CoreID/app/models/iam/Policy.model.js

const { Model } = require('flitter-orm')

// TODO - remove specific :create checks; auto-grant permissions on create

class PolicyModel extends Model {
    static get services() {
        return [...super.services, 'models', 'canon']
    }

    static get schema() {
        return {
            entity_type: String, // user | group
            entity_id: String,
            access_type: String, // allow | deny
            target_type: { type: String, default: 'application' }, // application | api_scope | machine | machine_group
            target_id: String,
            active: { type: Boolean, default: true },
        }
    }

    static async check_allow(entity_id, target_id) {
        const policies = await this.find({
            entity_id,
            target_id,
            access_type: 'allow',
            active: true,
        })

        return policies.length > 0
    }

    static async check_deny(entity_id, target_id) {
        const policies = await this.find({
            entity_id,
            target_id,
            access_type: 'deny',
            active: true,
        })

        return policies.length === 0
    }

    static async check_entity_access(entity_id, target_id) {
        return (await this.check_allow(entity_id, target_id)) && !(await this.check_deny(entity_id, target_id))
    }

    static async check_user_denied(user, target_id) {
        const groups = await user.groups()
        const group_ids = groups.map(x => x.id)

        const user_denials = await this.find({
            entity_id: user.id,
            target_id,
            access_type: 'deny',
            active: true,
        })

        const group_denials = await this.find({
            entity_id: { $in: group_ids },
            target_id,
            access_type: 'deny',
            active: true,
        })

        return user_denials.length > 0 || group_denials.length > 0
    }

    static async check_user_access(user, target_id) {
        const groups = await user.groups()
        const group_ids = groups.map(x => x.id)

        const user_approvals = await this.find({
            entity_id: user.id,
            target_id,
            access_type: 'allow',
            active: true,
        })

        const user_denials = await this.find({
            entity_id: user.id,
            target_id,
            access_type: 'deny',
            active: true,
        })

        const group_approvals = await this.find({
            entity_id: { $in: group_ids },
            target_id,
            access_type: 'allow',
            active: true,
        })

        const group_denials = await this.find({
            entity_id: { $in: group_ids },
            target_id,
            access_type: 'deny',
            active: true,
        })

        // IF user has explicit denial, deny
        if ( user_denials.length > 0 ) return false

        // ELSE IF user has explicit approval, approve
        if ( user_approvals.length > 0 ) return true

        // ELSE IF group has denial, deny
        if ( group_denials.length > 0 ) return false

        // ELSE IF group has approval, approve
        if ( group_approvals.length > 0 ) return true

        // ELSE deny
        return false
    }

    async to_api() {
        let entity_display = ''
        if ( this.entity_type === 'user' ) {
            const User = this.models.get('auth:User')
            const user = await User.findById(this.entity_id)
            entity_display = `User: ${user.last_name}, ${user.first_name} (${user.uid.toLowerCase()})`
        } else if ( this.entity_type === 'group' ) {
            const Group = this.models.get('auth:Group')
            const group = await Group.findById(this.entity_id)
            entity_display = `Group: ${group.name} (${group.user_ids.length} users)`
        }

        let target_display = ''
        if ( this.target_type === 'application' ) {
            const Application = this.models.get('Application')
            const app = await Application.findById(this.target_id)
            target_display = `Application: ${app.name}`
        } else if ( this.target_type === 'api_scope' ) {
            target_display = `API Scope: ${this.target_id}`
        } else if ( this.target_type === 'machine' ) {
            const Machine = this.models.get('ldap:Machine')
            const machine = await Machine.findById(this.target_id)
            target_display = `Computer: ${machine.name}`

            if ( machine.host_name ) {
                target_display += ` (${machine.host_name})`
            }
        } else if ( this.target_type === 'machine_group' ) {
            const MachineGroup = this.models.get('ldap:MachineGroup')
            const group = await MachineGroup.findById(this.target_id)
            target_display = `Computer Group: ${group.name} (${group.machine_ids.length} computers)`
        }

        return {
            id: this.id,
            entity_display,
            entity_type: this.entity_type,
            entity_id: this.entity_id,
            access_type: this.access_type,
            target_display,
            target_type: this.target_type,
            target_id: this.target_id,
        }
    }
}

module.exports = exports = PolicyModel