roleacl.cpp

/*
 * SPDX-FileCopyrightText: (C) 2014-2022 Daniel Nicoletti <dantti12@gmail.com>
 * SPDX-License-Identifier: BSD-3-Clause
 */
#include "common.h"
#include "roleacl_p.h"
 
#include <Cutelyst/Controller>
#include <Cutelyst/Dispatcher>
#include <Cutelyst/Plugins/Authentication/authentication.h>
 
using namespace Qt::StringLiterals;
using namespace Cutelyst;
 
RoleACL::RoleACL(QObject *parent)
    : Component(new RoleACLPrivate, parent)
{
}
 
Component::Modifiers RoleACL::modifiers() const
{
    return AroundExecute;
}
 
bool RoleACL::init(Cutelyst::Application *application, const QVariantHash &args)
{
    Q_D(RoleACL);
    Q_UNUSED(application)
 
    const auto attributes = args.value(QLatin1String("attributes")).value<ParamsMultiMap>();
    d->actionReverse      = args.value(QLatin1String("reverse")).toString();
 
    if (!attributes.contains(QLatin1String("RequiresRole")) &&
        !attributes.contains(QLatin1String("AllowedRole"))) {
        qFatal("RoleACL: Action %s requires at least one RequiresRole or AllowedRole attribute",
               qPrintable(d->actionReverse));
    } else {
        const QStringList required = attributes.values(QLatin1String("RequiresRole"));
        for (const QString &role : required) {
            d->requiresRole.append(role);
        }
 
        const QStringList allowed = attributes.values(QLatin1String("AllowedRole"));
        for (const QString &role : allowed) {
            d->allowedRole.append(role);
        }
    }
 
    auto it = attributes.constFind(QLatin1String("ACLDetachTo"));
    if (it == attributes.constEnd() || it.value().isEmpty()) {
        qFatal("RoleACL: Action %s requires the ACLDetachTo(<action>) attribute",
               qPrintable(d->actionReverse));
    }
    d->aclDetachTo = it.value();
 
    return true;
}
 
bool RoleACL::aroundExecute(Context *c, QStack<Cutelyst::Component *> stack)
{
    Q_D(const RoleACL);
 
    if (canVisit(c)) {
        return Component::aroundExecute(c, stack);
    }
 
    c->detach(d->detachTo);
 
    return false;
}
 
bool RoleACL::canVisit(Context *c) const
{
    Q_D(const RoleACL);
 
    const QStringList user_has = Authentication::user(c).value(u"roles"_s).toStringList();
 
    const QStringList required = d->requiresRole;
    const QStringList allowed  = d->allowedRole;
 
    if (!required.isEmpty() && !allowed.isEmpty()) {
        for (const QString &role : required) {
            if (!user_has.contains(role)) {
                return false;
            }
        }
 
        for (const QString &role : allowed) {
            if (user_has.contains(role)) {
                return true;
            }
        }
    } else if (!required.isEmpty()) {
        return std::ranges::all_of(
            required, [user_has](const QString &role) { return user_has.contains(role); });
    } else if (!allowed.isEmpty()) {
        for (const QString &role : allowed) {
            if (user_has.contains(role)) {
                return true;
            }
        }
    }
 
    return false;
}
 
bool RoleACL::dispatcherReady(const Dispatcher *dispatcher, Cutelyst::Controller *controller)
{
    Q_D(RoleACL);
    Q_UNUSED(dispatcher)
 
    d->detachTo = controller->actionFor(d->aclDetachTo);
    if (!d->detachTo) {
        d->detachTo = dispatcher->getActionByPath(d->aclDetachTo);
        if (!d->detachTo) {
            qFatal(
                "RoleACL: Action '%s' requires a valid action set on the ACLDetachTo(%s) attribute",
                qPrintable(d->actionReverse),
                qPrintable(d->aclDetachTo));
        }
    }
 
    return true;
}
 
#include "moc_roleacl.cpp"