All files / web/src/lib/auth checkAccess.ts

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
/**
 * Casbin-based access control — drop-in replacement for access-control.ts.
 *
 * Re-exports all the same types and provides Casbin-backed implementations
 * with parallel-run mode for safe migration. In parallel-run mode, both
 * Casbin and legacy are called, mismatches are logged, and legacy result
 * is returned until the migration is validated.
 */

import {
  canPerformAction as legacyCanPerformAction,
  getPlayerAccess as legacyGetPlayerAccess,
  getAccessiblePlayers as legacyGetAccessiblePlayers,
  isParentOf as legacyIsParentOf,
  isTeacherOf as legacyIsTeacherOf,
  generateAuthorizationError,
  type AccessLevel,
  type PlayerAccess,
  type PlayerAction,
  type AccessiblePlayers,
  type RemediationType,
  type AuthorizationError,
} from '@/lib/classroom/access-control'
import { getResourceEnforcer } from './enforcer'

// Re-export types that callers depend on
export type {
  AccessLevel,
  PlayerAccess,
  PlayerAction,
  AccessiblePlayers,
  RemediationType,
  AuthorizationError,
}

// Re-export generateAuthorizationError directly (no Casbin equivalent needed)
export { generateAuthorizationError }

/**
 * When true, both Casbin and legacy are called and results are compared.
 * Set to false to cut over to Casbin-only after validation.
 */
const PARALLEL_RUN = true

/**
 * Check if a user can perform an action on a player (Casbin-backed).
 */
export async function checkPlayerAccess(
  userId: string,
  playerId: string,
  action: PlayerAction
): Promise<boolean> {
  if (!PARALLEL_RUN) {
    const enforcer = await getResourceEnforcer()
    return enforcer.enforce(userId, `player:${playerId}`, 'player', action)
  }

  // Parallel run: call both and compare
  const [casbinResult, legacyResult] = await Promise.all([
    getResourceEnforcer()
      .then((e) => e.enforce(userId, `player:${playerId}`, 'player', action))
      .catch((err) => {
        console.error('[AUTH-MIGRATION] Casbin error:', err)
        return null
      }),
    legacyCanPerformAction(userId, playerId, action),
  ])

  if (casbinResult !== null && casbinResult !== legacyResult) {
    console.warn(
      `[AUTH-MIGRATION] Mismatch on checkPlayerAccess: ` +
        `user=${userId} player=${playerId} action=${action} ` +
        `casbin=${casbinResult} legacy=${legacyResult}`
    )
  }

  return legacyResult
}

/**
 * Get access details for a user-player pair.
 * During parallel run, delegates to legacy.
 */
export async function getPlayerAccessLevel(
  viewerId: string,
  playerId: string
): Promise<PlayerAccess> {
  // For now, delegate to legacy — Casbin doesn't produce the same rich structure.
  // After cutover, this would query Casbin for the user's roles in the player domain.
  return legacyGetPlayerAccess(viewerId, playerId)
}

/**
 * Get all players accessible to a viewer.
 * During parallel run, delegates to legacy.
 */
export async function getAccessiblePlayersForViewer(viewerId: string): Promise<AccessiblePlayers> {
  // Casbin equivalent would query all domains where user has a grouping policy,
  // then categorize by role. For now, use legacy.
  return legacyGetAccessiblePlayers(viewerId)
}

/**
 * Check if a user is a parent of a player.
 */
export async function checkIsParentOf(userId: string, playerId: string): Promise<boolean> {
  if (!PARALLEL_RUN) {
    const enforcer = await getResourceEnforcer()
    return enforcer.hasGroupingPolicy(userId, 'parent', `player:${playerId}`)
  }

  const [casbinResult, legacyResult] = await Promise.all([
    getResourceEnforcer()
      .then((e) => e.hasGroupingPolicy(userId, 'parent', `player:${playerId}`))
      .catch((err) => {
        console.error('[AUTH-MIGRATION] Casbin error:', err)
        return null
      }),
    legacyIsParentOf(userId, playerId),
  ])

  if (casbinResult !== null && casbinResult !== legacyResult) {
    console.warn(
      `[AUTH-MIGRATION] Mismatch on checkIsParentOf: ` +
        `user=${userId} player=${playerId} ` +
        `casbin=${casbinResult} legacy=${legacyResult}`
    )
  }

  return legacyResult
}

/**
 * Check if a user is a teacher of a player (student enrolled in their classroom).
 */
export async function checkIsTeacherOf(userId: string, playerId: string): Promise<boolean> {
  if (!PARALLEL_RUN) {
    const enforcer = await getResourceEnforcer()
    const enrolled = await enforcer.hasGroupingPolicy(
      userId,
      'teacher-enrolled',
      `player:${playerId}`
    )
    const present = await enforcer.hasGroupingPolicy(
      userId,
      'teacher-present',
      `player:${playerId}`
    )
    return enrolled || present
  }

  const [casbinResult, legacyResult] = await Promise.all([
    getResourceEnforcer()
      .then(async (e) => {
        const enrolled = await e.hasGroupingPolicy(userId, 'teacher-enrolled', `player:${playerId}`)
        const present = await e.hasGroupingPolicy(userId, 'teacher-present', `player:${playerId}`)
        return enrolled || present
      })
      .catch((err) => {
        console.error('[AUTH-MIGRATION] Casbin error:', err)
        return null
      }),
    legacyIsTeacherOf(userId, playerId),
  ])

  if (casbinResult !== null && casbinResult !== legacyResult) {
    console.warn(
      `[AUTH-MIGRATION] Mismatch on checkIsTeacherOf: ` +
        `user=${userId} player=${playerId} ` +
        `casbin=${casbinResult} legacy=${legacyResult}`
    )
  }

  return legacyResult
}