Permissions

// Permission system implementation
class PermissionManager {
  constructor() {
    // Permission format: "action:resource:condition"
    this.permissions = new Map()
  }

  // Check if user has permission
  hasPermission(user, requiredPermission) {
    const userPermissions = this.getUserPermissions(user)

    // Direct match
    if (userPermissions.has(requiredPermission)) {
      return true
    }

    // Wildcard match
    const [action, resource, condition] = requiredPermission.split(':')

    // Check wildcards: admin:*, *:documents, read:*
    if (
      userPermissions.has('*:*') ||
      userPermissions.has(`${action}:*`) ||
      userPermissions.has(`*:${resource}`)
    ) {
      return true
    }

    return false
  }

  getUserPermissions(user) {
    const permissions = new Set()

    // Add direct user permissions
    if (user.permissions) {
      user.permissions.forEach(p => permissions.add(p))
    }

    // Add role-based permissions
    if (user.roles) {
      user.roles.forEach(role => {
        const rolePerms = this.getRolePermissions(role)
        rolePerms.forEach(p => permissions.add(p))
      })
    }

    return permissions
  }

  getRolePermissions(role) {
    const rolePermissionMap = {
      'admin': ['*:*'],
      'editor': [
        'read:documents',
        'write:documents',
        'read:comments',
        'write:comments'
      ],
      'viewer': [
        'read:documents',
        'read:comments'
      ],
      'moderator': [
        'read:*',
        'delete:comments',
        'update:comments'
      ]
    }

    return rolePermissionMap[role] || []
  }

  // Check resource-specific permission with ownership
  hasResourcePermission(user, action, resource) {
    const permission = `${action}:${resource.type}`

    // Check basic permission
    if (!this.hasPermission(user, permission)) {
      // Check if has "own" variant
      const ownPermission = `${action}:own-${resource.type}`
      if (this.hasPermission(user, ownPermission)) {
        // Verify ownership
        return resource.ownerId === user.id
      }
      return false
    }

    return true
  }
}

// Permission-based middleware
const permissionManager = new PermissionManager()

function requirePermission(permission) {
  return (req, res, next) => {
    if (!req.user) {
      return res.status(401).json({ error: 'Unauthorized' })
    }

    if (!permissionManager.hasPermission(req.user, permission)) {
      return res.status(403).json({
        error: 'Forbidden',
        message: `Missing required permission: ${permission}`
      })
    }

    next()
  }
}

// Usage in routes
app.get('/api/documents',
  requirePermission('read:documents'),
  async (req, res) => {
    const documents = await db.documents.findAll()
    res.json(documents)
  }
)

app.delete('/api/documents/:id',
  async (req, res) => {
    const document = await db.documents.findById(req.params.id)

    if (!document) {
      return res.status(404).json({ error: 'Not found' })
    }

    // Check resource-specific permission
    if (!permissionManager.hasResourcePermission(
      req.user,
      'delete',
      document
    )) {
      return res.status(403).json({
        error: 'Forbidden',
        message: 'Cannot delete this document'
      })
    }

    await db.documents.delete(req.params.id)
    res.status(204).send()
  }
)

// Permission hierarchy
class PermissionHierarchy {
  constructor() {
    this.hierarchy = {
      'admin': ['editor', 'moderator', 'viewer'],
      'editor': ['viewer'],
      'moderator': ['viewer']
    }
  }

  // Check if role A implies role B
  implies(roleA, roleB) {
    if (roleA === roleB) return true

    const implied = this.hierarchy[roleA] || []
    if (implied.includes(roleB)) return true

    // Recursive check
    return implied.some(role => this.implies(role, roleB))
  }

  hasPermissionViaHierarchy(user, requiredPermission) {
    const permManager = new PermissionManager()

    // Check direct permissions
    if (permManager.hasPermission(user, requiredPermission)) {
      return true
    }

    // Check via role hierarchy
    for (const userRole of user.roles || []) {
      for (const [role, perms] of Object.entries(permManager.rolePermissionMap)) {
        if (this.implies(userRole, role)) {
          if (perms.includes(requiredPermission)) {
            return true
          }
        }
      }
    }

    return false
  }
}

// Conditional permissions
class ConditionalPermission {
  constructor(permission, condition) {
    this.permission = permission
    this.condition = condition
  }

  evaluate(user, resource, context) {
    return this.condition(user, resource, context)
  }
}

const conditionalPerms = [
  new ConditionalPermission(
    'delete:documents',
    (user, doc, ctx) => {
      // Can delete if owner OR admin OR created less than 1 hour ago
      return (
        doc.ownerId === user.id ||
        user.roles.includes('admin') ||
        (Date.now() - doc.createdAt) < 3600000
      )
    }
  )
]