221 lines
7.8 KiB
Go
221 lines
7.8 KiB
Go
/*
|
|
* Amsterdam Web Communities System
|
|
* Copyright (c) 2025 Erbosoft Metaverse Design Solutions, All Rights Reserved
|
|
*
|
|
* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at https://mozilla.org/MPL/2.0/.
|
|
*/
|
|
// The database package contains database management and storage logic.
|
|
package database
|
|
|
|
import (
|
|
"slices"
|
|
)
|
|
|
|
/* securityScope defines nested "scopes" within the security level system. Each scope is numerically nested
|
|
* inside the previous one and outside the next one. Each scope has a "low band" of values (for ordinary users)
|
|
* and a "high band" of values (for users with administrative privilege).
|
|
*/
|
|
type securityScope struct {
|
|
lowbandLow uint16
|
|
lowbandHigh uint16
|
|
highbandLow uint16
|
|
highbandHigh uint16
|
|
}
|
|
|
|
// scopelist defines the boundaries of the known scopes. There are 16 in all, most are unused.
|
|
var scopelist = []securityScope{
|
|
{0, 1999, 63000, 64999}, // global scope
|
|
{2000, 3999, 61000, 62999}, // community scope
|
|
{4000, 5999, 59000, 60999}, // conference scope
|
|
{6000, 7999, 57000, 58999},
|
|
{8000, 9999, 55000, 56999},
|
|
{10000, 11999, 53000, 54999},
|
|
{12000, 13999, 51000, 52999},
|
|
{14000, 15999, 49000, 50999},
|
|
{16000, 17999, 47000, 48999},
|
|
{18000, 19999, 45000, 46999},
|
|
{20000, 21999, 43000, 44999},
|
|
{22000, 23999, 41000, 42999},
|
|
{24000, 25999, 39000, 40999},
|
|
{26000, 27999, 37000, 38999},
|
|
{28000, 29999, 35000, 36999},
|
|
{30000, 31999, 33000, 34999},
|
|
}
|
|
|
|
// unrestrictedUserLevel is a user level that is above all "low" bands but below all "high" bands.
|
|
const unrestrictedUserLevel uint16 = 32500
|
|
|
|
// noAccessLevel is the level used to specify "no access," as it's above the highest value in the topmost scope.
|
|
const noAccessLevel uint16 = 65500
|
|
|
|
// Role defines a security role.
|
|
type Role interface {
|
|
ID() string
|
|
Name() string
|
|
Level() uint16
|
|
}
|
|
|
|
// amRole is the internal implementation of the Role.
|
|
type amRole struct {
|
|
id string
|
|
name string
|
|
level uint16
|
|
}
|
|
|
|
// ID returns the string identifier of the role.
|
|
func (r *amRole) ID() string {
|
|
return r.id
|
|
}
|
|
|
|
// Name returns the textual name of the role.
|
|
func (r *amRole) Name() string {
|
|
return r.name
|
|
}
|
|
|
|
// Level returns the access level of the role.
|
|
func (r *amRole) Level() uint16 {
|
|
return r.level
|
|
}
|
|
|
|
// RoleList defines a list of security roles.
|
|
type RoleList interface {
|
|
Roles() []Role
|
|
Default() Role
|
|
}
|
|
|
|
// amRoleList is the internal implementation of RoleList.
|
|
type amRoleList struct {
|
|
roleList []Role
|
|
defaultRole Role
|
|
}
|
|
|
|
// Roles returns the list of roles for a given RoleList.
|
|
func (rl *amRoleList) Roles() []Role {
|
|
return rl.roleList
|
|
}
|
|
|
|
// Default returns the default role in a given RoleList.
|
|
func (rl *amRoleList) Default() Role {
|
|
return rl.defaultRole
|
|
}
|
|
|
|
// roles holds all the defined roles.
|
|
var roles map[string]Role
|
|
|
|
// roleDefaults assigns roles to symbolic default names.
|
|
var roleDefaults map[string]Role
|
|
|
|
// roleLists holds all the defined role lists.
|
|
var roleLists map[string]RoleList
|
|
|
|
// permissions assigns roles to specific named permissions.
|
|
var permissions map[string]Role
|
|
|
|
// defineRole defines a role and adds it to the roles map.
|
|
func defineRole(id string, name string, level uint16) Role {
|
|
r := amRole{id: id, name: name, level: level}
|
|
roles[id] = &r
|
|
return &r
|
|
}
|
|
|
|
// defineRoleList defines a role list and adds it to the roleLists map.
|
|
func defineRoleList(id string, roles []Role, defaultRole Role) {
|
|
slices.SortFunc(roles, func(a Role, b Role) int {
|
|
leva := int(a.Level())
|
|
levb := int(b.Level())
|
|
return leva - levb
|
|
})
|
|
rl := amRoleList{roleList: roles, defaultRole: defaultRole}
|
|
roleLists[id] = &rl
|
|
}
|
|
|
|
/* AmRole returns a Role given a string ID.
|
|
* Parameters:
|
|
* id - ID of the role to look up.
|
|
* Returns:
|
|
* The specified role.
|
|
*/
|
|
func AmRole(id string) Role {
|
|
return roles[id]
|
|
}
|
|
|
|
/* AmDefaultRole returns a Role diven a default ID.
|
|
* Parameters:
|
|
* id - ID of the default to look up.
|
|
* Returns:
|
|
* The specified role.
|
|
*/
|
|
func AmDefaultRole(id string) Role {
|
|
return roleDefaults[id]
|
|
}
|
|
|
|
/* AmTestPermission tests a specified access level to see if it satisfies the given permission.
|
|
* Parameters:
|
|
* id - ID of the permission to check.
|
|
* level - The access level to be verified.
|
|
* Returns:
|
|
* true if the permission test is satisfied, false if not.
|
|
*/
|
|
func AmTestPermission(id string, level uint16) bool {
|
|
return permissions[id].Level() < level
|
|
}
|
|
|
|
// init initializes all the security data.
|
|
func init() {
|
|
// Initialize the roles.
|
|
roles = make(map[string]Role)
|
|
not := defineRole("NotInList", "Not in List", 0)
|
|
uu := defineRole("UnrestrictedUser", "Unrestricted User", unrestrictedUserLevel)
|
|
none := defineRole("NoAccess", "No Access", noAccessLevel)
|
|
g_anon := defineRole("Global.Anonymous", "Anonymous User", scopelist[0].lowbandLow+100)
|
|
g_unverf := defineRole("Global.Unverified", "Unauthenticated User", scopelist[0].lowbandLow+500)
|
|
g_normal := defineRole("Global.Normal", "Normal User", scopelist[0].lowbandLow+1000)
|
|
g_anyadmin := defineRole("Global.AnyAdmin", "Any System Administrator", scopelist[0].highbandLow)
|
|
g_PFY := defineRole("Global.PFY", "System Assistant Administrator", scopelist[0].highbandLow+1000)
|
|
g_BOFH := defineRole("Global.BOFH", "Global System Administrator", scopelist[0].highbandHigh)
|
|
com_member := defineRole("Community.Member", "Community Member", scopelist[1].lowbandLow+500)
|
|
com_anyadmin := defineRole("Community.AnyAdmin", "Any Community Administrator", scopelist[1].highbandLow)
|
|
com_cohost := defineRole("Community.Cohost", "Community Co-Host", scopelist[1].highbandLow+1000)
|
|
com_host := defineRole("Community.Host", "Community Host", scopelist[1].highbandLow+1500)
|
|
|
|
// Initialize the defaults list.
|
|
roleDefaults = make(map[string]Role)
|
|
roleDefaults["Global.NewUser"] = g_unverf
|
|
roleDefaults["Global.AfterVerify"] = g_normal
|
|
roleDefaults["Global.AfterEmailChange"] = g_unverf
|
|
roleDefaults["Community.NewUser"] = com_member
|
|
roleDefaults["Community.Creator"] = com_host
|
|
|
|
// Initialize the roles lists.
|
|
roleLists = make(map[string]RoleList)
|
|
defineRoleList("Global.UserLevels", []Role{g_anon, g_unverf, g_normal, uu}, nil)
|
|
defineRoleList("Global.UserLevelsPFY", []Role{g_anon, g_unverf, g_normal, uu, g_PFY}, nil)
|
|
defineRoleList("Global.CreateCommunity", []Role{g_normal, uu, g_anyadmin, g_PFY, g_BOFH}, g_normal)
|
|
defineRoleList("Community.Read", []Role{g_anon, g_unverf, g_normal, com_member, uu, com_anyadmin, com_cohost, com_host, g_anyadmin}, com_member)
|
|
defineRoleList("Community.Write", []Role{com_anyadmin, com_cohost, com_host, g_anyadmin, g_PFY, g_BOFH}, com_cohost)
|
|
defineRoleList("Community.Create", []Role{g_normal, com_member, uu, com_anyadmin, com_cohost, com_host, g_anyadmin}, com_cohost)
|
|
defineRoleList("Community.Delete", []Role{com_anyadmin, com_cohost, com_host, g_anyadmin, g_PFY, g_BOFH, none}, com_host)
|
|
defineRoleList("Community.Join", []Role{g_anon, g_unverf, g_normal}, g_normal)
|
|
defineRoleList("Community.UserLevels", []Role{not, g_anon, g_unverf, g_normal, com_member, uu, com_cohost}, nil)
|
|
|
|
// Initialize the permissions lists.
|
|
permissions = make(map[string]Role)
|
|
permissions["Global.ShowHiddenCategories"] = g_anyadmin
|
|
permissions["Global.NoEmailVerify"] = g_anyadmin
|
|
permissions["Global.SeeHiddenContactInfo"] = g_anyadmin
|
|
permissions["Global.SearchHiddenCommunities"] = g_anyadmin
|
|
permissions["Global.ShowHiddenCommunities"] = g_anyadmin
|
|
permissions["Global.SearchHiddenCategories"] = g_anyadmin
|
|
permissions["Global.SysAdminAccess"] = g_anyadmin
|
|
permissions["Global.PublishFP"] = g_anyadmin
|
|
permissions["Global.DesignatePFY"] = g_BOFH
|
|
permissions["Community.ShowAdmin"] = com_anyadmin
|
|
permissions["Community.NoJoinRequired"] = g_anyadmin
|
|
permissions["Community.NoKeyRequired"] = g_anyadmin
|
|
permissions["Community.ShowHiddenMembers"] = com_anyadmin
|
|
permissions["Community.ShowHiddenObjects"] = com_anyadmin
|
|
permissions["Community.MassMail"] = com_anyadmin
|
|
}
|