333 lines
11 KiB
Go
333 lines
11 KiB
Go
|
package billing
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"encoding/json"
|
||
|
|
"errors"
|
||
|
|
"fmt"
|
||
|
|
"sort"
|
||
|
|
"strings"
|
||
|
|
|
||
|
|
"github.com/google/uuid"
|
||
|
|
"github.com/jackc/pgx/v5"
|
||
|
|
)
|
||
|
|
|
||
|
|
// ErrFeatureNotGrantable is returned when a permission update names a key the company
|
||
|
|
// owner is not allowed to toggle (shell chrome, plan-metering capabilities, always-on keys).
|
||
|
|
var ErrFeatureNotGrantable = errors.New("feature not grantable")
|
||
|
|
|
||
|
|
// alwaysGrantedPrefixes are never restrictable: the app shell must keep working for
|
||
|
|
// every member, and capability.* keys meter the plan (credits, SKU caps) rather than
|
||
|
|
// describe UI access — restricting them per member would silently break billing math.
|
||
|
|
var alwaysGrantedPrefixes = []string{"shell.", "capability."}
|
||
|
|
|
||
|
|
// alwaysGrantedKeys keep a restricted member out of a dead end: they can always reach
|
||
|
|
// the dashboard landing page and their own profile (to change password / sign out).
|
||
|
|
var alwaysGrantedKeys = map[string]bool{
|
||
|
|
"dashboard.overview": true,
|
||
|
|
"settings.profile": true,
|
||
|
|
}
|
||
|
|
|
||
|
|
// IsGrantableFeatureKey reports whether a company owner may toggle key per member.
|
||
|
|
func IsGrantableFeatureKey(key string) bool {
|
||
|
|
key = strings.TrimSpace(key)
|
||
|
|
if !IsKnownFeatureKey(key) {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
if alwaysGrantedKeys[key] {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
for _, prefix := range alwaysGrantedPrefixes {
|
||
|
|
if strings.HasPrefix(key, prefix) {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
|
||
|
|
// GrantableFeatureKeys returns the catalog subset an owner may restrict, in catalog order.
|
||
|
|
func GrantableFeatureKeys() []string {
|
||
|
|
out := make([]string, 0, len(FeatureCatalogKeys))
|
||
|
|
for _, key := range FeatureCatalogKeys {
|
||
|
|
if IsGrantableFeatureKey(key) {
|
||
|
|
out = append(out, key)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return out
|
||
|
|
}
|
||
|
|
|
||
|
|
// MemberPermissionEntry is one grantable key for the owner-facing permission editor.
|
||
|
|
type MemberPermissionEntry struct {
|
||
|
|
Key string `json:"key"`
|
||
|
|
Section string `json:"section"`
|
||
|
|
// Parent is the nearest grantable ancestor key ("catalog.products" for
|
||
|
|
// "catalog.products.tab_error"), so the editor can nest children under it.
|
||
|
|
Parent string `json:"parent,omitempty"`
|
||
|
|
// PlanAllowed is false when the company's plan already denies the key — the
|
||
|
|
// editor shows it greyed out rather than pretending the owner can grant it.
|
||
|
|
PlanAllowed bool `json:"plan_allowed"`
|
||
|
|
}
|
||
|
|
|
||
|
|
// MemberPermissionCatalog is the payload for GET /api/team/permission-catalog.
|
||
|
|
type MemberPermissionCatalog struct {
|
||
|
|
Sections []MemberPermissionSection `json:"sections"`
|
||
|
|
}
|
||
|
|
|
||
|
|
// MemberPermissionSection groups grantable keys under one dashboard area.
|
||
|
|
type MemberPermissionSection struct {
|
||
|
|
ID string `json:"id"`
|
||
|
|
Entries []MemberPermissionEntry `json:"entries"`
|
||
|
|
}
|
||
|
|
|
||
|
|
// grantableParent returns the nearest ancestor key that is itself grantable.
|
||
|
|
func grantableParent(key string) string {
|
||
|
|
parts := strings.Split(key, ".")
|
||
|
|
for i := len(parts) - 1; i > 0; i-- {
|
||
|
|
candidate := strings.Join(parts[:i], ".")
|
||
|
|
if IsGrantableFeatureKey(candidate) {
|
||
|
|
return candidate
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
|
||
|
|
// PermissionCatalogForCompany lists the grantable keys grouped by section, annotated
|
||
|
|
// with what the company's own plan already allows.
|
||
|
|
func (s *Service) PermissionCatalogForCompany(ctx context.Context, companyID uuid.UUID) (MemberPermissionCatalog, error) {
|
||
|
|
caps, err := s.CapabilitiesForCompany(ctx, companyID)
|
||
|
|
if err != nil {
|
||
|
|
return MemberPermissionCatalog{}, err
|
||
|
|
}
|
||
|
|
bySection := map[string][]MemberPermissionEntry{}
|
||
|
|
order := make([]string, 0, len(FeatureSections))
|
||
|
|
for _, key := range GrantableFeatureKeys() {
|
||
|
|
section, _ := SectionOfFeature(key)
|
||
|
|
if section == "" {
|
||
|
|
section = "other"
|
||
|
|
}
|
||
|
|
if _, seen := bySection[section]; !seen {
|
||
|
|
order = append(order, section)
|
||
|
|
}
|
||
|
|
bySection[section] = append(bySection[section], MemberPermissionEntry{
|
||
|
|
Key: key,
|
||
|
|
Section: section,
|
||
|
|
Parent: grantableParent(key),
|
||
|
|
PlanAllowed: caps.Features != nil && caps.Features[key],
|
||
|
|
})
|
||
|
|
}
|
||
|
|
out := MemberPermissionCatalog{Sections: make([]MemberPermissionSection, 0, len(order))}
|
||
|
|
for _, section := range order {
|
||
|
|
out.Sections = append(out.Sections, MemberPermissionSection{ID: section, Entries: bySection[section]})
|
||
|
|
}
|
||
|
|
return out, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
// SanitizeMemberPermissions normalizes an incoming overlay to its canonical form:
|
||
|
|
// only grantable keys survive, and only denials (false) are stored — an "allowed"
|
||
|
|
// entry is the absence of a key. Returns ErrFeatureNotGrantable on an unknown or
|
||
|
|
// protected key so a typo fails loudly instead of silently granting access.
|
||
|
|
func SanitizeMemberPermissions(in map[string]bool) (map[string]bool, error) {
|
||
|
|
out := map[string]bool{}
|
||
|
|
for rawKey, allowed := range in {
|
||
|
|
key := strings.TrimSpace(rawKey)
|
||
|
|
if key == "" {
|
||
|
|
continue
|
||
|
|
}
|
||
|
|
if allowed {
|
||
|
|
// Allow is the default; storing it would only add drift.
|
||
|
|
if !IsKnownFeatureKey(key) {
|
||
|
|
return nil, fmt.Errorf("%w: %s", ErrUnknownFeatureKey, key)
|
||
|
|
}
|
||
|
|
continue
|
||
|
|
}
|
||
|
|
if !IsGrantableFeatureKey(key) {
|
||
|
|
return nil, fmt.Errorf("%w: %s", ErrFeatureNotGrantable, key)
|
||
|
|
}
|
||
|
|
out[key] = false
|
||
|
|
}
|
||
|
|
return out, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
// MemberDeniesFeature reports whether the overlay denies key, honouring parent-prefix
|
||
|
|
// denial (denying "catalog.products" also denies "catalog.products.tab_error").
|
||
|
|
// Mirrors effectiveFeature() in apps/web/src/lib/plan-capabilities.ts.
|
||
|
|
func MemberDeniesFeature(perms map[string]bool, key string) bool {
|
||
|
|
if len(perms) == 0 {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
if alwaysGrantedKeys[key] {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
for _, prefix := range alwaysGrantedPrefixes {
|
||
|
|
if strings.HasPrefix(key, prefix) {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if denied, ok := perms[key]; ok && !denied {
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
parts := strings.Split(key, ".")
|
||
|
|
for i := 1; i < len(parts); i++ {
|
||
|
|
ancestor := strings.Join(parts[:i], ".")
|
||
|
|
if denied, ok := perms[ancestor]; ok && !denied {
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
|
||
|
|
// ApplyMemberPermissions intersects a company feature map with a member overlay.
|
||
|
|
// Returns a new map (the input is left untouched) plus the sorted list of keys the
|
||
|
|
// overlay turned off — the UI uses that to say "restricted by your administrator"
|
||
|
|
// instead of "upgrade your plan".
|
||
|
|
func ApplyMemberPermissions(features map[string]bool, perms map[string]bool) (map[string]bool, []string) {
|
||
|
|
if len(perms) == 0 {
|
||
|
|
return features, nil
|
||
|
|
}
|
||
|
|
out := make(map[string]bool, len(features))
|
||
|
|
denied := make([]string, 0, len(perms))
|
||
|
|
for key, allowed := range features {
|
||
|
|
if allowed && MemberDeniesFeature(perms, key) {
|
||
|
|
out[key] = false
|
||
|
|
denied = append(denied, key)
|
||
|
|
continue
|
||
|
|
}
|
||
|
|
out[key] = allowed
|
||
|
|
}
|
||
|
|
sort.Strings(denied)
|
||
|
|
return out, denied
|
||
|
|
}
|
||
|
|
|
||
|
|
// FeatureETag exposes the feature-map digest so callers outside the package (the /me
|
||
|
|
// handler) can re-stamp it after narrowing a map with ApplyMemberPermissions.
|
||
|
|
func FeatureETag(features map[string]bool) string { return featureETag(features) }
|
||
|
|
|
||
|
|
// MemberPermissions returns the stored overlay for one company member.
|
||
|
|
//
|
||
|
|
// The owner (companies.owner_user_id) is never restricted — they are the one who edits
|
||
|
|
// these — so an owner always resolves to a nil overlay regardless of what is stored.
|
||
|
|
// Reads memberships directly (rather than through the auth package) so capability
|
||
|
|
// resolution stays a single self-contained query on the hot /me + /capabilities path.
|
||
|
|
func (s *Service) MemberPermissions(ctx context.Context, companyID, userID uuid.UUID) (map[string]bool, error) {
|
||
|
|
if s == nil || s.Pool == nil || companyID == uuid.Nil || userID == uuid.Nil {
|
||
|
|
return nil, nil
|
||
|
|
}
|
||
|
|
var raw []byte
|
||
|
|
var isOwner bool
|
||
|
|
err := s.Pool.QueryRow(ctx, `
|
||
|
|
SELECT COALESCE(m.permissions, '{}'::jsonb),
|
||
|
|
(c.owner_user_id IS NOT NULL AND c.owner_user_id = m.user_id) AS is_owner
|
||
|
|
FROM memberships m
|
||
|
|
JOIN companies c ON c.id = m.company_id
|
||
|
|
WHERE m.company_id = $1 AND m.user_id = $2`, companyID, userID).Scan(&raw, &isOwner)
|
||
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
||
|
|
// Platform staff acting on a tenant have no membership row — unrestricted.
|
||
|
|
return nil, nil
|
||
|
|
}
|
||
|
|
if err != nil {
|
||
|
|
// Pre-migration (no permissions / owner_user_id column): treat as unrestricted
|
||
|
|
// rather than locking every member out of the dashboard.
|
||
|
|
if isUndefinedColumn(err) {
|
||
|
|
return nil, nil
|
||
|
|
}
|
||
|
|
return nil, err
|
||
|
|
}
|
||
|
|
if isOwner {
|
||
|
|
return nil, nil
|
||
|
|
}
|
||
|
|
return decodeMemberPermissions(raw)
|
||
|
|
}
|
||
|
|
|
||
|
|
func decodeMemberPermissions(raw []byte) (map[string]bool, error) {
|
||
|
|
if len(raw) == 0 {
|
||
|
|
return nil, nil
|
||
|
|
}
|
||
|
|
var parsed map[string]bool
|
||
|
|
if err := json.Unmarshal(raw, &parsed); err != nil {
|
||
|
|
// A hand-edited / legacy blob must not brick the dashboard.
|
||
|
|
return nil, nil
|
||
|
|
}
|
||
|
|
out := map[string]bool{}
|
||
|
|
for key, allowed := range parsed {
|
||
|
|
if !allowed && IsGrantableFeatureKey(key) {
|
||
|
|
out[key] = false
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if len(out) == 0 {
|
||
|
|
return nil, nil
|
||
|
|
}
|
||
|
|
return out, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
// CapabilitiesForMember returns the company capabilities narrowed by the caller's
|
||
|
|
// per-member overlay. This is what the dashboard shell (nav, route guard, feature
|
||
|
|
// gates) reads, so restricting a member here hides the surface everywhere at once.
|
||
|
|
func (s *Service) CapabilitiesForMember(ctx context.Context, companyID, userID uuid.UUID) (Capabilities, error) {
|
||
|
|
caps, err := s.CapabilitiesForCompany(ctx, companyID)
|
||
|
|
if err != nil {
|
||
|
|
return caps, err
|
||
|
|
}
|
||
|
|
perms, err := s.MemberPermissions(ctx, companyID, userID)
|
||
|
|
if err != nil {
|
||
|
|
return caps, err
|
||
|
|
}
|
||
|
|
if len(perms) == 0 {
|
||
|
|
return caps, nil
|
||
|
|
}
|
||
|
|
features, denied := ApplyMemberPermissions(caps.Features, perms)
|
||
|
|
caps.Features = features
|
||
|
|
caps.MemberRestricted = true
|
||
|
|
caps.MemberDeniedFeatures = denied
|
||
|
|
caps.DisabledFeatures = mergeDisabledFeatures(caps.DisabledFeatures, denied)
|
||
|
|
// Re-stamp the ETag: two members of one company now have different maps, and a
|
||
|
|
// shared ETag would let one member's cached response satisfy another's request.
|
||
|
|
caps.FeatureETag = featureETag(features)
|
||
|
|
return caps, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
func mergeDisabledFeatures(existing, extra []string) []string {
|
||
|
|
seen := make(map[string]bool, len(existing)+len(extra))
|
||
|
|
out := make([]string, 0, len(existing)+len(extra))
|
||
|
|
for _, list := range [][]string{existing, extra} {
|
||
|
|
for _, key := range list {
|
||
|
|
if seen[key] {
|
||
|
|
continue
|
||
|
|
}
|
||
|
|
seen[key] = true
|
||
|
|
out = append(out, key)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
sort.Strings(out)
|
||
|
|
return out
|
||
|
|
}
|
||
|
|
|
||
|
|
// AssertFeaturesForMember fails closed on the first key denied by the plan, the global
|
||
|
|
// gates, or the member's own overlay.
|
||
|
|
func (s *Service) AssertFeaturesForMember(ctx context.Context, companyID, userID uuid.UUID, keys ...string) error {
|
||
|
|
if len(keys) == 0 {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
if err := s.AssertFeatures(ctx, companyID, keys...); err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
perms, err := s.MemberPermissions(ctx, companyID, userID)
|
||
|
|
if err != nil {
|
||
|
|
return err
|
||
|
|
}
|
||
|
|
for _, key := range keys {
|
||
|
|
key = strings.TrimSpace(key)
|
||
|
|
if key == "" {
|
||
|
|
continue
|
||
|
|
}
|
||
|
|
if MemberDeniesFeature(perms, key) {
|
||
|
|
return fmt.Errorf("%w: %s", ErrMemberFeatureDenied, key)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
|
||
|
|
// ErrMemberFeatureDenied separates "your administrator turned this off" from
|
||
|
|
// ErrFeatureDisabled ("your plan does not include this") so the UI can offer the right
|
||
|
|
// next step — ask an admin vs. upgrade.
|
||
|
|
var ErrMemberFeatureDenied = errors.New("member_feature_denied")
|