roleacl.cpp

/*
 * SPDX-FileCopyrightText: (C) 2014-2022 Daniel Nicoletti <dantti12@gmail.com>
 * SPDX-License-Identifier: BSD-3-Clause
 */
#include "common.h"
#include "roleacl_p.h"
 
#include <Cutelyst/Controller>
#include <Cutelyst/Dispatcher>
#include <Cutelyst/Plugins/Authentication/authentication.h>
 
using namespace Qt::StringLiterals;
using namespace Cutelyst;
 
RoleACL::RoleACL(QObject *parent)
    : Component(new RoleACLPrivate, parent)
{
}
 
Component::Modifiers RoleACL::modifiers() const
{
    return AroundExecute;
}
 
bool RoleACL::init(Cutelyst::Application *application, const QVariantHash &args)
{
    Q_D(RoleACL);
    Q_UNUSED(application)
 
    const auto attributes = args.value(u"attributes"_s).value<ParamsMultiMap>();
    d->actionReverse      = args.value(u"reverse"_s).toString();
 
    if (!attributes.contains(u"RequiresRole"_s) && !attributes.contains(u"AllowedRole"_s)) {
        qFatal("RoleACL: Action %s requires at least one RequiresRole or AllowedRole attribute",
               qPrintable(d->actionReverse));
    } else {
        const QStringList required = attributes.values(u"RequiresRole"_s);
        for (const QString &role : required) {
            d->requiresRole.append(role);
        }
 
        const QStringList allowed = attributes.values(u"AllowedRole"_s);
        for (const QString &role : allowed) {
            d->allowedRole.append(role);
        }
    }
 
    auto it = attributes.constFind(u"ACLDetachTo"_s);
    if (it == attributes.constEnd() || it.value().isEmpty()) {
        qFatal("RoleACL: Action %s requires the ACLDetachTo(<action>) attribute",
               qPrintable(d->actionReverse));
    }
    d->aclDetachTo = it.value();
 
    return true;
}
 
bool RoleACL::aroundExecute(Context *c, QStack<Cutelyst::Component *> stack)
{
    Q_D(const RoleACL);
 
    if (canVisit(c)) {
        return Component::aroundExecute(c, stack);
    }
 
    c->detach(d->detachTo);
 
    return false;
}
 
bool RoleACL::canVisit(Context *c) const
{
    Q_D(const RoleACL);
 
    const QStringList user_has = Authentication::user(c).value(u"roles"_s).toStringList();
 
    const QStringList required = d->requiresRole;
    const QStringList allowed  = d->allowedRole;
 
    if (!required.isEmpty() && !allowed.isEmpty()) {
        bool allRequired = std::ranges::all_of(
            required, [&user_has](const QString &role) { return user_has.contains(role); });
        if (!allRequired) {
            return false;
        }
 
        return std::ranges::any_of(
            allowed, [&user_has](const QString &role) { return user_has.contains(role); });
    } else if (!required.isEmpty()) {
        return std::ranges::all_of(
            required, [&user_has](const QString &role) { return user_has.contains(role); });
    } else if (!allowed.isEmpty()) {
        return std::ranges::any_of(
            allowed, [&user_has](const QString &role) { return user_has.contains(role); });
    }
 
    return false;
}
 
bool RoleACL::dispatcherReady(const Dispatcher *dispatcher, Cutelyst::Controller *controller)
{
    Q_D(RoleACL);
    Q_UNUSED(dispatcher)
 
    d->detachTo = controller->actionFor(d->aclDetachTo);
    if (!d->detachTo) {
        d->detachTo = dispatcher->getActionByPath(d->aclDetachTo);
        if (!d->detachTo) {
            qFatal(
                "RoleACL: Action '%s' requires a valid action set on the ACLDetachTo(%s) attribute",
                qPrintable(d->actionReverse),
                qPrintable(d->aclDetachTo));
        }
    }
 
    return true;
}
 
#include "moc_roleacl.cpp"