ricecoder_teams/

access.rs

/// Access control and permission management
use std::collections::HashMap;
use std::sync::Arc;

use ricecoder_permissions::{AuditLogger, PermissionManager};
use tokio::sync::RwLock;

use crate::error::Result;
use crate::models::{AuditLogEntry, TeamRole};

/// Manages team member roles and permissions
pub struct AccessControlManager {
    /// Permission manager for role-based access control
    #[allow(dead_code)]
    permission_manager: Arc<PermissionManager>,
    /// Audit logger for tracking permission changes
    audit_logger: Arc<AuditLogger>,
    /// In-memory cache of member roles (team_id -> member_id -> role)
    member_roles: Arc<RwLock<HashMap<String, HashMap<String, TeamRole>>>>,
}

impl AccessControlManager {
    /// Create a new AccessControlManager
    pub fn new(permission_manager: Arc<PermissionManager>, audit_logger: Arc<AuditLogger>) -> Self {
        AccessControlManager {
            permission_manager,
            audit_logger,
            member_roles: Arc::new(RwLock::new(HashMap::new())),
        }
    }

    /// Assign a role to a team member
    pub async fn assign_role(&self, team_id: &str, member_id: &str, role: TeamRole) -> Result<()> {
        // Store role in cache
        let mut roles = self.member_roles.write().await;
        let team_roles = roles
            .entry(team_id.to_string())
            .or_insert_with(HashMap::new);
        team_roles.insert(member_id.to_string(), role);

        // Log the action
        tracing::info!(
            team_id = %team_id,
            member_id = %member_id,
            role = %role.as_str(),
            "Assigning role to team member"
        );

        // Audit log entry
        let tool_name = format!("team:{}:assign_role", team_id);
        let context = format!("Assigned role {} to member {}", role.as_str(), member_id);
        let _ =
            self.audit_logger
                .log_execution(tool_name, Some(member_id.to_string()), Some(context));

        Ok(())
    }

    /// Check if a member has permission for an action
    pub async fn check_permission(
        &self,
        member_id: &str,
        action: &str,
        resource: &str,
    ) -> Result<bool> {
        // For now, we check based on role-based permissions
        // In a full implementation, this would integrate with PermissionManager
        tracing::info!(
            member_id = %member_id,
            action = %action,
            resource = %resource,
            "Checking permission"
        );

        // This is a placeholder - actual permission checking would be more sophisticated
        Ok(true)
    }

    /// Grant Admin role permissions
    pub async fn grant_admin_permissions(&self, member_id: &str) -> Result<()> {
        // Admin permissions: create, modify, delete standards
        let permissions = vec!["create_standards", "modify_standards", "delete_standards"];

        for permission in permissions {
            tracing::info!(
                member_id = %member_id,
                permission = %permission,
                "Granting admin permission"
            );
        }

        Ok(())
    }

    /// Grant Member role permissions
    pub async fn grant_member_permissions(&self, member_id: &str) -> Result<()> {
        // Member permissions: view, apply standards
        let permissions = vec!["view_standards", "apply_standards"];

        for permission in permissions {
            tracing::info!(
                member_id = %member_id,
                permission = %permission,
                "Granting member permission"
            );
        }

        Ok(())
    }

    /// Grant Viewer role permissions
    pub async fn grant_viewer_permissions(&self, member_id: &str) -> Result<()> {
        // Viewer permissions: read-only access
        let permissions = vec!["view_standards"];

        for permission in permissions {
            tracing::info!(
                member_id = %member_id,
                permission = %permission,
                "Granting viewer permission"
            );
        }

        Ok(())
    }

    /// Revoke all access for a member
    pub async fn revoke_access(&self, team_id: &str, member_id: &str) -> Result<()> {
        // Remove from role cache
        let mut roles = self.member_roles.write().await;
        if let Some(team_roles) = roles.get_mut(team_id) {
            team_roles.remove(member_id);
        }

        tracing::info!(
            team_id = %team_id,
            member_id = %member_id,
            "Revoking access"
        );

        // Audit log entry
        let tool_name = format!("team:{}:revoke_access", team_id);
        let context = format!("Revoked access for member {}", member_id);
        let _ =
            self.audit_logger
                .log_execution(tool_name, Some(member_id.to_string()), Some(context));

        Ok(())
    }

    /// Get audit log entries
    pub async fn get_audit_log(&self, team_id: &str) -> Result<Vec<AuditLogEntry>> {
        // Query audit log for team-related entries
        tracing::info!(team_id = %team_id, "Retrieving audit log");

        // Get all entries from the audit logger
        let entries = self
            .audit_logger
            .entries()
            .map_err(crate::error::TeamError::PermissionsError)?;

        // Convert and filter entries for this team
        let team_entries: Vec<AuditLogEntry> = entries
            .into_iter()
            .filter(|entry| entry.tool.contains(&format!("team:{}", team_id)))
            .map(|entry| AuditLogEntry {
                id: entry.id,
                team_id: team_id.to_string(),
                user_id: entry.agent.unwrap_or_default(),
                action: entry.action.to_string(),
                resource: entry.tool,
                result: entry.result.to_string(),
                timestamp: entry.timestamp,
            })
            .collect();

        Ok(team_entries)
    }

    /// Get the role of a team member
    pub async fn get_member_role(
        &self,
        team_id: &str,
        member_id: &str,
    ) -> Result<Option<TeamRole>> {
        let roles = self.member_roles.read().await;
        Ok(roles
            .get(team_id)
            .and_then(|team_roles| team_roles.get(member_id).copied()))
    }

    /// Check if a member has a specific role
    pub async fn has_role(&self, team_id: &str, member_id: &str, role: TeamRole) -> Result<bool> {
        let member_role = self.get_member_role(team_id, member_id).await?;
        Ok(member_role == Some(role))
    }
}

impl Default for AccessControlManager {
    fn default() -> Self {
        // Create default instances of dependencies
        let permission_manager = Arc::new(PermissionManager::new());
        let audit_logger = Arc::new(AuditLogger::new());
        Self::new(permission_manager, audit_logger)
    }
}