permissions in service layer

Author: pierre-b

internal/domain/errors.go

@@ -57,3 +57,31 @@ func NewValidationError(message string) error {
 		Message: message,
 	}
 }
+
+// PermissionError represents insufficient permissions for an operation
+type PermissionError struct {
+	Resource   PermissionResource `json:"resource"`
+	Permission PermissionType     `json:"permission"`
+	Message    string             `json:"message"`
+}
+
+// Error implements the error interface
+func (e *PermissionError) Error() string {
+	return e.Message
+}
+
+// NewPermissionError creates a new permission error
+func NewPermissionError(resource PermissionResource, permission PermissionType, message string) *PermissionError {
+	return &PermissionError{
+		Resource:   resource,
+		Permission: permission,
+		Message:    message,
+	}
+}
+
+// ErrInsufficientPermissions is the default insufficient permissions error
+var ErrInsufficientPermissions = NewPermissionError(
+	PermissionResourceWorkspace,
+	PermissionTypeRead,
+	"Insufficient permissions",
+)

internal/service/broadcast_service.go

@@ -69,12 +69,21 @@ func (s *BroadcastService) SetTaskService(taskService domain.TaskService) {
 func (s *BroadcastService) CreateBroadcast(ctx context.Context, request *domain.CreateBroadcastRequest) (*domain.Broadcast, error) {
 	// Authenticate user for workspace
 	var err error
-	ctx, _, _, err = s.authService.AuthenticateUserForWorkspace(ctx, request.WorkspaceID)
+	ctx, _, userWorkspace, err := s.authService.AuthenticateUserForWorkspace(ctx, request.WorkspaceID)
 	if err != nil {
 		s.logger.Error("Failed to authenticate user for workspace")
 		return nil, fmt.Errorf("failed to authenticate user: %w", err)
 	}
 
+	// Check permission for writing broadcasts
+	if !userWorkspace.HasPermission(domain.PermissionResourceBroadcasts, domain.PermissionTypeWrite) {
+		return nil, domain.NewPermissionError(
+			domain.PermissionResourceBroadcasts,
+			domain.PermissionTypeWrite,
+			"Insufficient permissions: write access to broadcasts required",
+		)
+	}
+
 	// Validate the request
 	broadcast, err := request.Validate()
 	if err != nil {
@@ -121,12 +130,21 @@ func (s *BroadcastService) CreateBroadcast(ctx context.Context, request *domain.
 func (s *BroadcastService) GetBroadcast(ctx context.Context, workspaceID, broadcastID string) (*domain.Broadcast, error) {
 	// Authenticate user for workspace
 	var err error
-	ctx, _, _, err = s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
+	ctx, _, userWorkspace, err := s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
 	if err != nil {
 		s.logger.WithField("broadcast_id", broadcastID).Error("Failed to authenticate user for workspace")
 		return nil, fmt.Errorf("failed to authenticate user: %w", err)
 	}
 
+	// Check permission for reading broadcasts
+	if !userWorkspace.HasPermission(domain.PermissionResourceBroadcasts, domain.PermissionTypeRead) {
+		return nil, domain.NewPermissionError(
+			domain.PermissionResourceBroadcasts,
+			domain.PermissionTypeRead,
+			"Insufficient permissions: read access to broadcasts required",
+		)
+	}
+
 	// Fetch the broadcast from the repository
 	return s.repo.GetBroadcast(ctx, workspaceID, broadcastID)
 }

internal/service/broadcast_service_test.go

@@ -105,7 +105,15 @@ func setupBroadcastSvc(t *testing.T) *broadcastSvcDeps {
 }
 
 func authOK(auth *domainmocks.MockAuthService, ctx context.Context, workspaceID string) {
-	auth.EXPECT().AuthenticateUserForWorkspace(ctx, workspaceID).Return(ctx, &domain.User{ID: "user1"}, nil, nil)
+	userWorkspace := &domain.UserWorkspace{
+		UserID:      "user1",
+		WorkspaceID: workspaceID,
+		Role:        "member",
+		Permissions: domain.UserPermissions{
+			domain.PermissionResourceBroadcasts: {Read: true, Write: true},
+		},
+	}
+	auth.EXPECT().AuthenticateUserForWorkspace(ctx, workspaceID).Return(ctx, &domain.User{ID: "user1"}, userWorkspace, nil)
 }
 
 func TestBroadcastService_CreateBroadcast_Success(t *testing.T) {

internal/service/contact_service.go

@@ -33,11 +33,20 @@ func NewContactService(
 
 func (s *ContactService) GetContactByEmail(ctx context.Context, workspaceID string, email string) (*domain.Contact, error) {
 	var err error
-	ctx, _, _, err = s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
+	ctx, _, userWorkspace, err := s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to authenticate user: %w", err)
 	}
 
+	// Check permission for reading contacts
+	if !userWorkspace.HasPermission(domain.PermissionResourceContacts, domain.PermissionTypeRead) {
+		return nil, domain.NewPermissionError(
+			domain.PermissionResourceContacts,
+			domain.PermissionTypeRead,
+			"Insufficient permissions: read access to contacts required",
+		)
+	}
+
 	contact, err := s.repo.GetContactByEmail(ctx, workspaceID, email)
 	if err != nil {
 		if strings.Contains(err.Error(), "contact not found") {
@@ -52,11 +61,20 @@ func (s *ContactService) GetContactByEmail(ctx context.Context, workspaceID stri
 
 func (s *ContactService) GetContactByExternalID(ctx context.Context, externalID string, workspaceID string) (*domain.Contact, error) {
 	var err error
-	ctx, _, _, err = s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
+	ctx, _, userWorkspace, err := s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to authenticate user: %w", err)
 	}
 
+	// Check permission for reading contacts
+	if !userWorkspace.HasPermission(domain.PermissionResourceContacts, domain.PermissionTypeRead) {
+		return nil, domain.NewPermissionError(
+			domain.PermissionResourceContacts,
+			domain.PermissionTypeRead,
+			"Insufficient permissions: read access to contacts required",
+		)
+	}
+
 	contact, err := s.repo.GetContactByExternalID(ctx, externalID, workspaceID)
 	if err != nil {
 		if strings.Contains(err.Error(), "contact not found") {
@@ -71,11 +89,20 @@ func (s *ContactService) GetContactByExternalID(ctx context.Context, externalID
 
 func (s *ContactService) GetContacts(ctx context.Context, req *domain.GetContactsRequest) (*domain.GetContactsResponse, error) {
 	var err error
-	ctx, _, _, err = s.authService.AuthenticateUserForWorkspace(ctx, req.WorkspaceID)
+	ctx, _, userWorkspace, err := s.authService.AuthenticateUserForWorkspace(ctx, req.WorkspaceID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to authenticate user: %w", err)
 	}
 
+	// Check permission for reading contacts
+	if !userWorkspace.HasPermission(domain.PermissionResourceContacts, domain.PermissionTypeRead) {
+		return nil, domain.NewPermissionError(
+			domain.PermissionResourceContacts,
+			domain.PermissionTypeRead,
+			"Insufficient permissions: read access to contacts required",
+		)
+	}
+
 	response, err := s.repo.GetContacts(ctx, req)
 	if err != nil {
 		s.logger.Error(fmt.Sprintf("Failed to get contacts: %v", err))
@@ -87,11 +114,20 @@ func (s *ContactService) GetContacts(ctx context.Context, req *domain.GetContact
 
 func (s *ContactService) DeleteContact(ctx context.Context, email string, workspaceID string) error {
 	var err error
-	ctx, _, _, err = s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
+	ctx, _, userWorkspace, err := s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
 	if err != nil {
 		return fmt.Errorf("failed to authenticate user: %w", err)
 	}
 
+	// Check permission for writing contacts
+	if !userWorkspace.HasPermission(domain.PermissionResourceContacts, domain.PermissionTypeWrite) {
+		return domain.NewPermissionError(
+			domain.PermissionResourceContacts,
+			domain.PermissionTypeWrite,
+			"Insufficient permissions: write access to contacts required",
+		)
+	}
+
 	if err := s.repo.DeleteContact(ctx, email, workspaceID); err != nil {
 		s.logger.WithField("email", email).Error(fmt.Sprintf("Failed to delete contact: %v", err))
 		return fmt.Errorf("failed to delete contact: %w", err)
@@ -106,12 +142,18 @@ func (s *ContactService) BatchImportContacts(ctx context.Context, workspaceID st
 	}
 
 	var err error
-	ctx, _, _, err = s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
+	ctx, _, userWorkspace, err := s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
 	if err != nil {
 		response.Error = fmt.Sprintf("failed to authenticate user: %v", err)
 		return response
 	}
 
+	// Check permission for writing contacts
+	if !userWorkspace.HasPermission(domain.PermissionResourceContacts, domain.PermissionTypeWrite) {
+		response.Error = "Insufficient permissions: write access to contacts required"
+		return response
+	}
+
 	// Validate and upsert
 	for i, contact := range contacts {
 		now := time.Now().UTC()
@@ -159,14 +201,22 @@ func (s *ContactService) UpsertContact(ctx context.Context, workspaceID string,
 	}
 
 	var err error
-	ctx, _, _, err = s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
+	ctx, _, userWorkspace, err := s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)
 	if err != nil {
 		operation.Action = domain.UpsertContactOperationError
 		operation.Error = err.Error()
 		s.logger.WithField("email", contact.Email).Error(fmt.Sprintf("Failed to authenticate user: %v", err))
 		return operation
 	}
 
+	// Check permission for writing contacts
+	if !userWorkspace.HasPermission(domain.PermissionResourceContacts, domain.PermissionTypeWrite) {
+		operation.Action = domain.UpsertContactOperationError
+		operation.Error = "Insufficient permissions: write access to contacts required"
+		s.logger.WithField("email", contact.Email).Error("Insufficient permissions: write access to contacts required")
+		return operation
+	}
+
 	if err := contact.Validate(); err != nil {
 		operation.Action = domain.UpsertContactOperationError
 		operation.Error = err.Error()