featherdb_core/

permissions.rs

//! Table-level permissions for authorization
//!
//! This module provides the `Permissions` bitflags type used for controlling
//! access to tables in FeatherDB.

use serde::{Deserialize, Deserializer, Serialize, Serializer};
use std::fmt;

bitflags::bitflags! {
    /// Permission flags for table-level access control.
    ///
    /// These flags can be combined using bitwise OR to grant multiple permissions.
    ///
    /// # Example
    ///
    /// ```rust
    /// use featherdb_core::Permissions;
    ///
    /// // Grant read-only access
    /// let read_only = Permissions::SELECT;
    ///
    /// // Grant read-write access
    /// let read_write = Permissions::SELECT | Permissions::INSERT | Permissions::UPDATE;
    ///
    /// // Grant full access
    /// let full_access = Permissions::ALL;
    ///
    /// // Check if a permission is granted
    /// assert!(full_access.contains(Permissions::DELETE));
    /// ```
    #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
    pub struct Permissions: u8 {
        /// Permission to read data from the table (SELECT)
        const SELECT = 0b0001;
        /// Permission to insert new rows into the table (INSERT)
        const INSERT = 0b0010;
        /// Permission to modify existing rows in the table (UPDATE)
        const UPDATE = 0b0100;
        /// Permission to remove rows from the table (DELETE)
        const DELETE = 0b1000;
        /// All permissions (SELECT | INSERT | UPDATE | DELETE)
        const ALL = Self::SELECT.bits() | Self::INSERT.bits() |
                    Self::UPDATE.bits() | Self::DELETE.bits();
    }
}

impl Permissions {
    /// Create permissions from a list of permission names
    ///
    /// Valid names (case-insensitive): "SELECT", "INSERT", "UPDATE", "DELETE", "ALL"
    ///
    /// # Example
    ///
    /// ```rust
    /// use featherdb_core::Permissions;
    ///
    /// let perms = Permissions::from_names(&["SELECT", "INSERT"]).unwrap();
    /// assert!(perms.contains(Permissions::SELECT));
    /// assert!(perms.contains(Permissions::INSERT));
    /// assert!(!perms.contains(Permissions::DELETE));
    /// ```
    pub fn from_names<S: AsRef<str>>(names: &[S]) -> Result<Self, String> {
        let mut perms = Permissions::empty();
        for name in names {
            let name_upper = name.as_ref().to_uppercase();
            match name_upper.as_str() {
                "SELECT" => perms |= Permissions::SELECT,
                "INSERT" => perms |= Permissions::INSERT,
                "UPDATE" => perms |= Permissions::UPDATE,
                "DELETE" => perms |= Permissions::DELETE,
                "ALL" => perms |= Permissions::ALL,
                _ => return Err(format!("Unknown permission: {}", name.as_ref())),
            }
        }
        Ok(perms)
    }

    /// Convert permissions to a list of permission names
    ///
    /// # Example
    ///
    /// ```rust
    /// use featherdb_core::Permissions;
    ///
    /// let perms = Permissions::SELECT | Permissions::DELETE;
    /// let names = perms.to_names();
    /// assert!(names.contains(&"SELECT"));
    /// assert!(names.contains(&"DELETE"));
    /// ```
    pub fn to_names(&self) -> Vec<&'static str> {
        let mut names = Vec::new();
        if self.contains(Permissions::SELECT) {
            names.push("SELECT");
        }
        if self.contains(Permissions::INSERT) {
            names.push("INSERT");
        }
        if self.contains(Permissions::UPDATE) {
            names.push("UPDATE");
        }
        if self.contains(Permissions::DELETE) {
            names.push("DELETE");
        }
        names
    }

    /// Get a human-readable description of the permissions
    pub fn description(&self) -> String {
        if *self == Permissions::ALL {
            return "ALL".to_string();
        }
        if self.is_empty() {
            return "NONE".to_string();
        }
        self.to_names().join(", ")
    }
}

impl Default for Permissions {
    fn default() -> Self {
        Permissions::empty()
    }
}

impl fmt::Display for Permissions {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(f, "{}", self.description())
    }
}

// Custom serialization - serialize as u8 for efficiency
impl Serialize for Permissions {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: Serializer,
    {
        serializer.serialize_u8(self.bits())
    }
}

impl<'de> Deserialize<'de> for Permissions {
    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
    where
        D: Deserializer<'de>,
    {
        let bits = u8::deserialize(deserializer)?;
        Permissions::from_bits(bits)
            .ok_or_else(|| serde::de::Error::custom(format!("Invalid permission bits: {}", bits)))
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_permissions_individual() {
        assert_eq!(Permissions::SELECT.bits(), 0b0001);
        assert_eq!(Permissions::INSERT.bits(), 0b0010);
        assert_eq!(Permissions::UPDATE.bits(), 0b0100);
        assert_eq!(Permissions::DELETE.bits(), 0b1000);
    }

    #[test]
    fn test_permissions_all() {
        let all = Permissions::ALL;
        assert!(all.contains(Permissions::SELECT));
        assert!(all.contains(Permissions::INSERT));
        assert!(all.contains(Permissions::UPDATE));
        assert!(all.contains(Permissions::DELETE));
        assert_eq!(all.bits(), 0b1111);
    }

    #[test]
    fn test_permissions_combine() {
        let perms = Permissions::SELECT | Permissions::INSERT;
        assert!(perms.contains(Permissions::SELECT));
        assert!(perms.contains(Permissions::INSERT));
        assert!(!perms.contains(Permissions::UPDATE));
        assert!(!perms.contains(Permissions::DELETE));
    }

    #[test]
    fn test_permissions_from_names() {
        let perms = Permissions::from_names(&["SELECT", "INSERT"]).unwrap();
        assert!(perms.contains(Permissions::SELECT));
        assert!(perms.contains(Permissions::INSERT));
        assert!(!perms.contains(Permissions::UPDATE));

        // Case insensitive
        let perms = Permissions::from_names(&["select", "DELETE"]).unwrap();
        assert!(perms.contains(Permissions::SELECT));
        assert!(perms.contains(Permissions::DELETE));

        // ALL
        let perms = Permissions::from_names(&["ALL"]).unwrap();
        assert_eq!(perms, Permissions::ALL);

        // Invalid name
        let result = Permissions::from_names(&["INVALID"]);
        assert!(result.is_err());
    }

    #[test]
    fn test_permissions_to_names() {
        let perms = Permissions::SELECT | Permissions::DELETE;
        let names = perms.to_names();
        assert_eq!(names.len(), 2);
        assert!(names.contains(&"SELECT"));
        assert!(names.contains(&"DELETE"));

        let empty = Permissions::empty();
        assert!(empty.to_names().is_empty());
    }

    #[test]
    fn test_permissions_display() {
        assert_eq!(Permissions::ALL.to_string(), "ALL");
        assert_eq!(Permissions::empty().to_string(), "NONE");
        assert_eq!(Permissions::SELECT.to_string(), "SELECT");
        assert_eq!(
            (Permissions::SELECT | Permissions::INSERT).to_string(),
            "SELECT, INSERT"
        );
    }

    #[test]
    fn test_permissions_default() {
        let perms = Permissions::default();
        assert!(perms.is_empty());
    }

    #[test]
    fn test_permissions_serialization() {
        let perms = Permissions::SELECT | Permissions::UPDATE;
        let json = serde_json::to_string(&perms).unwrap();
        // Should serialize as u8 (5 = 0b0101)
        assert_eq!(json, "5");
        let deserialized: Permissions = serde_json::from_str(&json).unwrap();
        assert_eq!(perms, deserialized);
    }

    #[test]
    fn test_permissions_remove() {
        let mut perms = Permissions::ALL;
        perms.remove(Permissions::DELETE);
        assert!(perms.contains(Permissions::SELECT));
        assert!(perms.contains(Permissions::INSERT));
        assert!(perms.contains(Permissions::UPDATE));
        assert!(!perms.contains(Permissions::DELETE));
    }
}