1. 1
2. 2
3. 3
4. 4
5. 5
6. 6
7. 7
8. 8
9. 9
10. 10
11. 11
12. 12
13. 13
14. 14
15. 15
16. 16
17. 17
18. 18
19. 19
20. 20
21. 21
22. 22
23. 23
24. 24
25. 25
26. 26
27. 27
28. 28
29. 29
30. 30
31. 31
32. 32
33. 33
34. 34
35. 35
36. 36
37. 37
38. 38
39. 39
40. 40
41. 41
42. 42
43. 43
44. 44
45. 45
46. 46
47. 47
48. 48
49. 49
50. 50
51. 51
52. 52
53. 53
54. 54
55. 55
56. 56
57. 57
58. 58
59. 59
60. 60
61. 61
62. 62
63. 63
64. 64
65. 65
66. 66
67. 67
68. 68
69. 69
70. 70
71. 71
72. 72
73. 73
74. 74
75. 75
76. 76
77. 77
78. 78
79. 79
80. 80
81. 81
82. 82
83. 83
84. 84
85. 85
86. 86
87. 87
88. 88
89. 89
90. 90
91. 91
92. 92
93. 93
94. 94
95. 95
96. 96
97. 97
98. 98
99. 99
100. 100
101. 101
102. 102
103. 103
104. 104
105. 105
106. 106
107. 107
108. 108
109. 109
110. 110
111. 111
112. 112
113. 113
114. 114
115. 115
116. 116
117. 117
118. 118
119. 119
120. 120
121. 121
122. 122
123. 123
124. 124
125. 125
126. 126
127. 127
128. 128
129. 129
130. 130
131. 131
132. 132
133. 133
134. 134
135. 135

// SPDX-License-Identifier: AGPL-3.0-only
// Copyright 2026 Shota FUJI
//
// This program is free software: you can redistribute it and/or modify it under the terms
// of the GNU Affero General Public License as published by the Free Software Foundation,
// either version 3 of the License, or (at your option) any later version.
//
// This program is distributed in the hope that it will be useful, but WITHOUT ANY
// WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
// PARTICULAR PURPOSE.  See the GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License along
// with this program.  If not, see <http://www.gnu.org/licenses/>.

const std = @import("std");

const flatbuffers = @import("flatbuffers");
const v1 = @import("v1");

const schema = v1.Yamori.Auth.V1;

/// * 管理者以外は自分のリソースのみ作成・変更可能
/// * どのユーザでも全てのリソースを閲覧可能
export fn v1_allow_resource_access(buffer_ptr: [*]const u8, buffer_len: u32) bool {
    const buffer = buffer_ptr[0..buffer_len];
    return v1AllowResourceAccess(buffer) catch return false;
}

fn v1AllowResourceAccess(buffer: []const u8) !bool {
    const root = flatbuffers.decodeRoot(schema.AccessRequest, @alignCast(buffer)) catch return false;

    if (root.user().is_super_user()) {
        return true;
    }

    const access_type = root.access_type();
    if (access_type == .Read) {
        return true;
    }

    return switch (root.resource_type()) {
        .User => |u| switch (access_type) {
            .Modify => std.mem.eql(u8, u.id(), root.user().id()),
            .Read => unreachable,
            else => false,
        },
        .UserAttribute => false,
        .UserAttributeDefinition => false,
        else => false,
    };
}

test "フィールドが欠けている場合はアクセスを拒否する" {
    var builder = try flatbuffers.Builder.init(std.testing.allocator);
    defer builder.deinit();

    try builder.writeRoot(schema.AccessRequest, try builder.writeTable(schema.AccessRequest, .{
        .user = try builder.writeTable(schema.User, .{
            .id = "foo-bar",
        }),
    }));

    const buffer = try builder.writeAlloc(std.testing.allocator);
    defer std.testing.allocator.free(buffer);

    try std.testing.expectEqual(false, try v1AllowResourceAccess(buffer));
}

test "管理者はユーザを追加できる" {
    var builder = try flatbuffers.Builder.init(std.testing.allocator);
    defer builder.deinit();

    try builder.writeRoot(schema.AccessRequest, try builder.writeTable(schema.AccessRequest, .{
        .user = try builder.writeTable(schema.User, .{
            .id = "foo-bar",
            .is_super_user = true,
        }),
        .access_type = .Create,
        .resource_type = .{
            .User = try builder.writeTable(schema.User, .{
                .id = "baz-qux",
                .is_super_user = true,
            }),
        },
    }));

    const buffer = try builder.writeAlloc(std.testing.allocator);
    defer std.testing.allocator.free(buffer);

    try std.testing.expectEqual(true, try v1AllowResourceAccess(buffer));
}

test "非管理者は自身の基本情報を変更できる" {
    var builder = try flatbuffers.Builder.init(std.testing.allocator);
    defer builder.deinit();

    try builder.writeRoot(schema.AccessRequest, try builder.writeTable(schema.AccessRequest, .{
        .user = try builder.writeTable(schema.User, .{
            .id = "foo-bar",
        }),
        .access_type = .Modify,
        .resource_type = .{
            .User = try builder.writeTable(schema.User, .{
                .id = "foo-bar",
            }),
        },
    }));

    const buffer = try builder.writeAlloc(std.testing.allocator);
    defer std.testing.allocator.free(buffer);

    try std.testing.expectEqual(true, try v1AllowResourceAccess(buffer));
}

test "非管理者は他人の基本情報を変更できない" {
    var builder = try flatbuffers.Builder.init(std.testing.allocator);
    defer builder.deinit();

    try builder.writeRoot(schema.AccessRequest, try builder.writeTable(schema.AccessRequest, .{
        .user = try builder.writeTable(schema.User, .{
            .id = "foo-bar",
        }),
        .access_type = .Modify,
        .resource_type = .{
            .User = try builder.writeTable(schema.User, .{
                .id = "baz-qux",
            }),
        },
    }));

    const buffer = try builder.writeAlloc(std.testing.allocator);
    defer std.testing.allocator.free(buffer);

    try std.testing.expectEqual(false, try v1AllowResourceAccess(buffer));
}