shoc-backend/SeaHaven.Services/Implementation/TeamPermissionPolicy.cs

using Data.SeaHavenIndustries.Enums;
using SeaHaven.Services.Constants;
using SeaHaven.Services.Interfaces;

namespace SeaHaven.Services.Implementation
{
    public sealed class TeamPermissionPolicy : ITeamPermissionPolicy
    {
        private static readonly StringComparer KeyComparer = StringComparer.OrdinalIgnoreCase;

        private static readonly HashSet<string> DispatcherDefaults = new(KeyComparer)
        {
            TeamPermissionKeys.CreateVendors,
            TeamPermissionKeys.EditVendors,
            TeamPermissionKeys.DeactivateVendors,
            TeamPermissionKeys.CreateSites,
            TeamPermissionKeys.EditSites,
            TeamPermissionKeys.CreateWorkOrders,
            TeamPermissionKeys.EditOthersWorkOrders,
            TeamPermissionKeys.CancelWorkOrders,
            TeamPermissionKeys.RequestUplifts,
            TeamPermissionKeys.AutoApproveUplifts
        };

        private static readonly HashSet<string> SchedulerDefaults = new(
            DispatcherDefaults
                .Except(new[]
                {
                    TeamPermissionKeys.RequestUplifts,
                    TeamPermissionKeys.AutoApproveUplifts
                }, KeyComparer)
                .Concat(new[]
                {
                    TeamPermissionKeys.DeleteSites,
                    TeamPermissionKeys.CreateServices,
                    TeamPermissionKeys.EditServices,
                    TeamPermissionKeys.CreateCompletionDocTemplates,
                    TeamPermissionKeys.EditCompletionDocTemplates,
                    TeamPermissionKeys.ViewAllDispatchersOnDashboard
                }), KeyComparer);

        public bool IsAllowed(
            string? roleName,
            string permissionKey,
            IReadOnlyDictionary<string, UserPermissionState>? overrides = null)
        {
            if (!TeamPermissionKeys.IsKnown(permissionKey))
                return false;

            if (IsAdmin(roleName))
                return true;

            var defaults = ResolveRoleDefaults(roleName);
            if (defaults is null)
                return false;

            if (overrides is not null
                && overrides.TryGetValue(permissionKey, out var state))
            {
                return state switch
                {
                    UserPermissionState.Allow => true,
                    UserPermissionState.Deny => false,
                    _ => defaults.Contains(permissionKey)
                };
            }

            return defaults.Contains(permissionKey);
        }

        private static bool IsAdmin(string? roleName) =>
            string.Equals(roleName, "Admin", StringComparison.OrdinalIgnoreCase);

        private static IReadOnlySet<string>? ResolveRoleDefaults(string? roleName)
        {
            if (string.IsNullOrWhiteSpace(roleName))
                return null;

            if (roleName.Equals("Dispatcher", StringComparison.OrdinalIgnoreCase))
                return DispatcherDefaults;

            if (roleName.Equals("Scheduler", StringComparison.OrdinalIgnoreCase))
                return SchedulerDefaults;

            return null;
        }
    }
}