authorization_service.hpp

/* -*- mode: c++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
 *
 * Copyright (C) 2025 Marco Craveiro <marco.craveiro@gmail.com>
 *
 * This program is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License as published by the Free Software
 * Foundation; either version 3 of the License, or (at your option) any later
 * version.
 *
 * This program is distributed in the hope that it will be useful, but WITHOUT
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
 * details.
 *
 * You should have received a copy of the GNU General Public License along with
 * this program; if not, write to the Free Software Foundation, Inc., 51
 * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 *
 */
#ifndef ORES_IAM_SERVICE_AUTHORIZATION_SERVICE_HPP
#define ORES_IAM_SERVICE_AUTHORIZATION_SERVICE_HPP
 
#include <string>
#include <vector>
#include <optional>
#include <boost/uuid/uuid.hpp>
#include "ores.logging/make_logger.hpp"
#include "ores.utility/uuid/uuid_v7_generator.hpp"
#include "ores.database/domain/context.hpp"
#include "ores.iam/domain/role.hpp"
#include "ores.iam/domain/permission.hpp"
#include "ores.iam/domain/account_role.hpp"
#include "ores.iam/repository/role_repository.hpp"
#include "ores.iam/repository/permission_repository.hpp"
#include "ores.iam/repository/account_role_repository.hpp"
#include "ores.iam/repository/role_permission_repository.hpp"
#include "ores.eventing/service/event_bus.hpp"
 
namespace ores::iam::service {
 
class authorization_service {
private:
    inline static std::string_view logger_name =
        "ores.iam.service.authorization_service";
 
    [[nodiscard]] static auto& lg() {
        using namespace ores::logging;
        static auto instance = make_logger(logger_name);
        return instance;
    }
 
public:
    using context = ores::database::context;
    using event_bus = ores::eventing::service::event_bus;
 
    explicit authorization_service(context ctx,
        event_bus* event_bus = nullptr);
 
    // ========================================================================
    // Permission Management
    // ========================================================================
 
    std::vector<domain::permission> list_permissions();
 
    std::optional<domain::permission>
    find_permission_by_code(const std::string& code);
 
    domain::permission create_permission(const std::string& code,
        const std::string& description);
 
    // ========================================================================
    // Role Management
    // ========================================================================
 
    std::vector<domain::role> list_roles();
 
    std::optional<domain::role> find_role(const boost::uuids::uuid& role_id);
 
    std::optional<domain::role> find_role_by_name(const std::string& name);
 
    domain::role create_role(const std::string& name,
        const std::string& description,
        const std::vector<std::string>& permission_codes,
        const std::string& recorded_by);
 
    std::vector<std::string>
    get_role_permissions(const boost::uuids::uuid& role_id);
 
    // ========================================================================
    // Role Assignment
    // ========================================================================
 
    void assign_role(const boost::uuids::uuid& account_id,
        const boost::uuids::uuid& role_id,
        const std::string& assigned_by,
        const std::string& change_commentary = "Role assigned to account");
 
    void revoke_role(const boost::uuids::uuid& account_id,
        const boost::uuids::uuid& role_id);
 
    std::vector<domain::role>
    get_account_roles(const boost::uuids::uuid& account_id);
 
    // ========================================================================
    // Permission Checking
    // ========================================================================
 
    std::vector<std::string>
    get_effective_permissions(const boost::uuids::uuid& account_id);
 
    bool has_permission(const boost::uuids::uuid& account_id,
        std::string_view permission_code);
 
    static bool check_permission(const std::vector<std::string>& permissions,
        std::string_view required_permission);
 
private:
    void publish_account_permissions_changed(const boost::uuids::uuid& account_id);
 
    repository::permission_repository permission_repo_;
    repository::role_repository role_repo_;
    repository::account_role_repository account_role_repo_;
    repository::role_permission_repository role_permission_repo_;
    utility::uuid::uuid_v7_generator uuid_generator_;
    event_bus* event_bus_;
};
 
}
 
#endif