Rewrite permission system

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/iam/authorizer.go

@@ -0,0 +1,156 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package iam
+
+import (
+	"context"
+	"errors"
+	"maps"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/iam/policy"
+)
+
+// Authorizer handles authorization using the policy engine.
+type Authorizer struct {
+	pg        *pg.Client
+	evaluator *policy.Evaluator
+	policySet *PolicySet
+}
+
+// NewAuthorizer creates a new authorizer with the given PolicySet.
+// The PolicySet should contain all role-based and self-management policies
+// from all services that need authorization.
+//
+// Example:
+//
+//	policySet := iam.IAMPolicySet().
+//	    Merge(documents.DocumentPolicySet()).
+//	    Merge(risks.RiskPolicySet())
+//	authorizer := iam.NewAuthorizer(pgClient, policySet)
+func NewAuthorizer(pgClient *pg.Client, policySet *PolicySet) *Authorizer {
+	return &Authorizer{
+		pg:        pgClient,
+		evaluator: policy.NewEvaluator(),
+		policySet: policySet,
+	}
+}
+
+// AuthorizeParams contains all parameters for an authorization check.
+type AuthorizeParams struct {
+	// Principal is the user requesting access.
+	Principal gid.GID
+
+	// Resource is the target resource.
+	Resource gid.GID
+
+	// Action is the operation being performed (e.g., "iam:organization:get").
+	Action string
+
+	// ResourceAttributes provides additional context for condition evaluation.
+	// Keys like "user_id", "owner_id" are used for self-management checks.
+	ResourceAttributes map[string]string
+}
+
+// Authorize checks if the principal can perform the action on the resource.
+// It combines self-management policies with role-based policies.
+func (a *Authorizer) Authorize(ctx context.Context, params AuthorizeParams) error {
+	// Validate principal type
+	if params.Principal.EntityType() != coredata.UserEntityType {
+		return NewUnsupportedPrincipalTypeError(params.Principal.EntityType())
+	}
+
+	// Build policies to evaluate
+	policies := a.buildPolicies(ctx, params)
+
+	// Build condition context
+	conditionCtx := policy.ConditionContext{
+		Principal: map[string]string{
+			"id": params.Principal.String(),
+		},
+		Resource: map[string]string{
+			"id": params.Resource.String(),
+		},
+	}
+
+	maps.Copy(conditionCtx.Resource, params.ResourceAttributes)
+
+	// Evaluate
+	req := policy.AuthorizationRequest{
+		Principal:        params.Principal,
+		Resource:         params.Resource,
+		Action:           params.Action,
+		ConditionContext: conditionCtx,
+	}
+
+	result := a.evaluator.Evaluate(req, policies)
+
+	if result.IsAllowed() {
+		return nil
+	}
+
+	if result.Decision == policy.DecisionDeny {
+		return NewInsufficientPermissionsError(params.Principal, params.Resource, params.Action)
+	}
+
+	// No match = implicit deny
+	return NewInsufficientPermissionsError(params.Principal, params.Resource, params.Action)
+}
+
+// buildPolicies constructs the list of policies to evaluate.
+// This includes self-management policies and role-based policies.
+func (a *Authorizer) buildPolicies(ctx context.Context, params AuthorizeParams) []*policy.Policy {
+	// Start with self-management policies
+	policies := make([]*policy.Policy, len(a.policySet.SelfManagePolicies))
+	copy(policies, a.policySet.SelfManagePolicies)
+
+	// For organization-scoped resources, add role-based policies
+	if params.Resource.TenantID() != gid.NilTenant {
+		rolePolicies := a.loadRolePolicies(ctx, params.Principal, params.Resource)
+		policies = append(policies, rolePolicies...)
+	}
+
+	return policies
+}
+
+// loadRolePolicies loads the role-based policies for a user in an organization.
+func (a *Authorizer) loadRolePolicies(ctx context.Context, principalID gid.GID, resourceID gid.GID) []*policy.Policy {
+	var roleName string
+
+	err := a.pg.WithConn(ctx, func(conn pg.Conn) error {
+		scope := coredata.NewScope(resourceID.TenantID())
+
+		var m coredata.Membership
+		if err := m.LoadRoleByUserAndEntityID(ctx, conn, scope, principalID, resourceID); err != nil {
+			if errors.Is(err, coredata.ErrResourceNotFound) {
+				return nil // No membership = no role-based policies
+			}
+			return err
+		}
+
+		roleName = m.Role.String()
+		return nil
+	})
+
+	if err != nil || roleName == "" {
+		// On error or no role, return empty policies (fail closed)
+		return nil
+	}
+
+	// Get policies for the user's role
+	return a.policySet.RolePolicies[roleName]
+}