filigree 0.4.1

Filigree web application framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

use sqlx::{query, PgExecutor};
use tracing::instrument;
use uuid::Uuid;

use crate::auth::{OrganizationId, RoleId, UserId};

/// Add roles to a user
#[instrument(skip(db))]
pub async fn add_roles_to_user(
    db: impl PgExecutor<'_>,
    organization_id: OrganizationId,
    user_id: UserId,
    role_ids: &[RoleId],
) -> Result<(), sqlx::Error> {
    query!(
        r##"
        INSERT INTO user_roles (organization_id, user_id, role_id)
        (
          SELECT $1, $2, role_id FROM UNNEST($3::uuid[]) role_id
        )
        ON CONFLICT DO NOTHING
        "##,
        organization_id.as_uuid(),
        user_id.as_uuid(),
        role_ids as _
    )
    .execute(db)
    .await?;

    Ok(())
}

/// Add the default role to a user, if one is set on the organization.
#[instrument(skip(db))]
pub async fn add_default_role_to_user(
    db: impl PgExecutor<'_>,
    organization_id: OrganizationId,
    user_id: UserId,
) -> Result<(), sqlx::Error> {
    query!(
        r##"
        INSERT INTO user_roles (organization_id, user_id, role_id)
        (
            SELECT $1, $2, default_role as role_id
            FROM organizations
            WHERE id = $1 AND default_role IS NOT NULL
        )
        ON CONFLICT DO NOTHING
        "##,
        organization_id.as_uuid(),
        user_id.as_uuid(),
    )
    .execute(db)
    .await?;

    Ok(())
}

/// Remove roles from a user
#[instrument(skip(db))]
pub async fn remove_roles_from_user(
    db: impl PgExecutor<'_>,
    organization_id: OrganizationId,
    user_id: UserId,
    role_ids: &[RoleId],
) -> Result<(), sqlx::Error> {
    query!(
        r##"
        DELETE FROM user_roles
            WHERE
                organization_id = $1
                AND user_id = $2
                AND role_id = ANY($3)
        "##,
        organization_id.as_uuid(),
        user_id.as_uuid(),
        role_ids as _,
    )
    .execute(db)
    .await?;

    Ok(())
}

/// Add org-wide permissions to a role or user
#[instrument(skip(db))]
pub async fn add_permissions_to_role(
    db: impl PgExecutor<'_>,
    organization_id: OrganizationId,
    actor_id: impl AsRef<Uuid> + std::fmt::Debug,
    permissions: &[String],
) -> Result<(), sqlx::Error> {
    query!(
        r##"
        INSERT INTO permissions (organization_id, actor_id, permission)
        (
          SELECT $1, $2, permission FROM UNNEST($3::text[]) permission
        )
        ON CONFLICT DO NOTHING
        "##,
        organization_id.as_uuid(),
        actor_id.as_ref(),
        permissions
    )
    .execute(db)
    .await?;

    Ok(())
}

/// Remove org-wide permissions from a role or user
#[instrument(skip(db))]
pub async fn remove_permissions_from_role(
    db: impl PgExecutor<'_>,
    organization_id: OrganizationId,
    role_id: impl AsRef<Uuid> + std::fmt::Debug,
    permissions: &[String],
) -> Result<(), sqlx::Error> {
    query!(
        r##"
        DELETE FROM permissions
            WHERE
                organization_id = $1
                AND actor_id = $2
                AND permission = ANY($3)
        "##,
        organization_id.as_uuid(),
        role_id.as_ref(),
        permissions
    )
    .execute(db)
    .await?;

    Ok(())
}