57 lines
1.5 KiB
Go
57 lines
1.5 KiB
Go
package service
|
|
|
|
import "browser.local/platform/domain"
|
|
|
|
func (svc *CoreService) authorizeServerLifecycle(sessionID string, serverInstanceID string) error {
|
|
user, err := svc.GetCurrentUser(sessionID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
instance, err := svc.store.ServerInstances().Get(serverInstanceID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !canAccessServer(user, instance) {
|
|
return ErrForbidden
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (svc *CoreService) requireServerOwner(sessionID string, serverInstanceID string) (domain.User, domain.ServerInstance, error) {
|
|
user, err := svc.GetCurrentUser(sessionID)
|
|
if err != nil {
|
|
return domain.User{}, domain.ServerInstance{}, err
|
|
}
|
|
instance, err := svc.store.ServerInstances().Get(serverInstanceID)
|
|
if err != nil {
|
|
return domain.User{}, domain.ServerInstance{}, err
|
|
}
|
|
if !isPlatformAdmin(user) && instance.OwnerUserID != user.ID {
|
|
return domain.User{}, domain.ServerInstance{}, ErrForbidden
|
|
}
|
|
return user, instance, nil
|
|
}
|
|
|
|
func canAccessServer(user domain.User, instance domain.ServerInstance) bool {
|
|
return isPlatformAdmin(user) || instance.OwnerUserID == user.ID || containsString(instance.AdminUserIDs, user.ID)
|
|
}
|
|
|
|
func isPlatformAdmin(user domain.User) bool {
|
|
for _, role := range user.Roles {
|
|
switch role {
|
|
case "admin", "platform-admin", "platformadmin":
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func containsString(values []string, target string) bool {
|
|
for _, value := range values {
|
|
if value == target {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|