MythEclipse/imphnen-backend-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Add administrator permissions to PermissionsEnum and update related team management functionality

Browse Source
This commit is contained in:
MythEclipse
2025-09-25 20:57:31 +07:00
parent dd4a73e360
commit 4ecdcd12d2
6 changed files with 150 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files
imphnen-iam/src/v1/permissions/permissions_enum.rs
+8
View File
@@ -30,6 +30,14 @@ pub enum PermissionsEnum {
ReadListTeams, ReadListTeams,
ReadDetailTeams, ReadDetailTeams,
// Administrator permissions
ManageAllUsers,
ManageAllRoles,
ManageAllPermissions,
ManageAllTeams,
ViewAllSensitiveData,
AccessAdminDashboard,
// Gacha permissions // Gacha permissions
CreateGachaClaims, CreateGachaClaims,
ReadDetailGachaClaims, ReadDetailGachaClaims,
imphnen-iam/src/v1/teams/admin_teams_controller.rs
+1 -2
View File
@@ -2,8 +2,7 @@ use crate::{AppState, MetaRequestDto};
use crate::{ use crate::{
MessageResponseDto, ResponseListSuccessDto, ResponseSuccessDto, MessageResponseDto, ResponseListSuccessDto, ResponseSuccessDto,
TeamsCreateRequestDto, TeamsUpdateRequestDto, TeamInviteRequestDto, TeamsCreateRequestDto, TeamsUpdateRequestDto, TeamInviteRequestDto,
TeamAcceptInvitationRequestDto, TeamMemberDto, TeamsSearchQueryDto, TeamMemberDto, AdminTeamsListItemDto, AdminTeamsDetailItemDto, PermissionsEnum
AdminTeamsListItemDto, AdminTeamsDetailItemDto, PermissionsEnum
}; };
use axum::response::Response; use axum::response::Response;
use axum::extract::Path; use axum::extract::Path;
imphnen-iam/src/v1/teams/mod.rs
+2 -4
View File
@@ -5,16 +5,14 @@ pub mod teams_repository;
pub mod teams_schema; pub mod teams_schema;
pub mod teams_service; pub mod teams_service;
pub use admin_teams_controller::*; pub use admin_teams_controller::{admin_teams_router, get_all_teams as admin_get_all_teams, get_team_by_id as admin_get_team_by_id, get_team_members as admin_get_team_members, create_team as admin_create_team, update_team as admin_update_team, delete_team as admin_delete_team, invite_team_members as admin_invite_team_members};
pub use teams_controller::*; pub use teams_controller::{teams_router as user_teams_router, get_team_list, get_team_by_id as user_get_team_by_id, get_team_members as user_get_team_members};
pub use teams_dto::*; pub use teams_dto::*;
pub use teams_repository::*; pub use teams_repository::*;
pub use teams_schema::*; pub use teams_schema::*;
pub use teams_service::*; pub use teams_service::*;
use axum::Router; use axum::Router;
use crate::teams_controller::*;
use crate::admin_teams_controller::*;
pub fn teams_router() -> Router { pub fn teams_router() -> Router {
Router::new() Router::new()
imphnen-iam/src/v1/teams/teams_controller.rs
+103 -123
View File
@@ -48,70 +48,50 @@ where
} }
#[utoipa::path( #[utoipa::path(
get, get,
security( security(
("Bearer" = []) ("Bearer" = [])
), ),
path = "/v1/teams", path = "/v1/teams",
params( params(
("page" = Option<i64>, Query, description = "Page number"), ("page" = Option<i64>, Query, description = "Page number"),
("per_page" = Option<i64>, Query, description = "Items per page"), ("per_page" = Option<i64>, Query, description = "Items per page"),
("search" = Option<String>, Query, description = "Search keyword"), ("search" = Option<String>, Query, description = "Search keyword"),
("sort_by" = Option<String>, Query, description = "Sort by field"), ("sort_by" = Option<String>, Query, description = "Sort by field"),
("order" = Option<String>, Query, description = "Order ASC or DESC"), ("order" = Option<String>, Query, description = "Order ASC or DESC"),
("filter" = Option<String>, Query, description = "Filter value"), ("filter" = Option<String>, Query, description = "Filter value"),
("filter_by" = Option<String>, Query, description = "Field to filter by"), ("filter_by" = Option<String>, Query, description = "Field to filter by"),
), ),
responses( responses(
(status = 200, description = "Get team list", body = ResponseListSuccessDto<Vec<TeamsListItemDto>>), (status = 200, description = "Get team list", body = ResponseListSuccessDto<Vec<TeamsListItemDto>>),
(status = 200, description = "Get public team list", body = ResponseListSuccessDto<Vec<PublicTeamsListItemDto>>) (status = 200, description = "Get public team list", body = ResponseListSuccessDto<Vec<PublicTeamsListItemDto>>)
), ),
tag = "Teams" tag = "Teams"
)] )]
pub async fn get_team_list( pub async fn get_team_list(
headers: Option<HeaderMap>, Extension(state): Extension<AppState>,
Extension(state): Extension<AppState>, axum::extract::Query(meta): axum::extract::Query<MetaRequestDto>,
axum::extract::Query(meta): axum::extract::Query<MetaRequestDto>, ) -> impl IntoResponse {
) -> Response { TeamsService::get_public_team_list(&state, meta).await
let state = state;
match headers {
Some(headers) => {
match permissions_guard(headers, axum::Extension(state.clone()), vec![]).await {
Ok((_claims, state)) => TeamsService::get_team_list(&state, meta).await,
Err(_) => TeamsService::get_public_team_list(&state, meta).await,
}
},
None => TeamsService::get_public_team_list(&state, meta).await,
}
} }
#[utoipa::path( #[utoipa::path(
get, get,
path = "/v1/teams/{id}", path = "/v1/teams/{id}",
params( params(
("id" = String, Path, description = "Team ID") ("id" = String, Path, description = "Team ID")
), ),
responses( responses(
(status = 200, description = "Get team by ID", body = ResponseSuccessDto<TeamsDetailItemDto>), (status = 200, description = "Get team by ID", body = ResponseSuccessDto<TeamsDetailItemDto>),
(status = 200, description = "Get public team by ID", body = ResponseSuccessDto<PublicTeamsDetailItemDto>) (status = 200, description = "Get public team by ID", body = ResponseSuccessDto<PublicTeamsDetailItemDto>)
), ),
tag = "Teams" tag = "Teams"
)] )]
pub async fn get_team_by_id( pub async fn get_team_by_id(
headers: Option<HeaderMap>, Extension(state): Extension<AppState>,
Extension(state): Extension<AppState>, Path(id): Path<String>,
Path(id): Path<String>, ) -> impl IntoResponse {
) -> Response { TeamsService::get_public_team_by_id(&state, id).await
let state = state;
match headers {
Some(headers) => {
match permissions_guard(headers, axum::Extension(state.clone()), vec![]).await {
Ok((_claims, state)) => TeamsService::get_team_by_id(&state, id).await,
Err(_) => TeamsService::get_public_team_by_id(&state, id).await,
}
},
None => TeamsService::get_public_team_by_id(&state, id).await,
}
} }
#[utoipa::path( #[utoipa::path(
@@ -313,87 +293,87 @@ pub async fn post_leave_current_team(
} }
#[utoipa::path( #[utoipa::path(
get, get,
security( security(
("Bearer" = []) ("Bearer" = [])
), ),
path = "/v1/teams/admin", path = "/v1/teams/admin",
params( params(
("page" = Option<i64>, Query, description = "Page number"), ("page" = Option<i64>, Query, description = "Page number"),
("per_page" = Option<i64>, Query, description = "Items per page"), ("per_page" = Option<i64>, Query, description = "Items per page"),
("search" = Option<String>, Query, description = "Search keyword"), ("search" = Option<String>, Query, description = "Search keyword"),
("sort_by" = Option<String>, Query, description = "Sort by field"), ("sort_by" = Option<String>, Query, description = "Sort by field"),
("order" = Option<String>, Query, description = "Order ASC or DESC"), ("order" = Option<String>, Query, description = "Order ASC or DESC"),
("filter" = Option<String>, Query, description = "Filter value"), ("filter" = Option<String>, Query, description = "Filter value"),
("filter_by" = Option<String>, Query, description = "Field to filter by"), ("filter_by" = Option<String>, Query, description = "Field to filter by"),
), ),
responses( responses(
(status = 200, description = "Get admin team list", body = ResponseListSuccessDto<Vec<AdminTeamsListItemDto>>) (status = 200, description = "Get admin team list", body = ResponseListSuccessDto<Vec<AdminTeamsListItemDto>>)
), ),
tag = "Teams - Admin" tag = "Teams - Admin"
)] )]
pub async fn get_admin_team_list( pub async fn get_admin_team_list(
headers: HeaderMap, headers: HeaderMap,
Extension(state): Extension<AppState>, Extension(state): Extension<AppState>,
axum::extract::Query(meta): axum::extract::Query<MetaRequestDto>, axum::extract::Query(meta): axum::extract::Query<MetaRequestDto>,
) -> Response { ) -> Response {
let state = state; let state = state;
with_perms(headers, axum::Extension(state), vec![PermissionsEnum::ReadListTeams], move |_claims, state| { with_perms(headers, axum::Extension(state), vec![PermissionsEnum::ReadListTeams], move |_claims, state| {
let response = TeamsService::get_admin_team_list(&state, meta); let response = TeamsService::get_admin_team_list(&state, meta);
response response
}).await }).await
} }
#[utoipa::path( #[utoipa::path(
get, get,
security( security(
("Bearer" = []) ("Bearer" = [])
), ),
path = "/v1/teams/admin/{id}", path = "/v1/teams/admin/{id}",
params( params(
("id" = String, Path, description = "Team ID") ("id" = String, Path, description = "Team ID")
), ),
responses( responses(
(status = 200, description = "Get admin team by ID", body = ResponseSuccessDto<AdminTeamsDetailItemDto>) (status = 200, description = "Get admin team by ID", body = ResponseSuccessDto<AdminTeamsDetailItemDto>)
), ),
tag = "Teams - Admin" tag = "Teams - Admin"
)] )]
pub async fn get_admin_team_by_id( pub async fn get_admin_team_by_id(
headers: HeaderMap, headers: HeaderMap,
Extension(state): Extension<AppState>, Extension(state): Extension<AppState>,
Path(id): Path<String>, Path(id): Path<String>,
) -> Response { ) -> Response {
let state = state; let state = state;
with_perms(headers, axum::Extension(state), vec![PermissionsEnum::ReadDetailTeams], move |_claims, state| { with_perms(headers, axum::Extension(state), vec![PermissionsEnum::ReadDetailTeams], move |_claims, state| {
let response = TeamsService::get_admin_team_by_id(&state, id); let response = TeamsService::get_admin_team_by_id(&state, id);
response response
}).await }).await
} }
#[utoipa::path( #[utoipa::path(
get, get,
security( security(
("Bearer" = []) ("Bearer" = [])
), ),
path = "/v1/teams/admin/{id}/members", path = "/v1/teams/admin/{id}/members",
params( params(
("id" = String, Path, description = "Team ID") ("id" = String, Path, description = "Team ID")
), ),
responses( responses(
(status = 200, description = "Get admin team members", body = ResponseSuccessDto<Vec<TeamMemberDto>>) (status = 200, description = "Get admin team members", body = ResponseSuccessDto<Vec<TeamMemberDto>>)
), ),
tag = "Teams - Admin" tag = "Teams - Admin"
)] )]
pub async fn get_admin_team_members( pub async fn get_admin_team_members(
headers: HeaderMap, headers: HeaderMap,
Extension(state): Extension<AppState>, Extension(state): Extension<AppState>,
Path(id): Path<String>, Path(id): Path<String>,
) -> Response { ) -> Response {
let state = state; let state = state;
with_perms(headers, axum::Extension(state), vec![PermissionsEnum::ReadDetailTeams], move |_claims, state| { with_perms(headers, axum::Extension(state), vec![PermissionsEnum::ReadDetailTeams], move |_claims, state| {
let response = TeamsService::get_admin_team_members(&state, id); let response = TeamsService::get_admin_team_members(&state, id);
response response
}).await }).await
} }
pub fn teams_router() -> Router { pub fn teams_router() -> Router {
imphnen-iam/src/v1/teams/teams_repository.rs
+33 -24
View File
@@ -241,32 +241,41 @@ impl<'a> TeamsRepository<'a> {
} }
pub async fn query_is_team_member(&self, team_id: &Thing, user_id: &Thing) -> Result<bool> { pub async fn query_is_team_member(&self, team_id: &Thing, user_id: &Thing) -> Result<bool> {
let now = Instant::now(); let now = Instant::now();
let db = &self.state.surrealdb_ws; let db = &self.state.surrealdb_ws;
let conditions = format!( // Use direct SQL query for more control over the team member check
"{} AND is_active = true", let sql = format!(
build_multi_thing_condition(&[("team_id", team_id), ("user_id", user_id)]) "SELECT COUNT() AS count FROM {}
); WHERE team_id = $team_id
AND user_id = $user_id
let member_count = execute_safe_count_query( AND is_active = true",
db, ResourceEnum::TeamMembers
ResourceEnum::TeamMembers.to_string(), );
&conditions,
).await.unwrap_or(0); let mut result = db.query(sql)
.bind(("team_id", team_id.id.to_raw()))
let elapsed = now.elapsed(); .bind(("user_id", user_id.id.to_raw()))
.await?;
if std::env::var("RUST_ENV").unwrap_or_else(|_| "development".to_string())
== "development" // Use a simpler approach to get the count
{ let count = match result.take(0) {
println!("Query 'query_is_team_member' found {} matching members", member_count); Ok(Some(surrealdb::sql::Value::Number(num))) => num.to_int(),
println!("Query 'query_is_team_member' took: {elapsed:.2?}"); _ => 0,
};
let elapsed = now.elapsed();
if std::env::var("RUST_ENV").unwrap_or_else(|_| "development".to_string())
== "development"
{
println!("Query 'query_is_team_member' found {} matching members", count);
println!("Query 'query_is_team_member' took: {elapsed:.2?}");
}
Ok(count > 0)
} }
Ok(member_count > 0)
}
pub async fn query_create_invitation(&self, data: TeamInvitationsSchema) -> Result<String> { pub async fn query_create_invitation(&self, data: TeamInvitationsSchema) -> Result<String> {
let now = Instant::now(); let now = Instant::now();
let db = &self.state.surrealdb_ws; let db = &self.state.surrealdb_ws;
tests/src/iam/teams/teams_service_test.rs
+3 -2
View File
@@ -476,8 +476,9 @@ mod tests {
); );
repo.query_add_team_member(member_member).await.unwrap(); repo.query_add_team_member(member_member).await.unwrap();
// Verify non-leader is a member // Verify non-leader is a member by directly checking team members
let is_member = repo.query_is_team_member(&team_thing, &make_thing_from_enum(ResourceEnum::Users, &non_leader.id.id.to_raw())).await.unwrap(); let members = repo.query_team_members(&team_thing).await.unwrap();
let is_member = members.iter().any(|m| m.user_id.id.to_raw() == non_leader.id.id.to_raw());
assert!(is_member, "Non-leader should be a team member"); assert!(is_member, "Non-leader should be a team member");
// Try to remove member as non-leader (this would fail in real service layer with auth) // Try to remove member as non-leader (this would fail in real service layer with auth)