22// All rights reserved. This file is part of cc-lib.
33// Use of this source code is governed by a MIT-style
44// license that can be found in the LICENSE file.
5+
56package schema
67
78import (
@@ -16,7 +17,7 @@ type Role int
1617
1718const (
1819 RoleAnonymous Role = iota // Unauthenticated or guest access
19- RoleApi // API access (programmatic/service accounts)
20+ RoleAPI // API access (programmatic/service accounts)
2021 RoleUser // Regular user (can view own jobs)
2122 RoleManager // Project manager (can view project jobs)
2223 RoleSupport // Support staff (can view all jobs, limited admin)
@@ -58,10 +59,12 @@ type User struct {
5859 AuthSource AuthSource `json:"authSource"` // Which system authenticated the user
5960}
6061
62+ // HasProject reports whether the user is authorized for the given project name.
6163func (u * User ) HasProject (project string ) bool {
6264 return slices .Contains (u .Projects , project )
6365}
6466
67+ // GetRoleString returns the lowercase string representation of a Role enum value.
6568func GetRoleString (roleInt Role ) string {
6669 return [6 ]string {"anonymous" , "api" , "user" , "manager" , "support" , "admin" }[roleInt ]
6770}
@@ -77,19 +80,21 @@ func getRoleEnum(roleStr string) Role {
7780 case "user" :
7881 return RoleUser
7982 case "api" :
80- return RoleApi
83+ return RoleAPI
8184 case "anonymous" :
8285 return RoleAnonymous
8386 default :
8487 return RoleError
8588 }
8689}
8790
91+ // IsValidRole reports whether the given string corresponds to a known role name.
8892func IsValidRole (role string ) bool {
8993 return getRoleEnum (role ) != RoleError
9094}
9195
92- // Check if User has SPECIFIED role AND role is VALID
96+ // HasValidRole checks whether the user has the specified role and whether the role string is valid.
97+ // Returns hasRole=true if the user has the role, and isValid=true if the role name is recognized.
9398func (u * User ) HasValidRole (role string ) (hasRole bool , isValid bool ) {
9499 if IsValidRole (role ) {
95100 if slices .Contains (u .Roles , role ) {
@@ -100,12 +105,12 @@ func (u *User) HasValidRole(role string) (hasRole bool, isValid bool) {
100105 return false , false
101106}
102107
103- // Check if User has SPECIFIED role
108+ // HasRole reports whether the user has the specified role.
104109func (u * User ) HasRole (role Role ) bool {
105110 return slices .Contains (u .Roles , GetRoleString (role ))
106111}
107112
108- // Check if User has ANY of the listed roles
113+ // HasAnyRole reports whether the user has at least one of the given roles.
109114func (u * User ) HasAnyRole (queryroles []Role ) bool {
110115 for _ , ur := range u .Roles {
111116 for _ , qr := range queryroles {
@@ -117,7 +122,7 @@ func (u *User) HasAnyRole(queryroles []Role) bool {
117122 return false
118123}
119124
120- // Check if User has ALL of the listed roles
125+ // HasAllRoles reports whether the user has every one of the given roles.
121126func (u * User ) HasAllRoles (queryroles []Role ) bool {
122127 target := len (queryroles )
123128 matches := 0
@@ -137,7 +142,7 @@ func (u *User) HasAllRoles(queryroles []Role) bool {
137142 }
138143}
139144
140- // Check if User has NONE of the listed roles
145+ // HasNotRoles reports whether the user has none of the given roles.
141146func (u * User ) HasNotRoles (queryroles []Role ) bool {
142147 matches := 0
143148 for _ , ur := range u .Roles {
@@ -156,11 +161,12 @@ func (u *User) HasNotRoles(queryroles []Role) bool {
156161 }
157162}
158163
159- // Called by API endpoint '/roles/' from frontend: Only required for admin config -> Check Admin Role
164+ // GetValidRoles returns the list of assignable role names. Only admins may call this;
165+ // returns an error if the user does not have the Admin role.
160166func GetValidRoles (user * User ) ([]string , error ) {
161167 var vals []string
162168 if user .HasRole (RoleAdmin ) {
163- for i := RoleApi ; i < RoleError ; i ++ {
169+ for i := RoleAPI ; i < RoleError ; i ++ {
164170 vals = append (vals , GetRoleString (i ))
165171 }
166172 return vals , nil
@@ -169,19 +175,21 @@ func GetValidRoles(user *User) ([]string, error) {
169175 return vals , fmt .Errorf ("%s: only admins are allowed to fetch a list of roles" , user .Username )
170176}
171177
172- // Called by routerConfig web.page setup in backend: Only requires known user
178+ // GetValidRolesMap returns a map of role names to Role enum values. Requires any
179+ // authenticated (non-anonymous) user; returns an error for anonymous users.
173180func GetValidRolesMap (user * User ) (map [string ]Role , error ) {
174181 named := make (map [string ]Role )
175182 if user .HasNotRoles ([]Role {RoleAnonymous }) {
176- for i := RoleApi ; i < RoleError ; i ++ {
183+ for i := RoleAPI ; i < RoleError ; i ++ {
177184 named [GetRoleString (i )] = i
178185 }
179186 return named , nil
180187 }
181188 return named , fmt .Errorf ("only known users are allowed to fetch a list of roles" )
182189}
183190
184- // Find highest role
191+ // GetAuthLevel returns the user's highest-privilege role.
192+ // Returns RoleError if the user has no recognized roles.
185193func (u * User ) GetAuthLevel () Role {
186194 if u .HasRole (RoleAdmin ) {
187195 return RoleAdmin
@@ -191,8 +199,8 @@ func (u *User) GetAuthLevel() Role {
191199 return RoleManager
192200 } else if u .HasRole (RoleUser ) {
193201 return RoleUser
194- } else if u .HasRole (RoleApi ) {
195- return RoleApi
202+ } else if u .HasRole (RoleAPI ) {
203+ return RoleAPI
196204 } else if u .HasRole (RoleAnonymous ) {
197205 return RoleAnonymous
198206 } else {
0 commit comments