breadcrumb-the-shire/lib/Service/Access/OperationsAuthorizationPolicy.php

<?php

namespace MintyPHP\Service\Access;

final class OperationsAuthorizationPolicy implements AuthorizationPolicyInterface
{
    public const ABILITY_ADMIN_DOCS_VIEW = 'ops.admin.docs.view';
    public const ABILITY_ADMIN_IMPORTS_VIEW = 'ops.admin.imports.view';
    public const ABILITY_ADMIN_JOBS_RUN_NOW = 'ops.admin.jobs.run_now';
    public const ABILITY_ADMIN_JOBS_VIEW = 'ops.admin.jobs.view';
    public const ABILITY_ADMIN_JOBS_MANAGE = 'ops.admin.jobs.manage';
    public const ABILITY_ADMIN_MAIL_LOG_VIEW = 'ops.admin.mail_log.view';
    public const ABILITY_ADMIN_STATS_VIEW = 'ops.admin.stats.view';
    public const ABILITY_ADMIN_SYSTEM_INFO_VIEW = 'ops.admin.system_info.view';
    public const ABILITY_ADMIN_API_DOCS_VIEW = 'ops.admin.api_docs.view';
    public const ABILITY_ADMIN_IMPORTS_TYPE_USERS = 'ops.admin.imports.type.users';
    public const ABILITY_ADMIN_IMPORTS_TYPE_DEPARTMENTS = 'ops.admin.imports.type.departments';
    public const ABILITY_ADMIN_USERS_ASSIGNMENTS_MANAGE = 'ops.admin.users.assignments.manage';
    public const ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS = 'ops.admin.users.create.edit_custom_fields';
    public const ABILITY_API_PERMISSIONS_VIEW = 'ops.api.permissions.view';
    public const ABILITY_API_SETTINGS_VIEW = 'ops.api.settings.view';
    public const ABILITY_API_SETTINGS_UPDATE = 'ops.api.settings.update';
    public const ABILITY_API_ROLES_VIEW = 'ops.api.roles.view';
    public const ABILITY_API_ROLES_CREATE = 'ops.api.roles.create';
    public const ABILITY_API_ROLES_UPDATE = 'ops.api.roles.update';
    public const ABILITY_API_ROLES_DELETE = 'ops.api.roles.delete';
    public const ABILITY_API_DEPARTMENTS_VIEW = 'ops.api.departments.view';
    public const ABILITY_API_DEPARTMENTS_CREATE = 'ops.api.departments.create';
    public const ABILITY_API_DEPARTMENTS_UPDATE = 'ops.api.departments.update';
    public const ABILITY_API_DEPARTMENTS_DELETE = 'ops.api.departments.delete';
    public const ABILITY_API_TENANTS_VIEW = 'ops.api.tenants.view';
    public const ABILITY_API_TENANTS_CREATE = 'ops.api.tenants.create';
    public const ABILITY_API_TENANTS_UPDATE = 'ops.api.tenants.update';
    public const ABILITY_API_TENANTS_DELETE = 'ops.api.tenants.delete';
    public const ABILITY_API_ME_SELF_UPDATE = 'ops.api.me.self_update';
    public const ABILITY_API_TOKENS_SELF_MANAGE = 'ops.api.tokens.self_manage';

    public function __construct(
        private readonly PermissionService $permissionService
    ) {
    }

    public function supports(string $ability): bool
    {
        return in_array($ability, [
            self::ABILITY_ADMIN_DOCS_VIEW,
            self::ABILITY_ADMIN_IMPORTS_VIEW,
            self::ABILITY_ADMIN_JOBS_RUN_NOW,
            self::ABILITY_ADMIN_JOBS_VIEW,
            self::ABILITY_ADMIN_JOBS_MANAGE,
            self::ABILITY_ADMIN_MAIL_LOG_VIEW,
            self::ABILITY_ADMIN_STATS_VIEW,
            self::ABILITY_ADMIN_SYSTEM_INFO_VIEW,
            self::ABILITY_ADMIN_API_DOCS_VIEW,
            self::ABILITY_ADMIN_IMPORTS_TYPE_USERS,
            self::ABILITY_ADMIN_IMPORTS_TYPE_DEPARTMENTS,
            self::ABILITY_ADMIN_USERS_ASSIGNMENTS_MANAGE,
            self::ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS,
            self::ABILITY_API_PERMISSIONS_VIEW,
            self::ABILITY_API_SETTINGS_VIEW,
            self::ABILITY_API_SETTINGS_UPDATE,
            self::ABILITY_API_ROLES_VIEW,
            self::ABILITY_API_ROLES_CREATE,
            self::ABILITY_API_ROLES_UPDATE,
            self::ABILITY_API_ROLES_DELETE,
            self::ABILITY_API_DEPARTMENTS_VIEW,
            self::ABILITY_API_DEPARTMENTS_CREATE,
            self::ABILITY_API_DEPARTMENTS_UPDATE,
            self::ABILITY_API_DEPARTMENTS_DELETE,
            self::ABILITY_API_TENANTS_VIEW,
            self::ABILITY_API_TENANTS_CREATE,
            self::ABILITY_API_TENANTS_UPDATE,
            self::ABILITY_API_TENANTS_DELETE,
            self::ABILITY_API_ME_SELF_UPDATE,
            self::ABILITY_API_TOKENS_SELF_MANAGE,
        ], true);
    }

    public function authorize(string $ability, array $context = []): AuthorizationDecision
    {
        $actorUserId = (int) ($context['actor_user_id'] ?? 0);
        if ($actorUserId <= 0) {
            return AuthorizationDecision::deny(403, 'forbidden');
        }

        return match ($ability) {
            self::ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS => $this->authorizeUsersCreateCustomFields($actorUserId),
            self::ABILITY_API_TOKENS_SELF_MANAGE => $this->authorizeApiTokensSelfManage($actorUserId),
            self::ABILITY_ADMIN_DOCS_VIEW => $this->allowIfHas($actorUserId, PermissionService::DOCS_VIEW),
            self::ABILITY_ADMIN_IMPORTS_VIEW => $this->allowIfHas($actorUserId, PermissionService::IMPORTS_VIEW),
            self::ABILITY_ADMIN_JOBS_RUN_NOW => $this->allowIfHas($actorUserId, PermissionService::JOBS_RUN_NOW),
            self::ABILITY_ADMIN_JOBS_VIEW => $this->allowIfHas($actorUserId, PermissionService::JOBS_VIEW),
            self::ABILITY_ADMIN_JOBS_MANAGE => $this->allowIfHas($actorUserId, PermissionService::JOBS_MANAGE),
            self::ABILITY_ADMIN_MAIL_LOG_VIEW => $this->allowIfHas($actorUserId, PermissionService::MAIL_LOG_VIEW),
            self::ABILITY_ADMIN_STATS_VIEW => $this->allowIfHas($actorUserId, PermissionService::STATS_VIEW),
            self::ABILITY_ADMIN_SYSTEM_INFO_VIEW => $this->allowIfHas($actorUserId, PermissionService::SYSTEM_INFO_VIEW),
            self::ABILITY_ADMIN_API_DOCS_VIEW => $this->allowIfHas($actorUserId, PermissionService::API_DOCS_VIEW),
            self::ABILITY_ADMIN_IMPORTS_TYPE_USERS => $this->allowIfHas($actorUserId, PermissionService::USERS_IMPORT),
            self::ABILITY_ADMIN_IMPORTS_TYPE_DEPARTMENTS => $this->allowIfHas($actorUserId, PermissionService::DEPARTMENTS_IMPORT),
            self::ABILITY_ADMIN_USERS_ASSIGNMENTS_MANAGE => $this->allowIfHas($actorUserId, PermissionService::USERS_UPDATE_ASSIGNMENTS),
            self::ABILITY_API_PERMISSIONS_VIEW => $this->allowIfHas($actorUserId, PermissionService::PERMISSIONS_VIEW),
            self::ABILITY_API_SETTINGS_VIEW => $this->allowIfHas($actorUserId, PermissionService::SETTINGS_VIEW),
            self::ABILITY_API_SETTINGS_UPDATE => $this->allowIfHas($actorUserId, PermissionService::SETTINGS_UPDATE),
            self::ABILITY_API_ROLES_VIEW => $this->allowIfHas($actorUserId, PermissionService::ROLES_VIEW),
            self::ABILITY_API_ROLES_CREATE => $this->allowIfHas($actorUserId, PermissionService::ROLES_CREATE),
            self::ABILITY_API_ROLES_UPDATE => $this->allowIfHas($actorUserId, PermissionService::ROLES_UPDATE),
            self::ABILITY_API_ROLES_DELETE => $this->allowIfHas($actorUserId, PermissionService::ROLES_DELETE),
            self::ABILITY_API_DEPARTMENTS_VIEW => $this->allowIfHas($actorUserId, PermissionService::DEPARTMENTS_VIEW),
            self::ABILITY_API_DEPARTMENTS_CREATE => $this->allowIfHas($actorUserId, PermissionService::DEPARTMENTS_CREATE),
            self::ABILITY_API_DEPARTMENTS_UPDATE => $this->allowIfHas($actorUserId, PermissionService::DEPARTMENTS_UPDATE),
            self::ABILITY_API_DEPARTMENTS_DELETE => $this->allowIfHas($actorUserId, PermissionService::DEPARTMENTS_DELETE),
            self::ABILITY_API_TENANTS_VIEW => $this->allowIfHas($actorUserId, PermissionService::TENANTS_VIEW),
            self::ABILITY_API_TENANTS_CREATE => $this->allowIfHas($actorUserId, PermissionService::TENANTS_CREATE),
            self::ABILITY_API_TENANTS_UPDATE => $this->allowIfHas($actorUserId, PermissionService::TENANTS_UPDATE),
            self::ABILITY_API_TENANTS_DELETE => $this->allowIfHas($actorUserId, PermissionService::TENANTS_DELETE),
            self::ABILITY_API_ME_SELF_UPDATE => $this->allowIfHas($actorUserId, PermissionService::USERS_SELF_UPDATE),
            default => AuthorizationDecision::deny(500, 'authorization_ability_not_supported'),
        };
    }

    private function authorizeUsersCreateCustomFields(int $actorUserId): AuthorizationDecision
    {
        if (!$this->permissionService->userHas($actorUserId, PermissionService::CUSTOM_FIELDS_EDIT_VALUES)) {
            return AuthorizationDecision::deny(403, 'forbidden');
        }
        if (!$this->permissionService->userHas($actorUserId, PermissionService::USERS_UPDATE_ASSIGNMENTS)) {
            return AuthorizationDecision::deny(403, 'forbidden');
        }
        return AuthorizationDecision::allow();
    }

    private function authorizeApiTokensSelfManage(int $actorUserId): AuthorizationDecision
    {
        if ($this->permissionService->userHas($actorUserId, PermissionService::USERS_SELF_UPDATE)) {
            return AuthorizationDecision::allow();
        }
        if ($this->permissionService->userHas($actorUserId, PermissionService::API_TOKENS_MANAGE)) {
            return AuthorizationDecision::allow();
        }
        return AuthorizationDecision::deny(403, 'forbidden');
    }

    private function allowIfHas(int $actorUserId, string $permissionKey): AuthorizationDecision
    {
        if (!$this->permissionService->userHas($actorUserId, $permissionKey)) {
            return AuthorizationDecision::deny(403, 'forbidden');
        }
        return AuthorizationDecision::allow();
    }
}