => {
                return Err(HTTPError::BadRequest(
                    "Missing or invalid server_id".to_string(),
                ));
            }
        };

        // 5. Check user permission via server repository
        let permission_result = app_state
            .repositories
            .server
            .get_user_permission(server_id, current_user.id)
            .await;

        let permission_bits = match permission_result {
            Ok(Some(p)) => p.permissions,
            Ok(None) => 0,
            Err(e) => return Err(HTTPError::InternalServerError(e.to_string())),
        };

        let required = ServerPermission::from_bits_truncate(PERM);
        let granted = ServerPermission::from_bits_truncate(permission_bits as u64);

        if granted.contains(required) {
            Ok(RequireServerPermission(current_user))
        } else {
            Err(HTTPError::Forbidden)
        }
    }
}

/// An Axum extractor that ensures the currently authenticated user has the specified
/// channel permission(s) on a target channel.
///
/// The target `channel_id` (or `id`) is automatically extracted from path parameters.
///
/// # Superuser Bypass
/// If the user is a superuser (`is_superuser == true`), the permission check automatically passes.
///
/// # Usage Example
/// ```rust
/// use axum::extract::State;
/// use uuid::Uuid;
/// use crate::http::permissions::RequireChannelPermission;
/// use crate::permissions::ChannelPermission;
/// use crate::core::AppState;
///
/// pub async fn read_channel_messages(
///     RequireChannelPermission::<{ ChannelPermission::READ_CHANNEL.bits() }>(user): RequireChannelPermission<{ ChannelPermission::READ_CHANNEL.bits() }>,
///     State(state): State<AppState>,
///     Path(channel_id): Path<Uuid>,
/// ) -> Result<(), HTTPError> {
///     // User has READ_CHANNEL or is a superuser
///     Ok(())
/// }
/// ```
#[derive(Clone, Debug)]
pub struct RequireChannelPermission<const PERM: u64>(pub CurrentUser);

impl<const PERM: u64> Deref for RequireChannelPermission<PERM> {
    type Target = CurrentUser;

    fn deref(&self) -> &Self::Target {
        &self.0
    }
}

impl<S, const PERM: u64> FromRequestParts<S> for RequireChannelPermission<PERM>
where
    S: Send + Sync,
{
    type Rejection = HTTPError;

    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {
        let current_user = CurrentUser::from_request_parts(parts, state).await?;

        if current_user.is_superuser {
            return Ok(RequireChannelPermission(current_user));
        }

        let app_state = match parts.extensions.get::<AppState>() {
            Some(s) => s.clone(),
            None => {
                return Err(HTTPError::InternalServerError(
                    "AppState missing in request extensions".to_string(),
                ));
            }
        };

        let channel_id = match extract_path_param_uuid(parts, &["channel_id", "id"]) {
            Some(id) => id,
            None => {
                return Err(HTTPError::BadRequest(
                    "Missing or invalid channel_id".to_string(),
                ));
            }
        };

        let permission_result = app_state
            .repositories
            .channel
            .get_user_permission(channel_id, current_user.id)
            .await;

        let permission_bits = match permission_result {
            Ok(Some(p)) => p.permissions,
            Ok(None) => 0,
            Err(e) => return Err(HTTPError::InternalServerError(e.to_string())),
        };

        let required = ChannelPermission::from_bits_truncate(PERM);
        let granted = ChannelPermission::from_bits_truncate(permission_bits as u64);

        if granted.contains(required) {
            Ok(RequireChannelPermission(current_user))
        } else {
            Err(HTTPError::Forbidden)
        }
    }
}

/// Helper function to extract a Uuid path parameter matching any of the given key names
/// from Axum request extensions.
fn extract_path_param_uuid(parts: &Parts, keys: &[&str]) -> Option<Uuid> {
    if let Some(map) = parts
        .extensions
        .get::<std::collections::HashMap<String, String>>()
    {
        for key in keys {
            if let Some(val) = map.get(*key) {
                if let Ok(uuid) = Uuid::parse_str(val) {
                    return Some(uuid);
                }
            }
        }
    }

    if let Some(params) = parts.extensions.get::<Vec<(String, String)>>() {
        for (k, v) in params {
            if keys.contains(&k.as_str()) {
                if let Ok(uuid) = Uuid::parse_str(v) {
                    return Some(uuid);
                }
            }
        }
    }

    None
}