backbone-bucket 0.2.0

//! Auth configuration for FileAccessLog handlers
//!
//! Generated by backbone-schema. Do not edit manually.
//!
//! This module provides:
//! - Permission definitions for CRUD operations
//! - Role-based guards
//! - Auth middleware configuration

use std::sync::Arc;
use super::AuthContextExt;

use backbone_auth::middleware::AuthContext;
use backbone_auth::{AuthMiddleware};
use axum::{
    extract::{Request, State},
    http::StatusCode,
    middleware::Next,
    response::Response,
};

// ==========================================================================
// Permission Constants
// ==========================================================================

/// Permission identifiers for FileAccessLog operations
pub mod file_access_logs {
    /// Permission to list file_access_log entities
    pub const LIST: &str = "file_access_log:list";
    /// Permission to read file_access_log entity details
    pub const READ: &str = "file_access_log:read";
    /// Permission to create file_access_log entities
    pub const CREATE: &str = "file_access_log:create";
    /// Permission to update file_access_log entities
    pub const UPDATE: &str = "file_access_log:update";
    /// Permission to delete file_access_log entities
    pub const DELETE: &str = "file_access_log:delete";
    /// Permission to bulk create file_access_log entities
    pub const BULK_CREATE: &str = "file_access_log:bulk_create";
    /// Permission to upsert file_access_log entities
    pub const UPSERT: &str = "file_access_log:upsert";

    /// Get all permissions for this entity
    pub fn all() -> Vec<&'static str> {
        vec![
            LIST,
            READ,
            CREATE,
            UPDATE,
            DELETE,
            BULK_CREATE,
            UPSERT,
        ]
    }
}

// ==========================================================================
// Permission Checking
// ==========================================================================

/// Check if auth context has a specific permission
pub fn has_permission(auth: &AuthContext, permission: &str) -> bool {
    auth.permissions.iter().any(|p| p == permission)
}

/// Check if auth context has any of the required roles
pub fn has_role(auth: &AuthContext, roles: &[&str]) -> bool {
    auth.roles.iter().any(|r| roles.contains(&r.as_str()))
}

/// Check if auth context has all of the required permissions
pub fn has_all_permissions(auth: &AuthContext, permissions: &[&str]) -> bool {
    permissions.iter().all(|p| has_permission(auth, p))
}

/// Check if auth context has any of the required permissions
pub fn has_any_permission(auth: &AuthContext, permissions: &[&str]) -> bool {
    permissions.iter().any(|p| has_permission(auth, p))
}

// ==========================================================================
// Permission Guards (Axum Middleware)
// ==========================================================================

/// Create a permission guard that checks for a specific permission
pub fn require_permission(permission: &'static str) -> impl Fn(
    axum::extract::Extension<AuthContext>,
    Request,
    Next,
) -> impl std::future::Future<Output = Result<Response, StatusCode>> + Send + Clone {
    move |auth, request, next| async move {
        if has_permission(&auth, permission) {
            Ok(next.run(request).await)
        } else {
            Err(StatusCode::FORBIDDEN)
        }
    }
}

/// Create a role guard that checks for any of the specified roles
pub fn require_role(roles: &'static [&'static str]) -> impl Fn(
    axum::extract::Extension<AuthContext>,
    Request,
    Next,
) -> impl std::future::Future<Output = Result<Response, StatusCode>> + Send + Clone {
    move |auth, request, next| async move {
        if has_role(&auth, roles) {
            Ok(next.run(request).await)
        } else {
            Err(StatusCode::FORBIDDEN)
        }
    }
}

// ==========================================================================
// FileAccessLog Specific Guards
// ==========================================================================

/// Guard that requires list permission for file_access_log
pub async fn require_list_file_access_log(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, file_access_logs::LIST) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires read permission for file_access_log
pub async fn require_read_file_access_log(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, file_access_logs::READ) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires create permission for file_access_log
pub async fn require_create_file_access_log(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, file_access_logs::CREATE) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires update permission for file_access_log
pub async fn require_update_file_access_log(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, file_access_logs::UPDATE) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires delete permission for file_access_log
pub async fn require_delete_file_access_log(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, file_access_logs::DELETE) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}