1use async_trait::async_trait;
2
3use crate::dto::{
4    AnswerAuthorizationRequest, CommentAuthorizationRequest, GitHttpAuthorizationRequest,
5    OrganizationAuthorizationRequest, QuestionAuthorizationRequest, RepositoryAuthorizationRequest,
6    RepositoryCreationAuthorizationRequest,
7};
8use crate::error::AuthorizationError;
9use crate::model::{GitOperation, OrganizationRole, RepositoryOwnerType};
10use crate::repository::{
11    OrganizationRepository, OrganizationRepositoryImpl, QuestionRepository, QuestionRepositoryImpl,
12    RepositoryRepository, RepositoryRepositoryImpl, UserRepository, UserRepositoryImpl,
13};
14
15#[async_trait]
16pub trait AuthorizationService: Send + Sync + 'static {
17    async fn verify_authorized_for_git_http(
18        &self,
19        request: GitHttpAuthorizationRequest,
20    ) -> Result<(), AuthorizationError>;
21
22    async fn verify_authorized_for_repository_creation(
23        &self,
24        request: RepositoryCreationAuthorizationRequest,
25    ) -> Result<(), AuthorizationError>;
26
27    async fn verify_authorized_for_repository(
28        &self,
29        request: RepositoryAuthorizationRequest,
30    ) -> Result<(), AuthorizationError>;
31
32    async fn verify_authorized_for_organization(
33        &self,
34        request: OrganizationAuthorizationRequest,
35    ) -> Result<(), AuthorizationError>;
36
37    async fn verify_authorized_for_question(
38        &self,
39        request: QuestionAuthorizationRequest,
40    ) -> Result<(), AuthorizationError>;
41
42    async fn verify_authorized_for_answer(
43        &self,
44        request: AnswerAuthorizationRequest,
45    ) -> Result<(), AuthorizationError>;
46
47    async fn verify_authorized_for_comment(
48        &self,
49        request: CommentAuthorizationRequest,
50    ) -> Result<(), AuthorizationError>;
51}
52
53#[derive(Debug, Clone)]
54pub struct AuthorizationServiceImpl<O, R, Q, U>
55where
56    O: OrganizationRepository,
57    R: RepositoryRepository,
58    Q: QuestionRepository,
59    U: UserRepository,
60{
61    org_repo: O,
62    repo_repo: R,
63    question_repo: Q,
64    user_repo: U,
65}
66
67impl
68    AuthorizationServiceImpl<
69        OrganizationRepositoryImpl,
70        RepositoryRepositoryImpl,
71        QuestionRepositoryImpl,
72        UserRepositoryImpl,
73    >
74{
75    pub fn new(
76        org_repo: OrganizationRepositoryImpl,
77        repo_repo: RepositoryRepositoryImpl,
78        question_repo: QuestionRepositoryImpl,
79        user_repo: UserRepositoryImpl,
80    ) -> Self {
81        Self {
82            org_repo,
83            repo_repo,
84            question_repo,
85            user_repo,
86        }
87    }
88}
89
90#[async_trait]
91impl<O, R, Q, U> AuthorizationService for AuthorizationServiceImpl<O, R, Q, U>
92where
93    O: OrganizationRepository,
94    R: RepositoryRepository,
95    Q: QuestionRepository,
96    U: UserRepository,
97{
98    async fn verify_authorized_for_git_http(
99        &self,
100        request: GitHttpAuthorizationRequest,
101    ) -> Result<(), AuthorizationError> {
102        let repository = self
103            .repo_repo
104            .get(request.owner.as_ref(), request.repo.as_ref())
105            .await?
106            .ok_or_else(|| AuthorizationError::NotFound("Repository not found".to_string()))?;
107
108        if repository.is_public() && request.operation == GitOperation::Read {
109            return Ok(());
110        }
111
112        let user_id = request.user_id.ok_or(AuthorizationError::Unauthorized)?;
113        if repository.is_owned_by_user() {
114            if repository.owner_id != user_id {
115                return Err(AuthorizationError::Unauthorized);
116            }
117        } else {
118            let is_member = self
119                .org_repo
120                .is_member(repository.owner_id, user_id)
121                .await?;
122            if !is_member {
123                return Err(AuthorizationError::Unauthorized);
124            }
125        }
126
127        Ok(())
128    }
129
130    async fn verify_authorized_for_repository_creation(
131        &self,
132        request: RepositoryCreationAuthorizationRequest,
133    ) -> Result<(), AuthorizationError> {
134        match request.owner_type {
135            RepositoryOwnerType::User => {
136                let user = self
137                    .user_repo
138                    .get_by_id(request.user_id)
139                    .await?
140                    .ok_or(AuthorizationError::Unauthorized)?;
141
142                if user.name.to_lowercase() != request.owner.as_ref().to_lowercase() {
143                    return Err(AuthorizationError::Unauthorized);
144                }
145            }
146            RepositoryOwnerType::Organization => {
147                let org = self
148                    .org_repo
149                    .get(request.owner.as_ref())
150                    .await?
151                    .ok_or_else(|| {
152                        AuthorizationError::NotFound(format!(
153                            "Organization not found: {}",
154                            request.owner.as_ref()
155                        ))
156                    })?;
157
158                let is_member = self.org_repo.is_member(org.id, request.user_id).await?;
159                if !is_member {
160                    return Err(AuthorizationError::Unauthorized);
161                }
162            }
163        }
164        Ok(())
165    }
166
167    async fn verify_authorized_for_repository(
168        &self,
169        request: RepositoryAuthorizationRequest,
170    ) -> Result<(), AuthorizationError> {
171        let repository = self
172            .repo_repo
173            .get(request.owner.as_ref(), request.repo.as_ref())
174            .await?
175            .ok_or_else(|| {
176                AuthorizationError::NotFound(format!(
177                    "Repository not found: {}",
178                    request.get_repo_path(),
179                ))
180            })?;
181
182        if repository.is_public() {
183            return Ok(());
184        }
185
186        if request.user_id.is_none() {
187            return Err(AuthorizationError::Unauthorized);
188        }
189
190        let user_id = request.user_id.unwrap();
191        if repository.is_owned_by_user() {
192            if repository.owner_id != user_id {
193                return Err(AuthorizationError::Unauthorized);
194            }
195        } else {
196            let is_member = self
197                .org_repo
198                .is_member(repository.owner_id, user_id)
199                .await?;
200            if !is_member {
201                return Err(AuthorizationError::Unauthorized);
202            }
203        }
204
205        Ok(())
206    }
207
208    async fn verify_authorized_for_organization(
209        &self,
210        request: OrganizationAuthorizationRequest,
211    ) -> Result<(), AuthorizationError> {
212        let role = self
213            .org_repo
214            .get_member_role(request.org_name.as_ref(), request.user_id)
215            .await?;
216
217        match role {
218            Some(OrganizationRole::Admin) => Ok(()),
219            _ => Err(AuthorizationError::Unauthorized),
220        }
221    }
222
223    async fn verify_authorized_for_question(
224        &self,
225        request: QuestionAuthorizationRequest,
226    ) -> Result<(), AuthorizationError> {
227        let author_id = self
228            .question_repo
229            .get_question_author_id(
230                request.owner.as_ref(),
231                request.repo.as_ref(),
232                request.number,
233            )
234            .await?
235            .ok_or_else(|| {
236                AuthorizationError::NotFound(format!(
237                    "Question not found: {}",
238                    request.get_repo_path(),
239                ))
240            })?;
241
242        if author_id != request.user_id {
243            return Err(AuthorizationError::Unauthorized);
244        }
245
246        Ok(())
247    }
248
249    async fn verify_authorized_for_answer(
250        &self,
251        request: AnswerAuthorizationRequest,
252    ) -> Result<(), AuthorizationError> {
253        let author_id = self
254            .question_repo
255            .get_answer_author_id(request.answer_id)
256            .await?
257            .ok_or_else(|| {
258                AuthorizationError::NotFound(format!("Answer not found: {}", request.answer_id))
259            })?;
260
261        if author_id != request.user_id {
262            return Err(AuthorizationError::Unauthorized);
263        }
264
265        Ok(())
266    }
267
268    async fn verify_authorized_for_comment(
269        &self,
270        request: CommentAuthorizationRequest,
271    ) -> Result<(), AuthorizationError> {
272        let author_id = self
273            .question_repo
274            .get_comment_author_id(request.comment_id)
275            .await?
276            .ok_or_else(|| {
277                AuthorizationError::NotFound(format!("Comment not found: {}", request.comment_id))
278            })?;
279
280        if author_id != request.user_id {
281            return Err(AuthorizationError::Unauthorized);
282        }
283
284        Ok(())
285    }
286}
287