lingniu-vehicle-ingest/vehicle-data-platform/apps/api/internal/app/oneos_authority.go

package app

// OneOS permissions are revalidated for each request. Administrator authority
// comes from upstream permissions, never from a username or role display name.
import (
	"errors"
	"lingniu/vehicle-data-platform/apps/api/internal/platform"
	"net/http"
	"strings"
	"time"
)

var errOneOSAuthority = errors.New("OneOS authorization unavailable")

const oneOSAdminPermission = "vehiclePlatform:admin:all"

func oneOSHasAdminPermission(values []string) bool {
	var access, admin bool
	for _, value := range values {
		if value == "*:*:*" {
			return true
		}
		access = access || value == "vehicle:platform:access"
		admin = admin || value == oneOSAdminPermission
	}
	return access && admin
}

func oneOSAdminPrincipal(u authUser, p oneOSProfile, permissions []string) platform.Principal {
	return platform.Principal{PermissionKeys: append([]string(nil), permissions...), Name: u.DisplayName, Username: p.Username, Role: "admin", UserType: "admin", TenantRef: p.TenantID, AuthProvider: "oneos", MenuKeys: append([]string(nil), adminMenus...), AuthorizationStatus: "ready"}
}

func oneOSPermissions(values []string) map[string]bool {
	out := map[string]bool{}
	for _, v := range values {
		out[v] = true
	}
	if oneOSHasAdminPermission(values) {
		out[oneOSAdminPermission] = true
		for _, menu := range adminMenus {
			out[oneOSMenuPermission(menu)] = true
		}
		for _, key := range []string{"vehicle:platform:access", "vehiclePlatform:monitor:view", "vehiclePlatform:vehicles:view", "vehiclePlatform:tracks:view", "vehiclePlatform:statistics:view", "vehiclePlatform:vehicle:read", "vehiclePlatform:track:read", "vehiclePlatform:statistics:read"} {
			out[key] = true
		}
	}
	return out
}
func oneOSReadAction(r *http.Request) string {
	if r.URL.Path == "/api/v2/alerts/events" {
		return ""
	}
	if r.URL.Path == "/api/v2/session" || r.URL.Path == "/api/v2/auth/oneos/me" {
		return "vehicle:platform:access"
	}
	if requiredRole(r) != "viewer" {
		return ""
	}
	switch requiredMenu(r) {
	case "operation-compliance":
		return "vehiclePlatform:operationCompliance:view"
	case "customer-mileage":
		return "vehiclePlatform:customerMileage:view"
	case "monitor", "vehicles", "shared":
		return "vehiclePlatform:vehicle:read"
	case "tracks":
		return "vehiclePlatform:track:read"
	case "statistics":
		return "vehiclePlatform:statistics:read"
	}
	return ""
}
func oneOSScopedPrincipal(u authUser, p oneOSProfile, permissions []string, scope oneOSVehicleScope, now time.Time) (platform.Principal, error) {
	if oneOSHasAdminPermission(permissions) {
		return oneOSAdminPrincipal(u, p, permissions), nil
	}
	grants := oneOSPermissions(permissions)
	if !grants["vehicle:platform:access"] || scope.TenantID != p.TenantID || scope.UserID != p.UserID || scope.PermissionVersion == "" || !scope.ExpiresAt.After(now) || scope.ExpiresAt.Sub(now) > 60*time.Second {
		return platform.Principal{}, errOneOSAuthority
	}
	seen := map[string]bool{}
	if len(scope.Vehicles) > 100000 {
		return platform.Principal{}, errOneOSAuthority
	}
	for _, v := range scope.Vehicles {
		if len(v.VIN) == 0 || len(v.VIN) > 64 || v.VIN != strings.ToUpper(strings.TrimSpace(v.VIN)) || seen[v.VIN] || v.ValidFrom.IsZero() || (v.ValidTo != nil && !v.ValidTo.After(v.ValidFrom)) {
			return platform.Principal{}, errOneOSAuthority
		}
		seen[v.VIN] = true
	}
	principal := platform.Principal{PermissionKeys: append([]string(nil), permissions...), Name: u.DisplayName, Username: p.Username, Role: "customer", UserType: "customer", TenantRef: p.TenantID, AuthProvider: "oneos", MenuKeys: []string{}}
	for _, menu := range []string{"monitor", "vehicles", "tracks", "statistics", "customer-mileage", "operation-compliance"} {
		if grants[oneOSMenuPermission(menu)] {
			principal.MenuKeys = append(principal.MenuKeys, menu)
		}
	}
	for _, v := range scope.Vehicles {
		if !v.ValidFrom.After(now) && (v.ValidTo == nil || v.ValidTo.After(now)) {
			principal.VehicleVINs = append(principal.VehicleVINs, v.VIN)
			principal.VehicleGrants = append(principal.VehicleGrants, platform.VehicleGrant{VIN: v.VIN, ValidFrom: v.ValidFrom, ValidTo: v.ValidTo})
		}
	}
	principal.VehicleCount = len(principal.VehicleVINs)
	return principal, nil
}

func oneOSMenuPermission(menu string) string {
	if menu == "operation-compliance" {
		menu = "operationCompliance"
	}
	if menu == "customer-mileage" {
		menu = "customerMileage"
	}
	return "vehiclePlatform:" + menu + ":view"
}