33306/backend/src/middlewares/check-permissions.js

const ValidationError = require('../services/notifications/errors/validation');
const RolesDBApi = require('../db/api/roles');

// Cache for the 'Public' role object
let publicRoleCache = null;

// Function to asynchronously fetch and cache the 'Public' role
async function fetchAndCachePublicRole() {
  try {
    // Use RolesDBApi to find the role by name 'Public'
    publicRoleCache = await RolesDBApi.findBy({ name: 'Public' });

    if (!publicRoleCache) {
      console.error(
        "WARNING: Role 'Public' not found in database during middleware startup. Check your migrations.",
      );
      // The system might not function correctly without this role. May need to throw an error or use a fallback stub.
    } else {
      console.log("'Public' role successfully loaded and cached.");
    }
  } catch (error) {
    console.error(
      "Error fetching 'Public' role during middleware startup:",
      error,
    );
    // Handle the error during startup fetch
    throw error; // Important to know if the app can proceed without the Public role
  }
}

// Trigger the role fetching when the check-permissions.js module is imported/loaded
// This should happen during application startup when routes are being configured.
fetchAndCachePublicRole().catch((error) => {
  // Handle the case where the fetchAndCachePublicRole promise is rejected
  console.error(
    'Critical error during permissions middleware initialization:',
    error,
  );
  // Decide here if the process should exit if the Public role is essential.
  // process.exit(1);
});

/**
 * Middleware creator to check if the current user (or Public role) has a specific permission.
 * @param {string} permission - The name of the required permission.
 * @return {import("express").RequestHandler} Express middleware function.
 */
function checkPermissions(permission) {
  return async (req, res, next) => {
    const { currentUser } = req;

    // 1. Check self-access bypass (only if the user is authenticated)
    if (
      currentUser &&
      (currentUser.id === req.params.id || currentUser.id === req.body.id)
    ) {
      return next(); // User has access to their own resource
    }

    // 2. Check Custom Permissions (only if the user is authenticated)
    if (currentUser) {
      // Ensure custom_permissions is an array before using find
      const customPermissions = Array.isArray(currentUser.custom_permissions)
        ? currentUser.custom_permissions
        : [];
      const userPermission = customPermissions.find(
        (cp) => cp.name === permission,
      );
      if (userPermission) {
        return next(); // User has a custom permission
      }
    }

    // 3. Determine the "effective" role for permission check
    let effectiveRole = null;
    try {
      if (currentUser && currentUser.app_role) {
        // User is authenticated and has an assigned role
        effectiveRole = currentUser.app_role;
      } else {
        // User is NOT authenticated OR is authenticated but has no role
        // Use the cached 'Public' role
        if (!publicRoleCache) {
          // If the cache is unexpectedly empty (e.g., startup error caught),
          // we can try fetching the role again synchronously (less ideal) or just deny access.
          console.error(
            'Public role cache is empty. Attempting synchronous fetch...',
          );
          // Less efficient fallback option:
          effectiveRole = await RolesDBApi.findBy({ name: 'Public' }); // Could be slow
          if (!effectiveRole) {
            // If even the synchronous attempt failed
            return next(
              new Error(
                'Internal Server Error: Public role missing and cannot be fetched.',
              ),
            );
          }
        } else {
          effectiveRole = publicRoleCache; // Use the cached object
        }
      }

      // Check if we got a valid role object
      if (!effectiveRole) {
        return next(
          new Error(
            'Internal Server Error: Could not determine effective role.',
          ),
        );
      }

      // 4. Check Permissions on the "effective" role
      // Assume the effectiveRole object (from app_role or RolesDBApi) has a getPermissions() method
      // or a 'permissions' property (if permissions are eagerly loaded).
      let rolePermissions = [];
      if (typeof effectiveRole.getPermissions === 'function') {
        rolePermissions = await effectiveRole.getPermissions(); // Get permissions asynchronously if the method exists
      } else if (Array.isArray(effectiveRole.permissions)) {
        rolePermissions = effectiveRole.permissions; // Or take from property if permissions are pre-loaded
      } else {
        console.error(
          'Role object lacks getPermissions() method or permissions property:',
          effectiveRole,
        );
        return next(
          new Error('Internal Server Error: Invalid role object format.'),
        );
      }

      if (rolePermissions.find((p) => p.name === permission)) {
        next(); // The "effective" role has the required permission
      } else {
        // The "effective" role does not have the required permission
        const roleName = effectiveRole.name || 'unknown role';
        next(
          new ValidationError(
            'auth.forbidden',
            `Role '${roleName}' denied access to '${permission}'.`,
          ),
        );
      }
    } catch (e) {
      // Handle errors during role or permission fetching
      console.error('Error during permission check:', e);
      next(e); // Pass the error to the next middleware
    }
  };
}

const METHOD_MAP = {
  POST: 'CREATE',
  GET: 'READ',
  PUT: 'UPDATE',
  PATCH: 'UPDATE',
  DELETE: 'DELETE',
};

/**
 * Middleware creator to check standard CRUD permissions based on HTTP method and entity name.
 * @param {string} name - The name of the entity.
 * @return {import("express").RequestHandler} Express middleware function.
 */
function checkCrudPermissions(name) {
  return (req, res, next) => {
    // Dynamically determine the permission name (e.g., 'READ_USERS')
    const permissionName = `${METHOD_MAP[req.method]}_${name.toUpperCase()}`;
    // Call the checkPermissions middleware with the determined permission
    checkPermissions(permissionName)(req, res, next);
  };
}

module.exports = {
  checkPermissions,
  checkCrudPermissions,
};