dialtone_axum 0.1.0

use dialtone_common::{
    authz::{actor::authz_actor_on_host, ap_object::authz_ap_object_on_host},
    rest::users::web_user::SystemRole,
};
use sqlx::{Executor, Postgres};

use crate::{err_unauthorized, response::response_error::ResponseError, start_server::SharedState};

use super::user_authz::{authz_actor_for_ap_object, authz_for_ap_object};

pub async fn authz_owner_or_contentadmin_for_ap_object(
    exec: impl Executor<'_, Database = Postgres>,
    state: &SharedState,
    ap_object_id: &str,
) -> Result<(), ResponseError> {
    let user_authz = &state.read().await.user_authz;
    let authz = authz_for_ap_object(exec, user_authz, &ap_object_id).await?;
    if !authz {
        err_unauthorized!()
    } else {
        Ok(())
    }
}

pub async fn authz_contentadmin_for_ap_object(
    state: &SharedState,
    ap_object_id: &str,
) -> Result<(), ResponseError> {
    let user_authz = &state.read().await.user_authz;
    let authz = authz_ap_object_on_host(&user_authz, &SystemRole::ContentAdmin, &ap_object_id);
    if !authz {
        err_unauthorized!()
    } else {
        Ok(())
    }
}

pub async fn authz_owner_or_contentadmin_for_actor(
    exec: impl Executor<'_, Database = Postgres>,
    state: &SharedState,
    actor_id: &str,
) -> Result<(), ResponseError> {
    let user_authz = &state.read().await.user_authz;
    let authz = authz_actor_for_ap_object(exec, user_authz, &actor_id).await?;
    if !authz {
        err_unauthorized!()
    } else {
        Ok(())
    }
}

pub async fn authz_contentadmin_for_actor(
    state: &SharedState,
    actor_id: &str,
) -> Result<(), ResponseError> {
    let user_authz = &state.read().await.user_authz;
    let authz = authz_actor_on_host(&user_authz, &SystemRole::ContentAdmin, &actor_id);
    if !authz {
        err_unauthorized!()
    } else {
        Ok(())
    }
}