forked from EduCraft/curriculum-project-hub
feat(hub): 支持教师团队权限
This commit is contained in:
@@ -0,0 +1,253 @@
|
||||
import type { PermissionResourceType, PermissionRole, PrismaClient, PrincipalType } from "@prisma/client";
|
||||
import { PrismaPrincipalResolver, type ActorInput, type PrincipalRef, type PrincipalResolution, type PrincipalResolver } from "./principals.js";
|
||||
|
||||
export type AuthorizationAction =
|
||||
| "project.read"
|
||||
| "project.edit"
|
||||
| "collaborator.manage"
|
||||
| "agent.trigger"
|
||||
| "agent.cancel"
|
||||
| "role.trigger";
|
||||
|
||||
export interface AuthorizationResource {
|
||||
readonly type: PermissionResourceType;
|
||||
readonly id: string;
|
||||
}
|
||||
|
||||
export interface AuthorizationRequest {
|
||||
readonly actor: ActorInput;
|
||||
readonly action: AuthorizationAction;
|
||||
readonly resource: AuthorizationResource;
|
||||
readonly roleId?: string | undefined;
|
||||
}
|
||||
|
||||
export interface MatchedPermissionGrant {
|
||||
readonly id: string;
|
||||
readonly principal: PrincipalRef;
|
||||
readonly role: PermissionRole;
|
||||
}
|
||||
|
||||
export interface MatchedRoleTriggerGrant {
|
||||
readonly id: string;
|
||||
readonly principal: PrincipalRef;
|
||||
}
|
||||
|
||||
export interface AuthorizationDecision {
|
||||
readonly allowed: boolean;
|
||||
readonly reason: string;
|
||||
readonly action: AuthorizationAction;
|
||||
readonly resource: AuthorizationResource;
|
||||
readonly actor: ActorInput;
|
||||
readonly actorUserId?: string | undefined;
|
||||
readonly principals: readonly PrincipalRef[];
|
||||
readonly requiredRole: PermissionRole;
|
||||
readonly effectiveRole?: PermissionRole | undefined;
|
||||
readonly matchedGrant?: MatchedPermissionGrant | undefined;
|
||||
readonly matchedRoleGrant?: MatchedRoleTriggerGrant | undefined;
|
||||
}
|
||||
|
||||
export interface PermissionAuthorizer {
|
||||
can(req: AuthorizationRequest): Promise<AuthorizationDecision>;
|
||||
}
|
||||
|
||||
export class PrismaPermissionAuthorizer implements PermissionAuthorizer {
|
||||
constructor(
|
||||
private readonly prisma: PrismaClient,
|
||||
private readonly resolver: PrincipalResolver = new PrismaPrincipalResolver(prisma),
|
||||
) {}
|
||||
|
||||
async can(req: AuthorizationRequest): Promise<AuthorizationDecision> {
|
||||
if (req.action === "role.trigger" && (req.roleId === undefined || req.roleId === "")) {
|
||||
throw new Error("role.trigger authorization requires roleId");
|
||||
}
|
||||
const resolution = await this.resolver.resolveActor(req.actor);
|
||||
const threshold = await this.requiredRole(req);
|
||||
if (threshold === "DISABLED") {
|
||||
return this.decision(req, resolution, {
|
||||
allowed: false,
|
||||
reason: "permission setting disables this action",
|
||||
requiredRole: defaultRequiredRole(req.action),
|
||||
});
|
||||
}
|
||||
|
||||
const grant = await this.bestGrant(req.resource, resolution.principals, threshold);
|
||||
if (grant === undefined) {
|
||||
return this.decision(req, resolution, {
|
||||
allowed: false,
|
||||
reason: `no active ${threshold}+ grant for resolved principals`,
|
||||
requiredRole: threshold,
|
||||
});
|
||||
}
|
||||
|
||||
if (req.action !== "role.trigger") {
|
||||
return this.decision(req, resolution, {
|
||||
allowed: true,
|
||||
reason: `granted by ${grant.principal.type}:${grant.principal.id} ${grant.role}`,
|
||||
requiredRole: threshold,
|
||||
effectiveRole: grant.role,
|
||||
matchedGrant: grant,
|
||||
});
|
||||
}
|
||||
|
||||
const roleGate = await this.roleTriggerGrant(req.resource, req.roleId!, resolution.principals);
|
||||
if (roleGate.status === "open") {
|
||||
return this.decision(req, resolution, {
|
||||
allowed: true,
|
||||
reason: `role ${req.roleId} unconfigured on project (open)`,
|
||||
requiredRole: threshold,
|
||||
effectiveRole: grant.role,
|
||||
matchedGrant: grant,
|
||||
});
|
||||
}
|
||||
if (roleGate.grant !== undefined) {
|
||||
return this.decision(req, resolution, {
|
||||
allowed: true,
|
||||
reason: `role ${req.roleId} granted by ${roleGate.grant.principal.type}:${roleGate.grant.principal.id}`,
|
||||
requiredRole: threshold,
|
||||
effectiveRole: grant.role,
|
||||
matchedGrant: grant,
|
||||
matchedRoleGrant: roleGate.grant,
|
||||
});
|
||||
}
|
||||
|
||||
return this.decision(req, resolution, {
|
||||
allowed: false,
|
||||
reason: `no active role ${req.roleId} grant for resolved principals`,
|
||||
requiredRole: threshold,
|
||||
effectiveRole: grant.role,
|
||||
matchedGrant: grant,
|
||||
});
|
||||
}
|
||||
|
||||
private async requiredRole(req: AuthorizationRequest): Promise<PermissionRole | "DISABLED"> {
|
||||
let required = defaultRequiredRole(req.action);
|
||||
if ((req.action === "agent.trigger" || req.action === "role.trigger") && req.resource.type === "PROJECT") {
|
||||
const settings = await this.prisma.permissionSettings.findFirst({
|
||||
where: { resourceType: req.resource.type, resourceId: req.resource.id },
|
||||
select: { agentTrigger: true },
|
||||
});
|
||||
const policy = normalizePolicy(settings?.agentTrigger);
|
||||
if (policy === "DISABLED") return "DISABLED";
|
||||
if (policy === "MANAGE_ONLY") required = "MANAGE";
|
||||
}
|
||||
return required;
|
||||
}
|
||||
|
||||
private async bestGrant(
|
||||
resource: AuthorizationResource,
|
||||
principals: readonly PrincipalRef[],
|
||||
threshold: PermissionRole,
|
||||
): Promise<MatchedPermissionGrant | undefined> {
|
||||
const grants = await this.prisma.permissionGrant.findMany({
|
||||
where: {
|
||||
resourceType: resource.type,
|
||||
resourceId: resource.id,
|
||||
revokedAt: null,
|
||||
OR: principalWhere(principals),
|
||||
},
|
||||
select: { id: true, principalType: true, principalId: true, role: true },
|
||||
});
|
||||
const sufficient = grants
|
||||
.filter((grant) => roleRank(grant.role) >= roleRank(threshold))
|
||||
.sort((a, b) => roleRank(b.role) - roleRank(a.role))[0];
|
||||
if (sufficient === undefined) return undefined;
|
||||
return {
|
||||
id: sufficient.id,
|
||||
principal: { type: sufficient.principalType, id: sufficient.principalId },
|
||||
role: sufficient.role,
|
||||
};
|
||||
}
|
||||
|
||||
private async roleTriggerGrant(
|
||||
resource: AuthorizationResource,
|
||||
roleId: string,
|
||||
principals: readonly PrincipalRef[],
|
||||
): Promise<{ readonly status: "open" } | { readonly status: "configured"; readonly grant?: MatchedRoleTriggerGrant | undefined }> {
|
||||
if (resource.type !== "PROJECT") {
|
||||
return { status: "configured" };
|
||||
}
|
||||
const anyGrant = await this.prisma.roleTriggerGrant.findFirst({
|
||||
where: { projectId: resource.id, roleId },
|
||||
select: { id: true },
|
||||
});
|
||||
if (anyGrant === null) return { status: "open" };
|
||||
|
||||
const grant = await this.prisma.roleTriggerGrant.findFirst({
|
||||
where: {
|
||||
projectId: resource.id,
|
||||
roleId,
|
||||
revokedAt: null,
|
||||
OR: principalWhere(principals),
|
||||
},
|
||||
select: { id: true, principalType: true, principalId: true },
|
||||
});
|
||||
if (grant === null) return { status: "configured" };
|
||||
return {
|
||||
status: "configured",
|
||||
grant: {
|
||||
id: grant.id,
|
||||
principal: { type: grant.principalType, id: grant.principalId },
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
private decision(
|
||||
req: AuthorizationRequest,
|
||||
resolution: PrincipalResolution,
|
||||
result: Omit<AuthorizationDecision, "action" | "resource" | "actor" | "actorUserId" | "principals">,
|
||||
): AuthorizationDecision {
|
||||
return {
|
||||
action: req.action,
|
||||
resource: req.resource,
|
||||
actor: req.actor,
|
||||
...(resolution.userId !== undefined ? { actorUserId: resolution.userId } : {}),
|
||||
principals: resolution.principals,
|
||||
...result,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
export function createPermissionAuthorizer(
|
||||
prisma: PrismaClient,
|
||||
resolver?: PrincipalResolver,
|
||||
): PermissionAuthorizer {
|
||||
return new PrismaPermissionAuthorizer(prisma, resolver);
|
||||
}
|
||||
|
||||
export function roleGrantsEdit(role: PermissionRole): boolean {
|
||||
return roleRank(role) >= roleRank("EDIT");
|
||||
}
|
||||
|
||||
export function roleRank(role: PermissionRole): number {
|
||||
switch (role) {
|
||||
case "READ": return 1;
|
||||
case "EDIT": return 2;
|
||||
case "MANAGE": return 3;
|
||||
}
|
||||
}
|
||||
|
||||
function defaultRequiredRole(action: AuthorizationAction): PermissionRole {
|
||||
switch (action) {
|
||||
case "project.read": return "READ";
|
||||
case "project.edit": return "EDIT";
|
||||
case "agent.trigger": return "EDIT";
|
||||
case "role.trigger": return "EDIT";
|
||||
case "collaborator.manage": return "MANAGE";
|
||||
case "agent.cancel": return "MANAGE";
|
||||
}
|
||||
}
|
||||
|
||||
function normalizePolicy(policy: string | undefined): "ROLE" | "MANAGE_ONLY" | "DISABLED" {
|
||||
if (policy === undefined || policy.trim() === "") return "ROLE";
|
||||
const normalized = policy.trim().toUpperCase();
|
||||
if (normalized === "DISABLED" || normalized === "DENY" || normalized === "OFF") return "DISABLED";
|
||||
if (normalized === "MANAGE_ONLY") return "MANAGE_ONLY";
|
||||
return "ROLE";
|
||||
}
|
||||
|
||||
function principalWhere(principals: readonly PrincipalRef[]): Array<{ principalType: PrincipalType; principalId: string }> {
|
||||
return principals.map((principal) => ({
|
||||
principalType: principal.type,
|
||||
principalId: principal.id,
|
||||
}));
|
||||
}
|
||||
Reference in New Issue
Block a user