helpers.go

package model

import (
	_ "embed"
	"encoding/json"
	"maps"
	"slices"
	"sort"
	"strings"
	"sync"

	openfga "github.com/openfga/go-sdk"
	language "github.com/openfga/language/pkg/go/transformer"
	"github.com/pkg/errors"
	"google.golang.org/protobuf/encoding/protojson"

	"github.com/theopenlane/core/fga/generate/modelparse"
)

const (
	// relationPartsCount is the expected number of parts when splitting a relation like "can_view_object"
	relationPartsCount = 3
	// scopePartsCount is the expected number of parts when splitting a scope like "control:write"
	scopePartsCount = 2
)

//go:embed generated/crud.fga
var embeddedCrudModel []byte

//go:embed roles/roles.fga
var embeddedRolesModel []byte

var (
	// CanView allows read-only access to an object
	CanView = "can_view"
	// CanEdit allows read and write access to an object
	CanEdit = "can_edit"
	// CanDelete allows deletion of an object
	CanDelete = "can_delete"
)

var (
	// Read is an alias for can_view
	Read = "read"
	// Write is an alias for can_edit
	Write = "write"
	// Delete is an alias for can_delete
	Delete = "delete"
)

var (
	aliasToRelation = map[string]string{
		"read":   CanView,
		"write":  CanEdit,
		"delete": CanDelete,
	}

	crudOnce  sync.Once
	crudModel *openfga.AuthorizationModel
	crudErr   error

	rolesOnce  sync.Once
	rolesModel *openfga.AuthorizationModel
	rolesErr   error

	organizationRolesOnce     sync.Once
	organizationRoles         []modelparse.OrganizationRole
	organizationRolesParseErr error
)

func parseAuthorizationModel(embeddedModel []byte) (*openfga.AuthorizationModel, error) {
	protoModel, err := language.TransformDSLToProto(string(embeddedModel))
	if err != nil {
		return nil, errors.Wrap(err, "parse fga model dsl")
	}
	rawJSON, err := protojson.Marshal(protoModel)
	if err != nil {
		return nil, errors.Wrap(err, "marshal fga model")
	}
	var model openfga.AuthorizationModel
	if err := json.Unmarshal(rawJSON, &model); err != nil {
		return nil, errors.Wrap(err, "decode fga model json")
	}
	return &model, nil
}

// GetCrudAuthorizationModel returns the parsed embedded authorization model
func GetCrudAuthorizationModel() (*openfga.AuthorizationModel, error) {
	crudOnce.Do(func() {
		crudModel, crudErr = parseAuthorizationModel(embeddedCrudModel)
	})
	return crudModel, crudErr
}

func GetRolesAuthorizationModel() (*openfga.AuthorizationModel, error) {
	rolesOnce.Do(func() {
		rolesModel, rolesErr = parseAuthorizationModel(embeddedRolesModel)
	})
	return rolesModel, rolesErr
}

// RelationsForService returns relations shaped like can_<verb>_<object> that directly accept service subjects.
func RelationsForService() ([]string, error) {
	model, err := GetCrudAuthorizationModel()
	if err != nil {
		return nil, err
	}

	var relations []string

	for _, td := range model.GetTypeDefinitions() {
		if td.Metadata == nil || td.Metadata.Relations == nil {
			continue
		}

		for rel := range *td.Metadata.Relations {
			parts := strings.SplitN(rel, "_", relationPartsCount)
			if len(parts) != relationPartsCount || parts[0] != "can" {
				continue
			}

			relations = append(relations, rel)
		}
	}

	sort.Strings(relations)

	return relations, nil
}

// getRelations is a helper that returns relations for a given verb (e.g., "manage" or "create") shaped like can_<verb>_<object>
func getRelations(relationType string, modelName string) ([]string, error) {
	var model *openfga.AuthorizationModel
	var err error

	switch modelName {
	case "crud":
		model, err = GetCrudAuthorizationModel()
	case "role":
		model, err = GetRolesAuthorizationModel()
	default:
		return nil, errors.Errorf("invalid model name: %s", modelName) //nolint:err113
	}

	if err != nil {
		return nil, err
	}

	var relations []string

	for _, td := range model.GetTypeDefinitions() {
		if td.Metadata == nil || td.Metadata.Relations == nil {
			continue
		}

		for rel := range *td.Metadata.Relations {
			parts := strings.SplitN(rel, "_", relationPartsCount)
			if len(parts) == relationPartsCount && parts[0] == "can" && parts[1] == relationType {
				relations = append(relations, rel)
			}
		}
	}

	sort.Strings(relations)

	return relations, nil
}

// roleRelations returns relations shaped like can_manage_<role> that indicates role management
func roleRelations() ([]string, error) {
	return getRelations("manage", "role")
}

// createRelations returns relations shaped like can_create_<object> that are used for group-based creation access
func createRelations() ([]string, error) {
	return getRelations("create", "crud")
}

// DefaultServiceScopeSet returns the default service scopes as a set
func DefaultServiceScopeSet() (map[string]struct{}, error) {
	scopes, err := RelationsForService()
	if err != nil {
		return nil, err
	}

	set := make(map[string]struct{}, len(scopes))
	for _, s := range scopes {
		set[s] = struct{}{}
	}

	return set, nil
}

// NormalizeScope returns the relation name for a provided scope, handling common aliases
// Accepts object:verb (e.g., control:write) and simple verbs (read/write/delete)
func NormalizeScope(scope string) string {
	raw := strings.TrimSpace(scope)
	if raw == "" {
		return ""
	}

	normalized := strings.ToLower(raw)

	mapVerb := func(verb string) string {
		if rel, ok := aliasToRelation[verb]; ok {
			return rel
		}

		return verb
	}

	if parts := strings.SplitN(normalized, ":", scopePartsCount); len(parts) == scopePartsCount && parts[1] != "" {
		return mapVerb(parts[1]) + "_" + parts[0]
	}

	if rel := mapVerb(normalized); rel != "" {
		return rel
	}

	return normalized
}

// ScopeAliases returns a copy of the supported alias mapping
func ScopeAliases() map[string]string {
	aliases := make(map[string]string, len(aliasToRelation))
	maps.Copy(aliases, aliasToRelation)

	return aliases
}

// ScopeOptions groups available scopes by object (verb mapped back via alias map)
func ScopeOptions() (map[string][]string, error) {
	rels, err := RelationsForService()
	if err != nil {
		return nil, err
	}

	relToVerb := map[string]string{}
	for verb, rel := range aliasToRelation {
		relToVerb[rel] = verb
	}

	opts := make(map[string][]string)

	for _, rel := range rels {
		parts := strings.SplitN(rel, "_", relationPartsCount)
		if len(parts) != relationPartsCount || parts[0] != "can" {
			continue
		}

		verb, ok := relToVerb[strings.Join(parts[0:2], "_")]
		if !ok {
			continue
		}

		obj := parts[2]
		if obj == "" {
			continue
		}

		opts[obj] = append(opts[obj], verb)
	}

	for obj := range opts {
		sort.Strings(opts[obj])
	}

	return opts, nil
}

func getRelationsOptionsForObject(rels []string) ([]string, error) {
	objs := make([]string, 0, len(rels))
	for _, rel := range rels {
		parts := strings.SplitN(rel, "_", relationPartsCount)

		obj := parts[2]
		if obj == "" {
			continue
		}

		objs = append(objs, obj)
	}

	sort.Strings(objs)

	return objs, nil
}

// CreateOptions returns objects with verbs that support creation
func CreateOptions() ([]string, error) {
	rels, err := createRelations()
	if err != nil {
		return nil, err
	}

	return getRelationsOptionsForObject(rels)
}

// RoleOptions returns objects with verbs that support roles
func RoleOptions() ([]string, error) {
	rels, err := roleRelations()
	if err != nil {
		return nil, err
	}

	if len(rels) == 0 {
		return nil, err
	}

	return getRelationsOptionsForObject(rels)
}

// OrganizationRoles returns the roles parsed from fga
func OrganizationRoles() ([]modelparse.OrganizationRole, error) {
	organizationRolesOnce.Do(func() {
		if _, err := GetRolesAuthorizationModel(); err != nil {
			organizationRolesParseErr = err
			return
		}

		roleInfo, err := modelparse.ParseRoleAnnotationsData(embeddedRolesModel)
		if err != nil {
			organizationRolesParseErr = err
			return
		}

		organizationRoles = roleInfo.OrganizationRoles
		sort.Slice(organizationRoles, func(i, j int) bool {
			return organizationRoles[i].ID < organizationRoles[j].ID
		})
	})

	if organizationRolesParseErr != nil {
		return nil, organizationRolesParseErr
	}

	roles := make([]modelparse.OrganizationRole, len(organizationRoles))
	copy(roles, organizationRoles)
	return roles, nil
}

// FilterOrganizationRoles ensures the assigned role is an organizational role and returns
// a filtered list of OrganizationRoles
func FilterOrganizationRoles(roles []modelparse.OrganizationRole, assigned []string) []modelparse.OrganizationRole {
	filtered := make([]modelparse.OrganizationRole, 0, len(assigned))
	for _, role := range roles {
		if slices.Contains(assigned, role.ID) {
			filtered = append(filtered, role)
		}
	}

	return filtered
}

// GetOrganizationRoleStrings takes assigned roles and filters non organization roles and returns a string list of role names
func GetOrganizationRoleStrings(roles []modelparse.OrganizationRole, assigned []string) []string {
	filtered := make([]string, 0, len(assigned))
	for _, role := range roles {
		if slices.Contains(assigned, role.ID) {
			filtered = append(filtered, role.Name)
		}
	}

	return filtered
}

func getRoleIDs() ([]string, error) {
	roles, err := OrganizationRoles()
	if err != nil {
		return nil, err
	}

	ids := make([]string, 0, len(roles))
	for _, role := range roles {
		ids = append(ids, role.ID)
	}

	return ids, nil
}

// IsOrganizationRole checks if a role is valid before it can be assigned or removed from a subject
func IsOrganizationRole(roleID string) (bool, error) {
	ids, err := getRoleIDs()
	if err != nil {
		return false, err
	}

	return slices.Contains(ids, roleID), nil
}