bridge.go

// Copyright 2025 Democratized Data Foundation
//
// Use of this software is governed by the Business Source License
// included in the file licenses/BSL.txt.
//
// As of the Change Date specified in that file, in accordance with
// the Business Source License, use of this software will be governed
// by the Apache License, Version 2.0, included in the file
// licenses/APL.txt.

package dac

import (
	"context"

	protoTypes "github.com/cosmos/gogoproto/types"

	"github.com/sourcenetwork/corelog"

	"github.com/sourcenetwork/defradb/acp"
	"github.com/sourcenetwork/defradb/acp/identity"
	acpTypes "github.com/sourcenetwork/defradb/acp/types"
)

var _ acp.ACPSystemClient = (*RemoteDocumentACP)(nil)

var _ DocumentACP = (*bridgeDocumentACP)(nil)

// bridgeDocumentACP wraps an [ACPSystemClient], hosting the DefraDB specific logic away
// from ACP client specific code.
type bridgeDocumentACP struct {
	clientACP acp.ACPSystemClient
	// documentACPType must only be set to [acpTypes.LocalDocumentACP] or
	// [acpTypes.RemoteDocumentACP]. [acpTypes.NodeACP] and future NAC types are invalid.
	documentACPType acpTypes.ACPSystemType
}

func (a *bridgeDocumentACP) Start(ctx context.Context) error {
	return a.clientACP.Start(ctx)
}

func (a *bridgeDocumentACP) AddPolicy(ctx context.Context, creator identity.Identity, policy string) (string, error) {
	// Having a creator identity is a MUST requirement for adding a policy.
	if creator == nil || creator.DID() == "" {
		return "", acp.ErrPolicyCreatorMustNotBeEmpty
	}

	if policy == "" {
		return "", acp.ErrPolicyDataMustNotBeEmpty
	}

	marshalType := acpTypes.PolicyMarshalType_YAML

	policyID, err := a.clientACP.AddPolicy(
		ctx,
		creator,
		policy,
		marshalType,
		protoTypes.TimestampNow(),
	)

	if err != nil {
		return "", acp.NewErrFailedToAddPolicy(err, a.documentACPType.String(), creator.DID())
	}

	log.InfoContext(ctx, "Created Policy", corelog.Any("PolicyID", policyID))
	return policyID, nil
}

func (a *bridgeDocumentACP) ValidateResourceInterface(
	ctx context.Context,
	policyID string,
	resourceName string,
) error {
	if a.documentACPType != acpTypes.LocalDocumentACP &&
		a.documentACPType != acpTypes.RemoteDocumentACP {
		return acp.ErrInvalidACPSystem
	}

	return acp.ValidateResourceInterface(
		ctx,
		policyID,
		resourceName,
		a.documentACPType,
		a.clientACP,
	)
}

func (a *bridgeDocumentACP) RegisterDocObject(
	ctx context.Context,
	identity identity.Identity,
	policyID string,
	resourceName string,
	docID string,
) error {
	err := a.clientACP.RegisterObject(
		ctx,
		identity,
		policyID,
		resourceName,
		docID,
		protoTypes.TimestampNow(),
	)

	if err != nil {
		// RegisterObject is effectively idempotent if the object already has the requested owner.
		// This lets the same collection be registered on multiple nodes that share an acp instance.
		owner, ownerErr := a.clientACP.ObjectOwner(ctx, policyID, resourceName, docID)
		if ownerErr == nil && owner.HasValue() && owner.Value() == identity.DID() {
			return nil
		}
		return acp.NewErrFailedToRegisterDoc(
			err,
			a.documentACPType.String(),
			policyID,
			identity.DID(),
			resourceName,
			docID,
		)
	}

	return nil
}

func (a *bridgeDocumentACP) IsDocRegistered(
	ctx context.Context,
	policyID string,
	resourceName string,
	docID string,
) (bool, error) {
	maybeActor, err := a.clientACP.ObjectOwner(
		ctx,
		policyID,
		resourceName,
		docID,
	)
	if err != nil {
		return false, acp.NewErrFailedToCheckIfDocIsRegistered(
			err,
			a.documentACPType.String(),
			policyID,
			resourceName,
			docID,
		)
	}

	return maybeActor.HasValue(), nil
}

func (a *bridgeDocumentACP) CheckDocAccess(
	ctx context.Context,
	permission acpTypes.DocumentResourcePermission,
	actorID string,
	policyID string,
	resourceName string,
	docID string,
) (bool, error) {
	// We grant "read" access even if the identity does not explicitly have the "read" permission,
	// as long as they have any of the permissions that imply read access.
	if permission == acpTypes.DocumentReadPerm {
		var canRead bool = false
		var err error

		for _, permissionThatImpliesRead := range acpTypes.ImplyDocumentReadPerm {
			canRead, err = a.clientACP.VerifyAccessRequest(
				ctx,
				permissionThatImpliesRead,
				actorID,
				policyID,
				resourceName,
				docID,
			)

			if err != nil {
				return false, acp.NewErrFailedToVerifyDocAccess(
					err,
					a.documentACPType.String(),
					permissionThatImpliesRead.String(),
					policyID,
					actorID,
					resourceName,
					docID,
				)
			}

			if canRead {
				break
			}
		}

		return canRead, nil
	}

	hasAccess, err := a.clientACP.VerifyAccessRequest(
		ctx,
		permission,
		actorID,
		policyID,
		resourceName,
		docID,
	)

	if err != nil {
		return false, acp.NewErrFailedToVerifyDocAccess(
			err,
			a.documentACPType.String(),
			permission.String(),
			policyID,
			actorID,
			resourceName,
			docID,
		)
	}

	return hasAccess, nil
}

func (a *bridgeDocumentACP) AddDocActorRelationship(
	ctx context.Context,
	policyID string,
	resourceName string,
	docID string,
	relation string,
	requestActor identity.Identity,
	targetActor string,
) (bool, error) {
	if policyID == "" ||
		resourceName == "" ||
		docID == "" ||
		relation == "" ||
		requestActor == nil ||
		targetActor == "" {
		var requestActorDID string
		if requestActor != nil {
			requestActorDID = requestActor.DID()
		}
		return false, acp.NewErrMissingRequiredArgToAddDocActorRelationship(
			policyID,
			resourceName,
			docID,
			relation,
			requestActorDID,
			targetActor,
		)
	}

	exists, err := a.clientACP.AddActorRelationship(
		ctx,
		policyID,
		resourceName,
		docID,
		relation,
		requestActor,
		targetActor,
		protoTypes.TimestampNow(),
	)

	if err != nil {
		return false, acp.NewErrFailedToAddDocActorRelationship(
			err,
			a.documentACPType.String(),
			policyID,
			resourceName,
			docID,
			relation,
			requestActor.DID(),
			targetActor,
		)
	}

	log.InfoContext(
		ctx,
		"Document and actor relationship set",
		corelog.Any("PolicyID", policyID),
		corelog.Any("ResourceName", resourceName),
		corelog.Any("DocID", docID),
		corelog.Any("Relation", relation),
		corelog.Any("RequestActor", requestActor.DID()),
		corelog.Any("TargetActor", targetActor),
		corelog.Any("Existed", exists),
	)

	return exists, nil
}

func (a *bridgeDocumentACP) DeleteDocActorRelationship(
	ctx context.Context,
	policyID string,
	resourceName string,
	docID string,
	relation string,
	requestActor identity.Identity,
	targetActor string,
) (bool, error) {
	if policyID == "" ||
		resourceName == "" ||
		docID == "" ||
		relation == "" ||
		requestActor == nil ||
		targetActor == "" {
		var requestActorDID string
		if requestActor != nil {
			requestActorDID = requestActor.DID()
		}
		return false, acp.NewErrMissingRequiredArgToDeleteDocActorRelationship(
			policyID,
			resourceName,
			docID,
			relation,
			requestActorDID,
			targetActor,
		)
	}

	recordFound, err := a.clientACP.DeleteActorRelationship(
		ctx,
		policyID,
		resourceName,
		docID,
		relation,
		requestActor,
		targetActor,
		protoTypes.TimestampNow(),
	)

	if err != nil {
		return false, acp.NewErrFailedToDeleteDocActorRelationship(
			err,
			a.documentACPType.String(),
			policyID,
			resourceName,
			docID,
			relation,
			requestActor.DID(),
			targetActor,
		)
	}

	log.InfoContext(
		ctx,
		"Document and actor relationship delete",
		corelog.Any("PolicyID", policyID),
		corelog.Any("ResourceName", resourceName),
		corelog.Any("DocID", docID),
		corelog.Any("Relation", relation),
		corelog.Any("RequestActor", requestActor.DID()),
		corelog.Any("TargetActor", targetActor),
		corelog.Any("RecordFound", recordFound),
	)

	return recordFound, nil
}

func (a *bridgeDocumentACP) Close() error {
	return a.clientACP.Close()
}

func (a *bridgeDocumentACP) ResetState(ctx context.Context) error {
	return a.clientACP.ResetState(ctx)
}