browser/platform/service/resource_authorization.go

package service

import (
	"browser.local/platform/domain"
)

func (svc *CoreService) AuthorizePluginBridgeActionForSession(sessionID string, request domain.PluginBridgeAuthorizeRequest) (domain.PluginBridgeAuthorization, error) {
	if _, err := svc.GetCurrentUser(sessionID); err != nil {
		return domain.PluginBridgeAuthorization{}, err
	}
	if request.ServerInstanceID != "" {
		if _, err := svc.GetServerInstanceForSession(sessionID, request.ServerInstanceID); err != nil {
			return domain.PluginBridgeAuthorization{}, err
		}
	}
	return svc.AuthorizePluginBridgeAction(request)
}

func (svc *CoreService) GetJobForSession(sessionID string, id string) (domain.Job, error) {
	job, err := svc.store.Jobs().Get(id)
	if err != nil {
		return domain.Job{}, err
	}
	if err := svc.authorizeJobAccess(sessionID, job); err != nil {
		return domain.Job{}, err
	}
	return domain.CopyJob(job), nil
}

func (svc *CoreService) ListJobsForSession(sessionID string, filter domain.JobFilter) ([]domain.Job, error) {
	user, err := svc.GetCurrentUser(sessionID)
	if err != nil {
		return nil, err
	}
	if filter.ServerInstanceID != "" {
		instance, err := svc.store.ServerInstances().Get(filter.ServerInstanceID)
		if err != nil {
			return nil, err
		}
		if !canAccessServer(user, instance) {
			return nil, ErrForbidden
		}
	}
	jobs, err := svc.store.Jobs().List(filter)
	if err != nil {
		return nil, err
	}
	if isPlatformAdmin(user) {
		return jobs, nil
	}
	visible := make([]domain.Job, 0, len(jobs))
	for _, job := range jobs {
		if job.ServerInstanceID == "" {
			continue
		}
		instance, getErr := svc.store.ServerInstances().Get(job.ServerInstanceID)
		if getErr == nil && canAccessServer(user, instance) {
			visible = append(visible, domain.CopyJob(job))
		}
	}
	return visible, nil
}

func (svc *CoreService) RequestRunJobCancelForSession(sessionID string, request domain.RunJobCancelRequest) (domain.RunJobCancelRequestResult, error) {
	job, err := svc.GetJobForSession(sessionID, request.JobID)
	if err != nil {
		return domain.RunJobCancelRequestResult{}, err
	}
	request.JobID = job.ID
	return svc.RequestRunJobCancel(request)
}

func (svc *CoreService) ListArtifactsForSession(sessionID string, filter domain.ArtifactFilter) ([]domain.Artifact, error) {
	if _, err := svc.GetCurrentUser(sessionID); err != nil {
		return nil, err
	}
	artifacts, err := svc.store.Artifacts().List(filter)
	if err != nil {
		return nil, err
	}
	visible := make([]domain.Artifact, 0, len(artifacts))
	for _, artifact := range artifacts {
		if err := svc.authorizeArtifactAccess(sessionID, artifact); err == nil {
			visible = append(visible, domain.CopyArtifact(artifact))
		}
	}
	if filter.OwnerID != "" && len(artifacts) > 0 && len(visible) == 0 {
		return nil, ErrForbidden
	}
	return visible, nil
}

func (svc *CoreService) GetLogStreamForSession(sessionID string, id string) (domain.LogStream, error) {
	stream, err := svc.store.LogStreams().Get(id)
	if err != nil {
		return domain.LogStream{}, err
	}
	if _, err := svc.GetServerInstanceForSession(sessionID, stream.ServerInstanceID); err != nil {
		return domain.LogStream{}, err
	}
	return domain.CopyLogStream(stream), nil
}

func (svc *CoreService) ListLogStreamsForSession(sessionID string, filter domain.LogStreamFilter) ([]domain.LogStream, error) {
	user, err := svc.GetCurrentUser(sessionID)
	if err != nil {
		return nil, err
	}
	if filter.ServerInstanceID != "" {
		instance, err := svc.store.ServerInstances().Get(filter.ServerInstanceID)
		if err != nil {
			return nil, err
		}
		if !canAccessServer(user, instance) {
			return nil, ErrForbidden
		}
	}
	streams, err := svc.store.LogStreams().List(filter)
	if err != nil {
		return nil, err
	}
	if isPlatformAdmin(user) {
		return streams, nil
	}
	visible := make([]domain.LogStream, 0, len(streams))
	for _, stream := range streams {
		instance, getErr := svc.store.ServerInstances().Get(stream.ServerInstanceID)
		if getErr == nil && canAccessServer(user, instance) {
			visible = append(visible, domain.CopyLogStream(stream))
		}
	}
	return visible, nil
}

func (svc *CoreService) QueryLogStreamForSession(sessionID string, query domain.LogStreamCursorQuery) (domain.LogStreamCursorResult, error) {
	if _, err := svc.GetLogStreamForSession(sessionID, query.LogStreamID); err != nil {
		return domain.LogStreamCursorResult{}, err
	}
	return svc.QueryLogStream(query)
}

func (svc *CoreService) authorizeJobAccess(sessionID string, job domain.Job) error {
	user, err := svc.GetCurrentUser(sessionID)
	if err != nil {
		return err
	}
	if job.ServerInstanceID == "" {
		if !isPlatformAdmin(user) {
			return ErrForbidden
		}
		return nil
	}
	instance, err := svc.store.ServerInstances().Get(job.ServerInstanceID)
	if err != nil {
		return err
	}
	if !canAccessServer(user, instance) {
		return ErrForbidden
	}
	return nil
}