backbone-bucket 0.3.0

//! Auth configuration for ConversionJob handlers
//!
//! Generated by backbone-schema. Do not edit manually.
//!
//! This module provides:
//! - Permission definitions for CRUD operations
//! - Role-based guards
//! - Auth middleware configuration

use std::sync::Arc;
use super::AuthContextExt;

use backbone_auth::middleware::AuthContext;
use axum::{
    extract::{Request, State},
    http::StatusCode,
    middleware::Next,
    response::Response,
};

// ==========================================================================
// Permission Constants
// ==========================================================================

/// Permission identifiers for ConversionJob operations
pub mod conversion_jobs {
    /// Permission to list conversion_job entities
    pub const LIST: &str = "conversion_job:list";
    /// Permission to read conversion_job entity details
    pub const READ: &str = "conversion_job:read";
    /// Permission to create conversion_job entities
    pub const CREATE: &str = "conversion_job:create";
    /// Permission to update conversion_job entities
    pub const UPDATE: &str = "conversion_job:update";
    /// Permission to delete conversion_job entities
    pub const DELETE: &str = "conversion_job:delete";
    /// Permission to restore deleted conversion_job entities
    pub const RESTORE: &str = "conversion_job:restore";
    /// Permission to view conversion_job trash
    pub const TRASH: &str = "conversion_job:trash";
    /// Permission to empty conversion_job trash (permanent delete)
    pub const EMPTY_TRASH: &str = "conversion_job:empty_trash";
    /// Permission to bulk create conversion_job entities
    pub const BULK_CREATE: &str = "conversion_job:bulk_create";
    /// Permission to upsert conversion_job entities
    pub const UPSERT: &str = "conversion_job:upsert";

    // State transition permissions
    /// Permission to execute start transition
    pub const TRANSITION_START: &str = "conversion_job:transition:start";
    /// Permission to execute update_progress transition
    pub const TRANSITION_UPDATE_PROGRESS: &str = "conversion_job:transition:update_progress";
    /// Permission to execute complete transition
    pub const TRANSITION_COMPLETE: &str = "conversion_job:transition:complete";
    /// Permission to execute fail transition
    pub const TRANSITION_FAIL: &str = "conversion_job:transition:fail";
    /// Permission to execute cancel_pending transition
    pub const TRANSITION_CANCEL_PENDING: &str = "conversion_job:transition:cancel_pending";
    /// Permission to execute cancel_running transition
    pub const TRANSITION_CANCEL_RUNNING: &str = "conversion_job:transition:cancel_running";
    /// Permission to execute retry transition
    pub const TRANSITION_RETRY: &str = "conversion_job:transition:retry";
    /// Permission to execute reconvert transition
    pub const TRANSITION_RECONVERT: &str = "conversion_job:transition:reconvert";

    /// Get all permissions for this entity
    pub fn all() -> Vec<&'static str> {
        vec![
            LIST,
            READ,
            CREATE,
            UPDATE,
            DELETE,
            RESTORE,
            TRASH,
            EMPTY_TRASH,
            BULK_CREATE,
            UPSERT,
            TRANSITION_START,
            TRANSITION_UPDATE_PROGRESS,
            TRANSITION_COMPLETE,
            TRANSITION_FAIL,
            TRANSITION_CANCEL_PENDING,
            TRANSITION_CANCEL_RUNNING,
            TRANSITION_RETRY,
            TRANSITION_RECONVERT,
        ]
    }
}

// ==========================================================================
// Permission Checking
// ==========================================================================

/// Check if auth context has a specific permission
pub fn has_permission(auth: &AuthContext, permission: &str) -> bool {
    auth.has_permission(permission)
}

/// Check if auth context has a specific role
pub fn has_role(auth: &AuthContext, role: &str) -> bool {
    auth.has_role(role)
}

/// Check if auth context has all of the required roles
pub fn has_all_roles(auth: &AuthContext, roles: &[&str]) -> bool {
    auth.has_all_roles(roles)
}

/// Check if auth context has any of the required permissions
pub fn has_any_permission(auth: &AuthContext, permissions: &[&str]) -> bool {
    permissions.iter().any(|p| auth.has_permission(p))
}

// ==========================================================================
// Permission Guards (Axum Middleware)
// ==========================================================================

/// Note: Axum middleware should be implemented as async fn, not impl Fn
/// This avoids E0562: `impl Trait` is not allowed in the return type of `Fn` trait bounds

// ==========================================================================
// ConversionJob Specific Guards
// ==========================================================================

/// Guard that requires list permission for conversion_job
pub async fn require_list_conversion_job(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, conversion_jobs::LIST) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires read permission for conversion_job
pub async fn require_read_conversion_job(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, conversion_jobs::READ) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires create permission for conversion_job
pub async fn require_create_conversion_job(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, conversion_jobs::CREATE) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires update permission for conversion_job
pub async fn require_update_conversion_job(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, conversion_jobs::UPDATE) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires delete permission for conversion_job
pub async fn require_delete_conversion_job(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, conversion_jobs::DELETE) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires restore permission for conversion_job
pub async fn require_restore_conversion_job(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, conversion_jobs::RESTORE) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires view trash permission for conversion_job
pub async fn require_trash_conversion_job(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, conversion_jobs::TRASH) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}

/// Guard that requires empty trash permission for conversion_job
pub async fn require_empty_trash_conversion_job(
    auth: axum::extract::Extension<AuthContext>,
    request: Request,
    next: Next,
) -> Result<Response, StatusCode> {
    if has_permission(&auth, conversion_jobs::EMPTY_TRASH) {
        Ok(next.run(request).await)
    } else {
        Err(StatusCode::FORBIDDEN)
    }
}