[FIX/BE-US] changes role to user and query

2026-05-23 06:45:43 +00:00 · 2026-01-15 14:43:59 +07:00
parent 549e283757
commit a3e9017e29
16 changed files with 805 additions and 147 deletions
@@ -24,6 +24,10 @@ type AuthContext struct {
 	User         *entity.User
 	Roles        []sso.Role
 	Permissions  map[string]struct{}
+	UserAreaIDs     []uint
+	UserLocationIDs []uint
+	UserAllArea     bool
+	UserAllLocation bool
 }

 // Auth validates the incoming request against the central SSO access token and
@@ -67,15 +71,19 @@ func Auth(userService service.UserService, requiredScopes ...string) fiber.Handl

 		var roles []sso.Role
 		permissions := make(map[string]struct{})
+		var profile *sso.UserProfile
 		if verification.UserID != 0 {
-			if profile, err := sso.FetchProfile(c.Context(), token, verification); err != nil {
+			if p, err := sso.FetchProfile(c.Context(), token, verification); err != nil {
 				utils.Log.WithError(err).Warn("auth: failed to fetch sso profile")
-			} else if profile != nil {
-				roles = profile.Roles
-				for _, perm := range profile.PermissionNames() {
-					if perm != "" {
-						permissions[perm] = struct{}{}
-					}
+			} else {
+				profile = p
+			}
+		}
+		if profile != nil {
+			roles = profile.Roles
+			for _, perm := range profile.PermissionNames() {
+				if perm != "" {
+					permissions[perm] = struct{}{}
 				}
 			}
 		}
@@ -86,6 +94,16 @@ func Auth(userService service.UserService, requiredScopes ...string) fiber.Handl
 			User:         user,
 			Roles:        roles,
 			Permissions:  permissions,
+			UserAreaIDs:     nil,
+			UserLocationIDs: nil,
+			UserAllArea:     false,
+			UserAllLocation: false,
+		}
+		if profile != nil {
+			ctx.UserAreaIDs = profile.AreaIDs
+			ctx.UserLocationIDs = profile.LocationIDs
+			ctx.UserAllArea = profile.AllArea
+			ctx.UserAllLocation = profile.AllLocation
 		}

 		c.Locals(authContextLocalsKey, ctx)
@@ -2,12 +2,10 @@ package middleware

 import (
 	"errors"
-	"strings"

 	"github.com/gofiber/fiber/v2"
 	"gorm.io/gorm"

-	"gitlab.com/mbugroup/lti-api.git/internal/config"
 	entity "gitlab.com/mbugroup/lti-api.git/internal/entities"
 )

@@ -86,48 +84,24 @@ func ResolveLocationScope(c *fiber.Ctx, db *gorm.DB) (ScopeFilter, error) {

 func collectRoleScope(c *fiber.Ctx) (roleScope, error) {
 	ctx, ok := AuthDetails(c)
-	if !ok || ctx == nil || len(ctx.Roles) == 0 {
+	if !ok || ctx == nil {
 		return roleScope{}, nil
 	}

-	clientAlias := resolveClientAlias(ctx)
-
-	scope := roleScope{}
-	areaSet := make(map[uint]struct{})
-	locationSet := make(map[uint]struct{})
-
-	for _, role := range ctx.Roles {
-		if clientAlias != "" && !strings.EqualFold(strings.TrimSpace(role.ClientAlias), clientAlias) {
-			continue
-		}
-		scope.hasAnyScopes = true
-		if role.AllArea {
-			scope.allArea = true
-		}
-		if role.AllLocation {
-			scope.allLocation = true
-		}
-		for _, id := range role.AreaIDs {
-			if id == 0 {
-				continue
-			}
-			areaSet[id] = struct{}{}
-		}
-		for _, id := range role.LocationIDs {
-			if id == 0 {
-				continue
-			}
-			locationSet[id] = struct{}{}
-		}
+	userAreaIDs := uniqueUint(ctx.UserAreaIDs)
+	userLocationIDs := uniqueUint(ctx.UserLocationIDs)
+	userScope := roleScope{
+		allArea:      ctx.UserAllArea,
+		allLocation:  ctx.UserAllLocation,
+		areaIDs:      userAreaIDs,
+		locationIDs:  userLocationIDs,
+		hasAnyScopes: ctx.UserAllArea || ctx.UserAllLocation || len(userAreaIDs) > 0 || len(userLocationIDs) > 0,
+	}
+	if userScope.hasAnyScopes {
+		return userScope, nil
 	}

-	scope.areaIDs = keysUint(areaSet)
-	scope.locationIDs = keysUint(locationSet)
-
-	scope.hasAnyScopes = scope.hasAnyScopes &&
-		(scope.allArea || scope.allLocation || len(scope.areaIDs) > 0 || len(scope.locationIDs) > 0)
-
-	return scope, nil
+	return roleScope{}, nil
 }

 func areaIDsByLocationIDs(db *gorm.DB, locationIDs []uint) ([]uint, error) {
@@ -204,70 +178,7 @@ func uniqueUint(ids []uint) []uint {
 	return result
 }

-func keysUint(set map[uint]struct{}) []uint {
-	if len(set) == 0 {
-		return nil
-	}
-	out := make([]uint, 0, len(set))
-	for id := range set {
-		out = append(out, id)
-	}
-	return out
-}

-func resolveClientAlias(ctx *AuthContext) string {
-	if ctx == nil || ctx.Verification == nil || ctx.Verification.Claims == nil {
-		return ""
-	}
-
-	scopes := ctx.Verification.Claims.Scopes()
-	if len(scopes) == 0 {
-		return ""
-	}
-
-	seen := make(map[string]struct{})
-	for _, scope := range scopes {
-		scope = strings.ToLower(strings.TrimSpace(scope))
-		if scope == "" {
-			continue
-		}
-		prefix := scope
-		if idx := strings.IndexAny(prefix, ".:"); idx > 0 {
-			prefix = prefix[:idx]
-		}
-		prefix = strings.TrimSpace(prefix)
-		if prefix == "" {
-			continue
-		}
-		if alias := matchAlias(prefix); alias != "" {
-			seen[alias] = struct{}{}
-		}
-	}
-
-	if len(seen) != 1 {
-		return ""
-	}
-	for alias := range seen {
-		return alias
-	}
-	return ""
-}
-
-func matchAlias(alias string) string {
-	alias = strings.ToLower(strings.TrimSpace(alias))
-	if alias == "" {
-		return ""
-	}
-	if _, ok := config.SSOClients[alias]; ok {
-		return alias
-	}
-	for key := range config.SSOClients {
-		if strings.EqualFold(key, alias) {
-			return strings.ToLower(strings.TrimSpace(key))
-		}
-	}
-	return ""
-}

 func ApplyScopeFilter(db *gorm.DB, scope ScopeFilter, column string) *gorm.DB {
 	if db == nil || !scope.Restrict {
@@ -278,3 +189,389 @@ func ApplyScopeFilter(db *gorm.DB, scope ScopeFilter, column string) *gorm.DB {
 	}
 	return db.Where(column+" IN ?", scope.IDs)
 }
+
+func EnsureWarehouseAccess(c *fiber.Ctx, db *gorm.DB, warehouseID uint) error {
+	if warehouseID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid warehouse id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Warehouse not found")
+	}
+
+	var count int64
+	if err := ApplyScopeFilter(
+		db.WithContext(c.Context()).
+			Model(&entity.Warehouse{}).
+			Where("id = ?", warehouseID),
+		scope,
+		"warehouses.location_id",
+	).Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Warehouse not found")
+	}
+	return nil
+}
+
+func EnsureAreaAccess(c *fiber.Ctx, db *gorm.DB, areaID uint) error {
+	if areaID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid area id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveAreaScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Area not found")
+	}
+
+	var count int64
+	if err := ApplyScopeFilter(
+		db.WithContext(c.Context()).
+			Model(&entity.Area{}).
+			Where("id = ?", areaID),
+		scope,
+		"areas.id",
+	).Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Area not found")
+	}
+	return nil
+}
+
+func EnsureLocationAccess(c *fiber.Ctx, db *gorm.DB, locationID uint) error {
+	if locationID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid location id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Location not found")
+	}
+
+	var count int64
+	if err := ApplyScopeFilter(
+		db.WithContext(c.Context()).
+			Model(&entity.Location{}).
+			Where("id = ?", locationID),
+		scope,
+		"locations.id",
+	).Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Location not found")
+	}
+	return nil
+}
+
+func EnsureKandangAccess(c *fiber.Ctx, db *gorm.DB, kandangID uint) error {
+	if kandangID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid kandang id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Kandang not found")
+	}
+
+	var count int64
+	if err := ApplyScopeFilter(
+		db.WithContext(c.Context()).
+			Model(&entity.Kandang{}).
+			Where("id = ?", kandangID),
+		scope,
+		"kandangs.location_id",
+	).Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Kandang not found")
+	}
+	return nil
+}
+
+func EnsureProductWarehouseAccess(c *fiber.Ctx, db *gorm.DB, productWarehouseID uint) error {
+	if productWarehouseID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid product warehouse id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Product warehouse not found")
+	}
+
+	var count int64
+	q := db.WithContext(c.Context()).
+		Table("product_warehouses pw").
+		Joins("JOIN warehouses w ON w.id = pw.warehouse_id").
+		Where("pw.id = ?", productWarehouseID)
+	q = ApplyScopeFilter(q, scope, "w.location_id")
+	if err := q.Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Product warehouse not found")
+	}
+	return nil
+}
+
+func EnsureStockLogAccess(c *fiber.Ctx, db *gorm.DB, stockLogID uint) error {
+	if stockLogID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid stock log id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Stock log not found")
+	}
+
+	var count int64
+	q := db.WithContext(c.Context()).
+		Table("stock_logs sl").
+		Joins("JOIN product_warehouses pw ON pw.id = sl.product_warehouse_id").
+		Joins("JOIN warehouses w ON w.id = pw.warehouse_id").
+		Where("sl.id = ?", stockLogID)
+	q = ApplyScopeFilter(q, scope, "w.location_id")
+	if err := q.Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Stock log not found")
+	}
+	return nil
+}
+
+func EnsureMarketingAccess(c *fiber.Ctx, db *gorm.DB, marketingID uint) error {
+	if marketingID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid marketing id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Marketing not found")
+	}
+
+	var count int64
+	q := db.WithContext(c.Context()).
+		Table("marketings m").
+		Joins("JOIN marketing_products mp ON mp.marketing_id = m.id").
+		Joins("JOIN product_warehouses pw ON pw.id = mp.product_warehouse_id").
+		Joins("JOIN warehouses w ON w.id = pw.warehouse_id").
+		Where("m.id = ?", marketingID)
+	q = ApplyScopeFilter(q, scope, "w.location_id")
+	if err := q.Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Marketing not found")
+	}
+	return nil
+}
+
+func EnsureRecordingAccess(c *fiber.Ctx, db *gorm.DB, recordingID uint) error {
+	if recordingID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid recording id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Recording not found")
+	}
+
+	var count int64
+	q := db.WithContext(c.Context()).
+		Table("recordings r").
+		Joins("JOIN project_flock_kandangs pfk ON pfk.id = r.project_flock_kandangs_id").
+		Joins("JOIN project_flocks pf ON pf.id = pfk.project_flock_id").
+		Where("r.id = ?", recordingID)
+	q = ApplyScopeFilter(q, scope, "pf.location_id")
+	if err := q.Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Recording not found")
+	}
+	return nil
+}
+
+func EnsureUniformityAccess(c *fiber.Ctx, db *gorm.DB, uniformityID uint) error {
+	if uniformityID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid uniformity id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Uniformity not found")
+	}
+
+	var count int64
+	q := db.WithContext(c.Context()).
+		Table("project_flock_kandang_uniformities u").
+		Joins("JOIN project_flock_kandangs pfk ON pfk.id = u.project_flock_kandang_id").
+		Joins("JOIN project_flocks pf ON pf.id = pfk.project_flock_id").
+		Where("u.id = ?", uniformityID)
+	q = ApplyScopeFilter(q, scope, "pf.location_id")
+	if err := q.Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Uniformity not found")
+	}
+	return nil
+}
+
+func EnsureLayingTransferAccess(c *fiber.Ctx, db *gorm.DB, transferID uint) error {
+	if transferID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid transfer id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Transfer not found")
+	}
+
+	var count int64
+	q := db.WithContext(c.Context()).
+		Table("laying_transfers lt").
+		Joins("JOIN project_flocks pf_from ON pf_from.id = lt.from_project_flock_id").
+		Joins("JOIN project_flocks pf_to ON pf_to.id = lt.to_project_flock_id").
+		Where("lt.id = ?", transferID).
+		Where("(pf_from.location_id IN ? OR pf_to.location_id IN ?)", scope.IDs, scope.IDs)
+	if err := q.Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Transfer not found")
+	}
+	return nil
+}
+
+func EnsureProjectFlockAccess(c *fiber.Ctx, db *gorm.DB, projectFlockID uint) error {
+	if projectFlockID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid project flock id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Project Flock not found")
+	}
+
+	var count int64
+	if err := ApplyScopeFilter(
+		db.WithContext(c.Context()).
+			Model(&entity.ProjectFlock{}).
+			Where("id = ?", projectFlockID),
+		scope,
+		"project_flocks.location_id",
+	).Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Project Flock not found")
+	}
+	return nil
+}
+
+func EnsureProjectFlockKandangAccess(c *fiber.Ctx, db *gorm.DB, projectFlockID, projectFlockKandangID uint) error {
+	if projectFlockKandangID == 0 {
+		return fiber.NewError(fiber.StatusBadRequest, "Invalid project flock kandang id")
+	}
+	if db == nil {
+		return fiber.NewError(fiber.StatusInternalServerError, "Database not configured")
+	}
+
+	scope, err := ResolveLocationScope(c, db)
+	if err != nil || !scope.Restrict {
+		return err
+	}
+	if len(scope.IDs) == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Project Flock Kandang not found")
+	}
+
+	var count int64
+	q := db.WithContext(c.Context()).
+		Table("project_flock_kandangs").
+		Joins("JOIN project_flocks ON project_flocks.id = project_flock_kandangs.project_flock_id").
+		Where("project_flock_kandangs.id = ?", projectFlockKandangID)
+	if projectFlockID > 0 {
+		q = q.Where("project_flock_kandangs.project_flock_id = ?", projectFlockID)
+	}
+	q = ApplyScopeFilter(q, scope, "project_flocks.location_id")
+	if err := q.Count(&count).Error; err != nil {
+		return err
+	}
+	if count == 0 {
+		return fiber.NewError(fiber.StatusNotFound, "Project Flock Kandang not found")
+	}
+	return nil
+}