shoc-backend/SeaHaven.Services/Helpers/WorkOrderMediaAuthorization.cs

using System.Security.Claims;
using Data.SeaHavenIndustries;
using SeaHaven.Services.Exceptions;

namespace SeaHaven.Services.Helpers
{
    /// <summary>
    /// Claims-derived authorization for work-order media read/mutations.
    /// Organization scope matches the board: callers must already have resolved
    /// the work order via <c>ApplyBaseScope</c> (non-deleted, non-template).
    /// Staff may access any in-org work order; technicians only when
    /// <see cref="WorkOrder.AssignTo"/> matches the actor. See
    /// <c>docs/adr/0001-work-order-single-org-scope.md</c>.
    /// </summary>
    public static class WorkOrderMediaAuthorization
    {
        private static readonly string[] StaffRoles =
        {
            "Admin",
            "Manager",
            "Dispatcher",
            "Supervisor"
        };

        public static void EnsureCanRead(ClaimsPrincipal user, string? actorId)
        {
            EnsureAuthenticated(user, actorId, "You are not allowed to view work order media.");

            if (IsStaff(user) || user.IsInRole("User"))
                return;

            throw Forbidden("You are not allowed to view work order media.");
        }

        public static void EnsureCanMutate(ClaimsPrincipal user, string? actorId)
        {
            EnsureAuthenticated(user, actorId);

            if (IsStaff(user) || user.IsInRole("User"))
                return;

            throw Forbidden();
        }

        public static void EnsureCanDelete(ClaimsPrincipal user, string? actorId)
        {
            EnsureAuthenticated(user, actorId);

            // Technician (User) may upload/categorize assigned media but not delete.
            if (IsStaff(user))
                return;

            throw Forbidden();
        }

        /// <summary>
        /// Caller-scope check after a base-scoped (in-org) work-order load.
        /// Staff: any in-org work order already resolved via <c>ApplyBaseScope</c>.
        /// Technician: only when assigned to the caller.
        /// Out of caller scope → NotFound (no disclosure).
        /// </summary>
        public static void EnsureWorkOrderInCallerScope(
            ClaimsPrincipal user,
            string actorId,
            WorkOrder workOrder)
        {
            // Organization boundary is enforced by the data-layer ApplyBaseScope
            // load that produced <paramref name="workOrder"/>. Staff are authorized
            // for any in-org work order (same as the board). See ADR 0001.
            if (IsStaff(user))
                return;

            if (user.IsInRole("User")
                && string.Equals(workOrder.AssignTo, actorId, StringComparison.Ordinal))
            {
                return;
            }

            throw new WorkOrderBoardValidationException("NotFound", "Work order not found.");
        }

        private static void EnsureAuthenticated(
            ClaimsPrincipal user,
            string? actorId,
            string? forbiddenMessage = null)
        {
            if (user is null
                || !(user.Identity?.IsAuthenticated ?? false)
                || string.IsNullOrWhiteSpace(actorId))
            {
                throw Forbidden(forbiddenMessage);
            }
        }

        private static bool IsStaff(ClaimsPrincipal user)
            => StaffRoles.Any(user.IsInRole);

        private static WorkOrderBoardValidationException Forbidden(string? message = null)
            => new(
                "Forbidden",
                message ?? "You are not allowed to mutate work order media.");
    }
}