roleacl.cpp

/*
 * SPDX-FileCopyrightText: (C) 2014-2022 Daniel Nicoletti <dantti12@gmail.com>
 * SPDX-License-Identifier: BSD-3-Clause
 */
#include "common.h"
#include "roleacl_p.h"

#include <Cutelyst/Controller>
#include <Cutelyst/Dispatcher>
#include <Cutelyst/Plugins/Authentication/authentication.h>

using namespace Qt::StringLiterals;
using namespace Cutelyst;

RoleACL::RoleACL(QObject *parent)
    : Component(new RoleACLPrivate, parent)
{
}

Component::Modifiers RoleACL::modifiers() const
{
    return AroundExecute;
}

bool RoleACL::init(Cutelyst::Application *application, const QVariantHash &args)
{
    Q_D(RoleACL);
    Q_UNUSED(application)

    const auto attributes = args.value(u"attributes"_s).value<ParamsMultiMap>();
    d->actionReverse      = args.value(u"reverse"_s).toString();

    if (!attributes.contains(u"RequiresRole"_s) && !attributes.contains(u"AllowedRole"_s)) {
        qFatal("RoleACL: Action %s requires at least one RequiresRole or AllowedRole attribute",
               qPrintable(d->actionReverse));
    } else {
        const QStringList required = attributes.values(u"RequiresRole"_s);
        for (const QString &role : required) {
            d->requiresRole.append(role);
        }

        const QStringList allowed = attributes.values(u"AllowedRole"_s);
        for (const QString &role : allowed) {
            d->allowedRole.append(role);
        }
    }

    auto it = attributes.constFind(u"ACLDetachTo"_s);
    if (it == attributes.constEnd() || it.value().isEmpty()) {
        qFatal("RoleACL: Action %s requires the ACLDetachTo(<action>) attribute",
               qPrintable(d->actionReverse));
    }
    d->aclDetachTo = it.value();

    return true;
}

bool RoleACL::aroundExecute(Context *c, QStack<Cutelyst::Component *> stack)
{
    Q_D(const RoleACL);

    if (canVisit(c)) {
        return Component::aroundExecute(c, stack);
    }

    c->detach(d->detachTo);

    return false;
}

bool RoleACL::canVisit(Context *c) const
{
    Q_D(const RoleACL);

    const QStringList user_has = Authentication::user(c).value(u"roles"_s).toStringList();

    const QStringList required = d->requiresRole;
    const QStringList allowed  = d->allowedRole;

    if (!required.isEmpty() && !allowed.isEmpty()) {
        bool allRequired = std::ranges::all_of(
            required, [&user_has](const QString &role) { return user_has.contains(role); });
        if (!allRequired) {
            return false;
        }

        return std::ranges::any_of(
            allowed, [&user_has](const QString &role) { return user_has.contains(role); });
    } else if (!required.isEmpty()) {
        return std::ranges::all_of(
            required, [&user_has](const QString &role) { return user_has.contains(role); });
    } else if (!allowed.isEmpty()) {
        return std::ranges::any_of(
            allowed, [&user_has](const QString &role) { return user_has.contains(role); });
    }

    return false;
}

bool RoleACL::dispatcherReady(const Dispatcher *dispatcher, Cutelyst::Controller *controller)
{
    Q_D(RoleACL);
    Q_UNUSED(dispatcher)

    d->detachTo = controller->actionFor(d->aclDetachTo);
    if (!d->detachTo) {
        d->detachTo = dispatcher->getActionByPath(d->aclDetachTo);
        if (!d->detachTo) {
            qFatal(
                "RoleACL: Action '%s' requires a valid action set on the ACLDetachTo(%s) attribute",
                qPrintable(d->actionReverse),
                qPrintable(d->aclDetachTo));
        }
    }

    return true;
}

#include "moc_roleacl.cpp"