Permissions: модель дозволів

ресурс:операція:область

articles:read:any
articles:update:any
articles:update:own
articles:delete:own

admin:
  articles:read:any
  articles:create:any
  articles:update:any
  articles:delete:any

editor:
  articles:read:any
  articles:create:any
  articles:update:any

author:
  articles:read:any
  articles:create:any
  articles:update:own
  articles:delete:own

viewer:
  articles:read:any

const user = {
  id: "user-1",
  roles: ["author"],
};

const roles = {
  author: [
    "articles:read:any",
    "articles:create:any",
    "articles:update:own",
    "articles:delete:own",
  ],
};

can(user, "update", "articles", article)

"use strict";

const roles = Object.freeze({
  admin: [
    "articles:read:any",
    "articles:create:any",
    "articles:update:any",
    "articles:delete:any",
  ],

  editor: [
    "articles:read:any",
    "articles:create:any",
    "articles:update:any",
  ],

  author: [
    "articles:read:any",
    "articles:create:any",
    "articles:update:own",
    "articles:delete:own",
  ],

  viewer: [
    "articles:read:any",
  ],
});

class ForbiddenError extends Error {
  constructor(message = "Доступ заборонено") {
    super(message);
    this.name = "ForbiddenError";
    this.statusCode = 403;
  }
}

function getUserPermissions(user) {
  if (!user || !Array.isArray(user.roles)) {
    return new Set();
  }

  const permissions = new Set();

  for (const roleName of user.roles) {
    const rolePermissions = roles[roleName];

    if (!rolePermissions) {
      continue;
    }

    for (const permission of rolePermissions) {
      permissions.add(permission);
    }
  }

  return permissions;
}

function can(user, action, resourceName, resource = null) {
  const permissions = getUserPermissions(user);

  const permissionForAnyResource =
    `${resourceName}:${action}:any`;

  if (permissions.has(permissionForAnyResource)) {
    return true;
  }

  const permissionForOwnResource =
    `${resourceName}:${action}:own`;

  const isOwner =
    resource !== null &&
    resource.ownerId === user.id;

  return permissions.has(permissionForOwnResource) && isOwner;
}

function authorize(user, action, resourceName, resource = null) {
  if (!can(user, action, resourceName, resource)) {
    throw new ForbiddenError(
      `Користувач не може виконати "${action}" над ресурсом "${resourceName}"`
    );
  }
}

const articles = [
  {
    id: "article-1",
    title: "Власна стаття автора",
    ownerId: "user-author",
    status: "draft",
  },
  {
    id: "article-2",
    title: "Стаття іншого користувача",
    ownerId: "user-editor",
    status: "published",
  },
];

const users = {
  author: {
    id: "user-author",
    roles: ["author"],
  },

  editor: {
    id: "user-editor",
    roles: ["editor"],
  },

  viewer: {
    id: "user-viewer",
    roles: ["viewer"],
  },
};

function updateArticle(user, articleId, changes) {
  const article = articles.find((item) => item.id === articleId);

  if (!article) {
    throw new Error("Статтю не знайдено");
  }

  // Перевіряємо доступ саме до знайденого ресурсу.
  authorize(user, "update", "articles", article);

  Object.assign(article, changes);

  return article;
}

function deleteArticle(user, articleId) {
  const articleIndex = articles.findIndex(
    (item) => item.id === articleId
  );

  if (articleIndex === -1) {
    throw new Error("Статтю не знайдено");
  }

  const article = articles[articleIndex];

  // Для автора перевірка врахує ownerId.
  authorize(user, "delete", "articles", article);

  const [deletedArticle] = articles.splice(articleIndex, 1);

  return deletedArticle;
}

function tryOperation(description, operation) {
  try {
    const result = operation();
    console.log(`Дозволено: ${description}`);
    console.log(result);
  } catch (error) {
    if (error instanceof ForbiddenError) {
      console.log(`Заборонено: ${description}`);
      console.log(error.message);
      return;
    }

    throw error;
  }
}

tryOperation(
  "автор редагує власну статтю",
  () => updateArticle(users.author, "article-1", {
    title: "Оновлений заголовок",
  })
);

tryOperation(
  "автор редагує чужу статтю",
  () => updateArticle(users.author, "article-2", {
    title: "Несанкціонована зміна",
  })
);

tryOperation(
  "редактор редагує чужу статтю",
  () => updateArticle(users.editor, "article-1", {
    status: "published",
  })
);

tryOperation(
  "переглядач видаляє статтю",
  () => deleteArticle(users.viewer, "article-1")
);

tryOperation(
  "автор видаляє власну статтю",
  () => deleteArticle(users.author, "article-1")
);

async function handleUpdateArticle(request, response) {
  const user = request.user;
  const articleId = request.params.id;

  const article = await articleRepository.findById(articleId);

  if (!article) {
    response.statusCode = 404;
    response.end("Статтю не знайдено");
    return;
  }

  try {
    authorize(user, "update", "articles", article);
  } catch (error) {
    if (error instanceof ForbiddenError) {
      response.statusCode = 403;
      response.end("Доступ заборонено");
      return;
    }

    throw error;
  }

  const updatedArticle = await articleRepository.update(
    articleId,
    request.body
  );

  response.statusCode = 200;
  response.end(JSON.stringify(updatedArticle));
}

if (user.roles.includes("author")) {
  // Небезпечно: не перевірено власника статті
}

authorize(user, "update", "articles", article);

function createArticle(user, data) {
  authorize(user, "create", "articles");

  const article = {
    id: crypto.randomUUID(),
    title: data.title,
    ownerId: user.id,
    status: "draft",
  };

  return article;
}

// Небезпечно
const article = {
  title: request.body.title,
  ownerId: request.body.ownerId,
};

const article = {
  title: request.body.title,
  ownerId: request.user.id,
};

if (user.roles.includes("admin") || user.roles.includes("editor")) {
  // логіка доступу змішана з логікою бізнес-операції
}

authorize(user, "update", "articles", article);

authorize(user, "delete", "articles", article);

user.roles.includes("author");

return false;