heelonvault-core 1.1.0

Core cryptography and storage library for HeelonVault
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

use crate::errors::{AccessDeniedReason, AppError};
use crate::models::{TeamMemberRole, User, UserRole, VaultShareRole};

#[derive(Debug, Clone, Copy)]
pub enum Action {
    AdminManageUsers,
    TeamManageMembers,
    TeamReadMembers,
    VaultCreate,
    VaultOpen,
    VaultWrite,
    VaultList,
    VaultDelete,
    VaultShare,
    VaultRevoke,
    VaultRotate,
    AuditRead,
    AuditWrite,
    BackupExport,
    BackupRestore,
}

#[derive(Debug, Clone)]
pub enum Resource {
    Global,
    Team {
        requester_role: Option<TeamMemberRole>,
    },
    Vault {
        is_owner: bool,
        has_direct_share: bool,
        has_team_share: bool,
        share_role: Option<VaultShareRole>,
    },
}

pub fn check_permission(user: &User, action: Action, resource: &Resource) -> Result<(), AppError> {
    if matches!(user.role, UserRole::Admin) {
        return Ok(());
    }

    match (action, resource) {
        (Action::AdminManageUsers, _) => {
            Err(AppError::Authorization(AccessDeniedReason::AdminRequired))
        }
        (Action::AuditRead, _) => Err(AppError::Authorization(AccessDeniedReason::AdminRequired)),
        (Action::AuditWrite, _) => Ok(()),
        (Action::TeamManageMembers, Resource::Team { requester_role }) => {
            if matches!(requester_role, Some(TeamMemberRole::Leader)) {
                Ok(())
            } else {
                Err(AppError::Authorization(
                    AccessDeniedReason::TeamLeaderRequired,
                ))
            }
        }
        (Action::TeamReadMembers, Resource::Team { requester_role }) => {
            if requester_role.is_some() {
                Ok(())
            } else {
                Err(AppError::Authorization(
                    AccessDeniedReason::TeamMembershipRequired,
                ))
            }
        }
        (Action::VaultCreate, Resource::Global) => Ok(()),
        (Action::VaultList, Resource::Global) => Ok(()),
        (
            Action::VaultDelete,
            Resource::Vault {
                is_owner,
                has_direct_share: _,
                has_team_share: _,
                share_role,
            },
        ) => {
            if *is_owner || share_role.is_some_and(|role| role.can_admin()) {
                Ok(())
            } else {
                Err(AppError::Authorization(
                    AccessDeniedReason::VaultAdminRequired,
                ))
            }
        }
        (
            Action::VaultWrite,
            Resource::Vault {
                is_owner,
                has_direct_share,
                has_team_share,
                share_role,
            },
        ) => {
            let has_access = *is_owner || *has_direct_share || *has_team_share;
            if has_access && (*is_owner || share_role.is_some_and(|role| role.can_write())) {
                Ok(())
            } else {
                Err(AppError::Authorization(
                    AccessDeniedReason::VaultWriteDenied,
                ))
            }
        }
        (
            Action::VaultOpen,
            Resource::Vault {
                is_owner,
                has_direct_share,
                has_team_share,
                share_role: _,
            },
        ) => {
            if *is_owner || *has_direct_share || *has_team_share {
                Ok(())
            } else {
                Err(AppError::Authorization(
                    AccessDeniedReason::VaultAccessDenied,
                ))
            }
        }
        (
            Action::VaultShare | Action::VaultRevoke | Action::VaultRotate,
            Resource::Vault {
                is_owner,
                has_direct_share,
                has_team_share,
                share_role,
            },
        ) => {
            let has_access = *is_owner || *has_direct_share || *has_team_share;
            if has_access && (*is_owner || share_role.is_some_and(|role| role.can_admin())) {
                Ok(())
            } else {
                Err(AppError::Authorization(
                    AccessDeniedReason::VaultAdminRequired,
                ))
            }
        }
        (Action::BackupExport, _) => {
            Err(AppError::Authorization(AccessDeniedReason::AdminRequired))
        }
        (Action::BackupRestore, _) => {
            Err(AppError::Authorization(AccessDeniedReason::AdminRequired))
        }
        _ => Err(AppError::Authorization(AccessDeniedReason::Unauthorized)),
    }
}