75 lines
2.5 KiB
Rust
75 lines
2.5 KiB
Rust
use crate::AppService;
|
|
use crate::error::AppError;
|
|
use models::WorkspaceRole;
|
|
use models::workspaces::workspace;
|
|
use models::workspaces::workspace_membership;
|
|
|
|
use sea_orm::*;
|
|
use session::Session;
|
|
use uuid::Uuid;
|
|
|
|
impl AppService {
|
|
pub async fn utils_find_workspace_by_slug(
|
|
&self,
|
|
slug: String,
|
|
) -> Result<workspace::Model, AppError> {
|
|
workspace::Entity::find()
|
|
.filter(workspace::Column::Slug.eq(slug))
|
|
.filter(workspace::Column::DeletedAt.is_null())
|
|
.one(&self.db)
|
|
.await?
|
|
.ok_or(AppError::WorkspaceNotFound)
|
|
}
|
|
|
|
pub async fn utils_find_workspace_by_id(&self, id: Uuid) -> Result<workspace::Model, AppError> {
|
|
workspace::Entity::find_by_id(id)
|
|
.filter(workspace::Column::DeletedAt.is_null())
|
|
.one(&self.db)
|
|
.await?
|
|
.ok_or(AppError::WorkspaceNotFound)
|
|
}
|
|
|
|
pub async fn utils_workspace_context_role(
|
|
&self,
|
|
ctx: &Session,
|
|
workspace_slug: String,
|
|
) -> Result<WorkspaceRole, AppError> {
|
|
let user_uid = ctx.user().ok_or(AppError::Unauthorized)?;
|
|
let ws = self.utils_find_workspace_by_slug(workspace_slug).await?;
|
|
let membership = workspace_membership::Entity::find()
|
|
.filter(workspace_membership::Column::WorkspaceId.eq(ws.id))
|
|
.filter(workspace_membership::Column::UserId.eq(user_uid))
|
|
.filter(workspace_membership::Column::Status.eq("active"))
|
|
.one(&self.db)
|
|
.await?;
|
|
match membership {
|
|
Some(m) => m.role.parse().map_err(|_| AppError::RoleParseError),
|
|
None => Err(AppError::NotWorkspaceMember),
|
|
}
|
|
}
|
|
|
|
pub async fn utils_check_workspace_permission(
|
|
&self,
|
|
workspace_id: Uuid,
|
|
user_id: Uuid,
|
|
required_roles: &[WorkspaceRole],
|
|
) -> Result<(), AppError> {
|
|
let membership = workspace_membership::Entity::find()
|
|
.filter(workspace_membership::Column::WorkspaceId.eq(workspace_id))
|
|
.filter(workspace_membership::Column::UserId.eq(user_id))
|
|
.filter(workspace_membership::Column::Status.eq("active"))
|
|
.one(&self.db)
|
|
.await?;
|
|
|
|
if let Some(member) = membership {
|
|
for role in required_roles {
|
|
if member.role.parse::<WorkspaceRole>() == Ok(role.clone()) {
|
|
return Ok(());
|
|
}
|
|
}
|
|
}
|
|
|
|
Err(AppError::PermissionDenied)
|
|
}
|
|
}
|