Agent-System/internal/authz/authorizer.go

package authz

import (
	"context"
	"errors"
	"fmt"
	"time"

	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgxpool"

	"chat-agent-system/internal/docduty"
)

var (
	ErrForbidden       = errors.New("authz: forbidden")
	ErrProjectNotFound = errors.New("authz: project not found")
	ErrUnauthenticated = errors.New("authz: unauthenticated")
)

const (
	RoleOwner    = "owner"
	RoleMember   = "member"
	RoleViewer   = "viewer"
	StatusActive = "active"
	StatusExited = "exited"
)

var allowedProjectRoles = map[string]struct{}{
	RoleOwner:  {},
	RoleMember: {},
	RoleViewer: {},
}

// ProjectMemberRecord 项目成员 API 视图。
type ProjectMemberRecord struct {
	ID           int64  `json:"id,omitempty"`
	ProjectID    int64  `json:"project_id,omitempty"`
	UserID       int64  `json:"user_id"`
	Username     string `json:"username,omitempty"`
	Name         string `json:"name,omitempty"`
	ProjectRole  string `json:"project_role"`
	DocumentDuty string `json:"document_duty,omitempty"`
	Status       string `json:"status"`
	JoinedAt     string `json:"joined_at,omitempty"`
}

// MemberUpsert 项目访问角色 + 可选文档职责。
type MemberUpsert struct {
	ProjectRole  string
	DocumentDuty *string
}

// Authorizer 项目级对象授权。
type Authorizer struct {
	pool *pgxpool.Pool
}

func NewAuthorizer(pool *pgxpool.Pool) *Authorizer {
	return &Authorizer{pool: pool}
}

func (a *Authorizer) enabled() bool {
	return a != nil && a.pool != nil
}

// AddOwnerOnCreate 项目创建时写入 owner 成员关系，并默认编制职责。
func (a *Authorizer) AddOwnerOnCreate(ctx context.Context, projectID, userID int64) error {
	duty := docduty.DutyAuthor
	return a.UpsertProjectMemberSpec(ctx, projectID, userID, MemberUpsert{
		ProjectRole:  RoleOwner,
		DocumentDuty: &duty,
	})
}

// IsProjectMember 判断用户是否为项目 active 成员或创建人。
func (a *Authorizer) IsProjectMember(ctx context.Context, projectID, userID int64) (bool, error) {
	if projectID <= 0 || userID <= 0 {
		return false, nil
	}
	if !a.enabled() {
		return userID > 0, nil
	}
	var member bool
	err := a.pool.QueryRow(ctx, `
		SELECT EXISTS (
			SELECT 1 FROM project_members pm
			WHERE pm.project_id = $1 AND pm.user_id = $2 AND pm.status = $3
		) OR EXISTS (
			SELECT 1 FROM projects p
			WHERE p.id = $1 AND p.creator_user_id = $2
		)
	`, projectID, userID, StatusActive).Scan(&member)
	return member, err
}

// RequireProjectAccess 要求用户可访问项目。
func (a *Authorizer) RequireProjectAccess(ctx context.Context, projectID, userID int64) error {
	if userID <= 0 {
		return ErrUnauthenticated
	}
	ok, err := a.IsProjectMember(ctx, projectID, userID)
	if err != nil {
		return err
	}
	if !ok {
		return ErrForbidden
	}
	return nil
}

// RequireProjectAccessOrAdmin 管理员可跨项目访问。
func (a *Authorizer) RequireProjectAccessOrAdmin(ctx context.Context, projectID, userID int64, isAdmin bool) error {
	if isAdmin {
		return nil
	}
	return a.RequireProjectAccess(ctx, projectID, userID)
}

// BackfillCreatorMembers 为既有项目补齐 creator owner 记录（迁移后一次性）。
func (a *Authorizer) BackfillCreatorMembers(ctx context.Context) error {
	if !a.enabled() {
		return nil
	}
	_, err := a.pool.Exec(ctx, `
		INSERT INTO project_members (project_id, user_id, project_role, status, joined_at, updated_at)
		SELECT p.id, p.creator_user_id, $1, $2, now(), now()
		FROM projects p
		WHERE p.creator_user_id IS NOT NULL AND p.creator_user_id > 0
		ON CONFLICT (project_id, user_id) DO NOTHING
	`, RoleOwner, StatusActive)
	return err
}

// ListVisibleProjectIDs 返回用户可见项目 ID（成员或创建人）。
func (a *Authorizer) ListVisibleProjectIDs(ctx context.Context, userID int64) ([]int64, error) {
	if !a.enabled() {
		return nil, nil
	}
	rows, err := a.pool.Query(ctx, `
		SELECT DISTINCT p.id
		FROM projects p
		LEFT JOIN project_members pm ON pm.project_id = p.id AND pm.user_id = $1 AND pm.status = $2
		WHERE pm.user_id IS NOT NULL OR p.creator_user_id = $1
		ORDER BY p.id DESC
	`, userID, StatusActive)
	if err != nil {
		return nil, fmt.Errorf("list visible projects: %w", err)
	}
	defer rows.Close()
	var ids []int64
	for rows.Next() {
		var id int64
		if err := rows.Scan(&id); err != nil {
			return nil, err
		}
		ids = append(ids, id)
	}
	return ids, rows.Err()
}

func validateProjectRole(role string) error {
	if _, ok := allowedProjectRoles[role]; !ok {
		return fmt.Errorf("authz: invalid project_role %q", role)
	}
	return nil
}

// IsProjectOwner 判断用户是否为项目 owner（成员表或创建人）。
func (a *Authorizer) IsProjectOwner(ctx context.Context, projectID, userID int64) (bool, error) {
	if projectID <= 0 || userID <= 0 {
		return false, nil
	}
	if !a.enabled() {
		return userID > 0, nil
	}
	var owner bool
	err := a.pool.QueryRow(ctx, `
		SELECT EXISTS (
			SELECT 1 FROM project_members pm
			WHERE pm.project_id = $1 AND pm.user_id = $2
			  AND pm.status = $3 AND pm.project_role = $4
		) OR EXISTS (
			SELECT 1 FROM projects p
			WHERE p.id = $1 AND p.creator_user_id = $2
		)
	`, projectID, userID, StatusActive, RoleOwner).Scan(&owner)
	return owner, err
}

// ListProjectMembers 列出项目 active/exited 成员。
func (a *Authorizer) ListProjectMembers(ctx context.Context, projectID int64) ([]ProjectMemberRecord, error) {
	if projectID <= 0 {
		return nil, nil
	}
	if !a.enabled() {
		return nil, nil
	}
	rows, err := a.pool.Query(ctx, `
		SELECT pm.id, pm.project_id, pm.user_id,
		       COALESCE(NULLIF(u.username, ''), u.account_id, '') AS username,
		       COALESCE(u.name, '') AS name,
		       pm.project_role, COALESCE(pm.document_duty, ''), pm.status, pm.joined_at
		FROM project_members pm
		JOIN users u ON u.id = pm.user_id
		WHERE pm.project_id = $1
		ORDER BY pm.joined_at ASC, pm.user_id ASC
	`, projectID)
	if err != nil {
		return nil, fmt.Errorf("list project members: %w", err)
	}
	defer rows.Close()
	out := make([]ProjectMemberRecord, 0)
	for rows.Next() {
		var rec ProjectMemberRecord
		var joined time.Time
		if err := rows.Scan(
			&rec.ID, &rec.ProjectID, &rec.UserID,
			&rec.Username, &rec.Name,
			&rec.ProjectRole, &rec.DocumentDuty, &rec.Status, &joined,
		); err != nil {
			return nil, err
		}
		rec.JoinedAt = joined.Format("2006-01-02 15:04:05")
		out = append(out, rec)
	}
	return out, rows.Err()
}

// UpsertProjectMember 新增或更新成员访问角色（禁止把 author/reviewer/approver 写入 project_role）。
func (a *Authorizer) UpsertProjectMember(ctx context.Context, projectID, userID int64, projectRole string) error {
	return a.UpsertProjectMemberSpec(ctx, projectID, userID, MemberUpsert{ProjectRole: projectRole})
}

// UpsertProjectMemberSpec 写入访问角色，并可选独占 document_duty。
func (a *Authorizer) UpsertProjectMemberSpec(ctx context.Context, projectID, userID int64, spec MemberUpsert) error {
	if projectID <= 0 || userID <= 0 {
		return fmt.Errorf("authz: invalid project or user id")
	}
	if err := validateProjectRole(spec.ProjectRole); err != nil {
		return err
	}
	var duty string
	var err error
	if spec.DocumentDuty != nil {
		duty, err = docduty.NormalizeDocumentDuty(*spec.DocumentDuty)
		if err != nil {
			return err
		}
	}
	if !a.enabled() {
		return nil
	}
	tx, err := a.pool.Begin(ctx)
	if err != nil {
		return err
	}
	defer func() { _ = tx.Rollback(ctx) }()

	if spec.DocumentDuty != nil && duty != docduty.DutyNone {
		if _, err := tx.Exec(ctx, `
			UPDATE project_members
			SET document_duty = '', updated_at = now()
			WHERE project_id = $1 AND document_duty = $2 AND user_id <> $3 AND status = $4
		`, projectID, duty, userID, StatusActive); err != nil {
			return err
		}
	}

	if spec.DocumentDuty != nil {
		_, err = tx.Exec(ctx, `
			INSERT INTO project_members (project_id, user_id, project_role, document_duty, status, joined_at, updated_at)
			VALUES ($1, $2, $3, $4, $5, now(), now())
			ON CONFLICT (project_id, user_id) DO UPDATE SET
				project_role = EXCLUDED.project_role,
				document_duty = EXCLUDED.document_duty,
				status = EXCLUDED.status,
				updated_at = now()
		`, projectID, userID, spec.ProjectRole, duty, StatusActive)
	} else {
		_, err = tx.Exec(ctx, `
			INSERT INTO project_members (project_id, user_id, project_role, status, joined_at, updated_at)
			VALUES ($1, $2, $3, $4, now(), now())
			ON CONFLICT (project_id, user_id) DO UPDATE SET
				project_role = EXCLUDED.project_role,
				status = EXCLUDED.status,
				updated_at = now()
		`, projectID, userID, spec.ProjectRole, StatusActive)
	}
	if err != nil {
		return err
	}
	return tx.Commit(ctx)
}

// SetProjectMemberStatus 更新成员状态（如 exited）。
func (a *Authorizer) SetProjectMemberStatus(ctx context.Context, projectID, userID int64, status string) error {
	if projectID <= 0 || userID <= 0 {
		return fmt.Errorf("authz: invalid project or user id")
	}
	if status != StatusActive && status != StatusExited {
		return fmt.Errorf("authz: invalid member status %q", status)
	}
	if !a.enabled() {
		return nil
	}
	tag, err := a.pool.Exec(ctx, `
		UPDATE project_members
		SET status = $3, updated_at = now()
		WHERE project_id = $1 AND user_id = $2
	`, projectID, userID, status)
	if err != nil {
		return err
	}
	if tag.RowsAffected() == 0 {
		return fmt.Errorf("authz: project member not found")
	}
	return nil
}

// TableExists 检查 project_members 表是否存在。
func TableExists(ctx context.Context, pool *pgxpool.Pool, table string) (bool, error) {
	if pool == nil {
		return false, nil
	}
	var exists bool
	err := pool.QueryRow(ctx, `
		SELECT EXISTS (
			SELECT 1 FROM information_schema.tables
			WHERE table_schema = 'public' AND table_name = $1
		)
	`, table).Scan(&exists)
	if errors.Is(err, pgx.ErrNoRows) {
		return false, nil
	}
	return exists, err
}