Initial commit

internal/web/role_editor.go

@@ -0,0 +1,62 @@
+package web
+
+import (
+	"strconv"
+
+	"gardomatic.kleiax.de/lib/client"
+)
+
+type roleEditorRole struct {
+	Name        string
+	Label       string
+	Permissions []string
+	Editable    bool
+	EditLabel   bool
+	Deletable   bool
+}
+
+type roleEditorData struct {
+	ID           string
+	Title        string
+	Description  string
+	Scope        string
+	Roles        []roleEditorRole
+	Permissions  []permissionOption
+	CreateAction string
+	UpdateAction string
+	DeleteAction string
+	CSRFToken    string
+	Garden       *client.Garden
+}
+
+func globalRoleEditor(id, title, description, scope string, roles []client.Role, permissions []permissionOption, csrfToken string) roleEditorData {
+	result := roleEditorData{ID: id, Title: title, Description: description, Scope: scope, Permissions: permissions, CreateAction: webPath("admin.role.new"), UpdateAction: webPath("admin.role.update"), DeleteAction: webPath("admin.role.delete"), CSRFToken: csrfToken}
+	for _, role := range roles {
+		effective := []string{}
+		for _, permission := range permissions {
+			if clientRoleHasPermission(role, permission.Name) {
+				effective = append(effective, permission.Name)
+			}
+		}
+		result.Roles = append(result.Roles, roleEditorRole{Name: role.Name, Label: role.Label, Permissions: effective, Editable: role.Name != "owner", EditLabel: true, Deletable: !role.System})
+	}
+	return result
+}
+
+func gardenOverrideRoleEditor(gardenID int, roles []client.GardenRoleSetting, permissions []permissionOption, csrfToken string) roleEditorData {
+	id := strconv.Itoa(gardenID)
+	result := roleEditorData{ID: "garden-role-editor", Title: "Gartenspezifische Rollenrechte", Description: "Diese Einstellungen überschreiben die globalen Gartenrollen nur für diesen Garten.", Scope: "garden", Permissions: permissions, CreateAction: webPath("garden.role.new", id), UpdateAction: webPath("garden.role.update", id), DeleteAction: webPath("garden.role.delete", id), CSRFToken: csrfToken}
+	for _, setting := range roles {
+		result.Roles = append(result.Roles, roleEditorRole{Name: setting.Role.Name, Label: setting.Role.Label, Permissions: setting.EffectivePermissions, Editable: setting.Role.Name != "owner", Deletable: setting.Role.GardenID != nil})
+	}
+	return result
+}
+
+func clientRoleHasPermission(role client.Role, permission string) bool {
+	for _, granted := range role.Permissions {
+		if granted == permission || granted == "*" || granted == "garden:*" && permission != "garden:delete" {
+			return true
+		}
+	}
+	return false
+}