feat: team access control

server/app/keychains/repository.go

@@ -20,10 +20,16 @@ func NewRepository(r *Keychains) *Keychains {
 	return r
 }
 
-func (r *Keychains) GetAll() ([]*models.Keychain, error) {
-	var rows []*models.Keychain
-	query := r.ACL(r.db.Order("created_at DESC"))
+func (r *Keychains) GetAll(opt GetAllOpt) ([]*models.Keychain, error) {
+	query := r.db.Order("created_at DESC")
 
+	if opt.TeamID != "" {
+		query = query.Where("keychains.team_id = ?", opt.TeamID)
+	} else {
+		query = query.Where("keychains.owner_id = ? AND keychains.team_id IS NULL", r.User.ID)
+	}
+
+	var rows []*models.Keychain
 	ret := query.Find(&rows)
 	return rows, ret.Error
 }
@@ -34,9 +40,7 @@ func (r *Keychains) Create(item *models.Keychain) error {
 
 func (r *Keychains) Get(id string) (*models.Keychain, error) {
 	var keychain models.Keychain
-	query := r.ACL(r.db.Where("id = ?", id))
-
-	if err := query.First(&keychain).Error; err != nil {
+	if err := r.db.Where("id = ?", id).First(&keychain).Error; err != nil {
 		return nil, err
 	}
 
@@ -45,8 +49,7 @@ func (r *Keychains) Get(id string) (*models.Keychain, error) {
 
 func (r *Keychains) Exists(id string) (bool, error) {
 	var count int64
-	query := r.ACL(r.db.Model(&models.Keychain{}).Where("id = ?", id))
-	ret := query.Count(&count)
+	ret := r.db.Model(&models.Keychain{}).Where("id = ?", id).Count(&count)
 	return count > 0, ret.Error
 }
 
@@ -70,14 +73,5 @@ func (r *Keychains) GetDecrypted(id string) (*KeychainDecrypted, error) {
 }
 
 func (r *Keychains) Update(id string, item *models.Keychain) error {
-	query := r.ACL(r.db.Where("id = ?", id))
-	return query.Updates(item).Error
-}
-
-func (r *Keychains) ACL(query *gorm.DB) *gorm.DB {
-	if r.User.IsAdmin {
-		return query
-	}
-
-	return query.Where("keychains.owner_id = ?", r.User.ID)
+	return r.db.Where("id = ?", id).Updates(item).Error
 }

server/app/keychains/router.go

@@ -1,7 +1,7 @@
 package keychains
 
 import (
-	"fmt"
+	"errors"
 	"net/http"
 
 	"github.com/gofiber/fiber/v2"
@@ -23,17 +23,22 @@ type GetAllResult struct {
 }
 
 func getAll(c *fiber.Ctx) error {
+	teamId := c.Query("teamId")
 	withData := c.Query("withData")
 
 	user := utils.GetUser(c)
 	repo := NewRepository(&Keychains{User: user})
 
-	rows, err := repo.GetAll()
+	if teamId != "" && !user.IsInTeam(&teamId) {
+		return utils.ResponseError(c, errors.New("no access"), 403)
+	}
+
+	rows, err := repo.GetAll(GetAllOpt{TeamID: teamId})
 	if err != nil {
 		return utils.ResponseError(c, err, 500)
 	}
 
-	if withData != "true" {
+	if withData != "true" || (teamId != "" && !user.TeamCanWrite(&teamId)) {
 		return c.JSON(fiber.Map{"rows": rows})
 	}
 
@@ -67,8 +72,13 @@ func create(c *fiber.Ctx) error {
 	user := utils.GetUser(c)
 	repo := NewRepository(&Keychains{User: user})
 
+	if body.TeamID != nil && !user.TeamCanWrite(body.TeamID) {
+		return utils.ResponseError(c, errors.New("no access"), 403)
+	}
+
 	item := &models.Keychain{
-		OwnerID: user.ID,
+		OwnerID: &user.ID,
+		TeamID:  body.TeamID,
 		Type:    body.Type,
 		Label:   body.Label,
 	}
@@ -94,15 +104,18 @@ func update(c *fiber.Ctx) error {
 	repo := NewRepository(&Keychains{User: user})
 
 	id := c.Params("id")
-
-	exist, _ := repo.Exists(id)
-	if !exist {
-		return utils.ResponseError(c, fmt.Errorf("key %s not found", id), 404)
+	data, _ := repo.Get(id)
+	if data == nil {
+		return utils.ResponseError(c, errors.New("key not found"), 404)
+	}
+	if !data.CanWrite(&user.User) || !user.TeamCanWrite(body.TeamID) {
+		return utils.ResponseError(c, errors.New("no access"), 403)
 	}
 
 	item := &models.Keychain{
-		Type:  body.Type,
-		Label: body.Label,
+		TeamID: body.TeamID,
+		Type:   body.Type,
+		Label:  body.Label,
 	}
 
 	if err := item.EncryptData(body.Data); err != nil {

server/app/keychains/schema.go

@@ -1,7 +1,12 @@
 package keychains
 
 type CreateKeychainSchema struct {
-	Type  string      `json:"type"`
-	Label string      `json:"label"`
-	Data  interface{} `json:"data"`
+	TeamID *string     `json:"teamId"`
+	Type   string      `json:"type"`
+	Label  string      `json:"label"`
+	Data   interface{} `json:"data"`
+}
+
+type GetAllOpt struct {
+	TeamID string
 }