permissions_repo

type PermissionCheck struct {
	Action       entSchema.PermittedAction
	ResourceType entSchema.ResourceType
	ResourceID   uuid.UUID
	// If a custom check is provided, it will be called in addition to the standard permission checks
	CustomCheck func(ctx context.Context, userID uuid.UUID) error
}

type PermissionsRepository struct {
	// contains filtered or unexported fields
}

type PermissionsRepositoryInterface interface {
	// Check if a user has any of the provided permissions. If any check passes, the permission is granted.
	Check(ctx context.Context, userID uuid.UUID, checks []PermissionCheck) error
	// GetUserPermissionsForResource returns all permissions a user has for a specific resource
	GetUserPermissionsForResource(ctx context.Context, userID uuid.UUID, resourceType entSchema.ResourceType, resourceID uuid.UUID) ([]entSchema.PermittedAction, error)
	// CreatePermission creates a new permission
	CreatePermission(ctx context.Context, groupID uuid.UUID, action entSchema.PermittedAction, resourceType entSchema.ResourceType, selector entSchema.ResourceSelector) (*ent.Permission, error)
	// DeletePermission deletes a permission
	DeletePermission(ctx context.Context, permissionID uuid.UUID) error
	// GetPermissionsByGroup gets all permissions for a group
	GetPermissionsByGroup(ctx context.Context, groupID uuid.UUID) ([]*ent.Permission, error)
	// GetAccessibleProjectPredicates returns Ent predicates for filtering projects
	// that the user has the given action permission for.
	// Returns nil predicate and nil error if user is superuser for projects or access is broadly granted (matches all).
	// Returns a predicate that matches nothing if no access is found.
	// Returns an error if an issue occurs.
	GetAccessibleProjectPredicates(ctx context.Context, userID uuid.UUID, action entSchema.PermittedAction) (predicate.Project, error)
	// GetAccessibleTeamPredicates returns Ent predicates for filtering teams
	// that the user has the given action permission for.
	GetAccessibleTeamPredicates(ctx context.Context, userID uuid.UUID, action entSchema.PermittedAction) (predicate.Team, error)
	// GetAccessibleEnvironmentPredicates returns Ent predicates for filtering environments.
	// It can be scoped by an optional projectID.
	GetAccessibleEnvironmentPredicates(ctx context.Context, userID uuid.UUID, action entSchema.PermittedAction, projectID *uuid.UUID) (predicate.Environment, error)
	// GetAccessibleServicePredicates returns Ent predicates for filtering services.
	// It can be scoped by an optional environmentID.
	GetAccessibleServicePredicates(ctx context.Context, userID uuid.UUID, action entSchema.PermittedAction, environmentID *uuid.UUID) (predicate.Service, error)
	Create(ctx context.Context, action schema.PermittedAction, resourceType schema.ResourceType, selector schema.ResourceSelector) (*ent.Permission, error)
	AddToGroup(ctx context.Context, groupID, permissionID uuid.UUID) error
	Delete(ctx context.Context, id uuid.UUID) error
	RemoveFromGroup(ctx context.Context, groupID, permissionID uuid.UUID) error
	GetByID(ctx context.Context, id uuid.UUID) (*ent.Permission, error)
}

type ResourceHierarchyInfo struct {
	ResourceType entSchema.ResourceType
	ResourceID   uuid.UUID
}