edr-platform/apps/edr-freight-api/src/common/freight-permission.guard.ts

import {
  CanActivate,
  ExecutionContext,
  ForbiddenException,
  Injectable,
  Type,
  UnauthorizedException,
} from '@nestjs/common';
import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';

import { hasFreightPermission, isSuperAdmin } from './freight-permission.util';
import { readTwinOf } from '../seed/freight-permissions.registry';

// String literals on purpose (same reasoning as login-audience.middleware.ts):
// the values are wire-format constants from iam.users.user_type, and importing
// the vendored enum couples us to its package layout for no gain.
const CUSTOMER_USER_TYPES = ['individual', 'external_organization'];

const userTypeOf = (user: TCurrentUser): string | undefined =>
  (user as { userType?: string }).userType;

/** Staff routes are employee-only; a missing userType (stale session) also fails. */
const isEmployee = (user: TCurrentUser): boolean =>
  userTypeOf(user) === 'employee' || isSuperAdmin(user);

const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);

/**
 * Does the caller satisfy a required permission?
 *
 * Holding the key outright always passes. A required `<module>:view` is ALSO
 * satisfied by the weaker `<module>:read` — the key that buys API reads
 * without putting the module in the backoffice sidebar — but only on a safe
 * HTTP method.
 *
 * The method restriction is load-bearing, not caution. Nest runs class AND
 * method guards, so controllers list every route key on the class gate,
 * `:view` among the write keys. Without this check a `:read` holder would
 * clear that class gate and then reach any write route that has no method
 * gate of its own. Keying on the HTTP verb closes that by construction rather
 * than by an audit that goes stale the next time a route is added.
 */
const satisfiedBy = (
  user: TCurrentUser,
  required: string,
  method: string,
): boolean => {
  if (hasFreightPermission(user, required)) return true;
  if (!SAFE_METHODS.has(method)) return false;
  const readTwin = readTwinOf(required);
  return Boolean(readTwin && hasFreightPermission(user, readTwin));
};

export function FreightPermissionGuard(
  permissions: string[],
): Type<CanActivate> {
  @Injectable()
  class FreightPermissionsGuard implements CanActivate {
    canActivate(context: ExecutionContext): boolean {
      const request = context
        .switchToHttp()
        .getRequest<{ user?: TCurrentUser; method: string }>();
      const user = request.user;

      if (!user) {
        throw new UnauthorizedException('Authentication required');
      }
      if (!isEmployee(user)) {
        throw new ForbiddenException('Staff account required');
      }

      if (!permissions?.length) return true;
      if (permissions.some((p) => satisfiedBy(user, p, request.method))) {
        return true;
      }

      throw new ForbiddenException(
        `Missing permission. Required one of: ${permissions.join(', ')}`,
      );
    }
  }

  return FreightPermissionsGuard;
}

/** Portal routes: customer accounts only (individual / external organization). */
@Injectable()
export class PortalCustomerGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest<{ user?: TCurrentUser }>();
    const user = request.user;

    if (!user) {
      throw new UnauthorizedException('Authentication required');
    }
    if (!CUSTOMER_USER_TYPES.includes(userTypeOf(user) ?? '')) {
      throw new ForbiddenException('Customer account required');
    }
    return true;
  }
}

/**
 * Routes both audiences legitimately call (contract sign, shared document
 * reads, warehouse handover). Staff callers must hold one of the given
 * permissions; customer callers pass here and are scoped by the service's
 * ownership checks.
 */
export function MixedAudienceGuard(permissions: string[]): Type<CanActivate> {
  @Injectable()
  class MixedAudiencesGuard implements CanActivate {
    canActivate(context: ExecutionContext): boolean {
      const request = context
        .switchToHttp()
        .getRequest<{ user?: TCurrentUser; method: string }>();
      const user = request.user;

      if (!user) {
        throw new UnauthorizedException('Authentication required');
      }
      if (CUSTOMER_USER_TYPES.includes(userTypeOf(user) ?? '')) {
        return true;
      }
      if (!isEmployee(user)) {
        throw new ForbiddenException('Unrecognized account type');
      }
      if (
        !permissions?.length ||
        permissions.some((p) => satisfiedBy(user, p, request.method))
      ) {
        return true;
      }
      throw new ForbiddenException(
        `Missing permission. Required one of: ${permissions.join(', ')}`,
      );
    }
  }

  return MixedAudiencesGuard;
}