feat: support team-based scope for sharing services (#258)

* feat: sharing services handle team related filters

* chore: update docs

* chore: update terms query util

* Update modules/security/share/service.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update modules/security/share/service.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* chore: add util.mapstr for parameter get utils

* chore: fix team filter for document search

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: medcl

core/orm/query.go

@@ -306,17 +306,11 @@ func MultiMatchQuery(fields []string, value interface{}) *Clause {
 	return newLeaf(strings.Join(fields, ","), QueryMultiMatch, value)
 }
 
-func TermQuery(field string, value interface{}) *Clause {
+func TermQuery[T comparable](field string, value T) *Clause {
 	return newLeaf(field, QueryTerm, value)
 }
 
-// TermsQuery creates a terms query clause from a generic slice
-func TermsQuery[T any](field string, value []T) *Clause {
-	// Convert []T to []interface{}
-	values := make([]interface{}, len(value))
-	for i, v := range value {
-		values[i] = v
-	}
+func TermsQuery[T comparable](field string, values []T) *Clause {
 	return newLeaf(field, QueryTerms, values)
 }
 

core/param/parameter.go

@@ -658,6 +658,13 @@ func (para *Parameters) GetArray(key ParaKey) ([]interface{}, bool) {
 		return s, ok
 	}
 
+	if s8, ok := v.(util.MapStr); ok {
+		for _, v1 := range s8 {
+			s = append(s, v1)
+		}
+		return s, ok
+	}
+
 	//TODO handle rest types
 	log.Warnf("parameters failed to GetArray, key: %v, type: %v", key, reflect.TypeOf(v))
 

docs/content.en/docs/release-notes/_index.md

@@ -11,6 +11,8 @@ Information about release notes of INFINI Framework is provided here.
 ## Latest (In development)  
 ### ❌ Breaking changes  
 ### 🚀 Features  
+- feat: support team-based scope for sharing services #258
+
 ### 🐛 Bug fix  
 ### ✈️ Improvements  
 

modules/security/orm_hooks/hooks.go

@@ -56,7 +56,7 @@ func init() {
 				}
 
 				resourceType := ctx.MustGetString(orm.SharingResourceType)
-				per, err := sharingService.GetUserExplicitEffectivePermission(userID, share.NewResourceEntity(resourceType, o1.GetID(), ""))
+				per, err := sharingService.GetUserExplicitEffectivePermission(sessionUser, share.NewResourceEntity(resourceType, o1.GetID(), ""))
 				if err == nil {
 					log.Debug("get permission: ", resourceType, ",", o1.GetID(), " => ", per)
 					if op == orm.OpGet && per >= 1 {
@@ -65,7 +65,7 @@ func init() {
 				}
 
 				if ctx.GetBool(orm.SharingCategoryCheckingChildrenEnabled, false) {
-					per, err := sharingService.GetCategoryVisibleWithChildrenSharedObjects(userID, resourceType, o1.GetID())
+					per, err := sharingService.GetCategoryVisibleWithChildrenSharedObjects(sessionUser, resourceType, o1.GetID())
 					if err == nil {
 						if op == orm.OpGet && per >= 1 {
 							log.Debugf("the resource is category,and children are with %v permission, allow to read access", per)
@@ -142,7 +142,7 @@ func init() {
 					shareEntity.ResourceParentPath = ctx.MustGetString(orm.SharingResourceParentPath)
 				}
 
-				per, err := sharingService.GetUserExplicitEffectivePermission(userID, shareEntity)
+				per, err := sharingService.GetUserExplicitEffectivePermission(sessionUser, shareEntity)
 				if err == nil {
 					log.Debug("get permission: ", resourceType, ",", o1.GetID(), " => ", per)
 					if op == orm.OpGet && per >= 1 {
@@ -151,7 +151,7 @@ func init() {
 				}
 
 				if ctx.GetBool(orm.SharingCategoryCheckingChildrenEnabled, false) {
-					per, err := sharingService.GetCategoryVisibleWithChildrenSharedObjects(userID, resourceType, o1.GetID())
+					per, err := sharingService.GetCategoryVisibleWithChildrenSharedObjects(sessionUser, resourceType, o1.GetID())
 					if err == nil {
 						if op == orm.OpGet && per >= 1 {
 							log.Debug("the resource is category,and children are with share permission, allow to read access")
@@ -248,7 +248,7 @@ func init() {
 					shareEntity.ResourceCategoryID = ctx.MustGetString(orm.SharingResourceCategoryID)
 					shareEntity.ResourceParentPath = ctx.MustGetString(orm.SharingResourceParentPath)
 				}
-				per, err := sharingService.GetUserExplicitEffectivePermission(userID, shareEntity)
+				per, err := sharingService.GetUserExplicitEffectivePermission(sessionUser, shareEntity)
 				if err == nil {
 					log.Debug("get permission: ", resourceType, ",", o1.GetID(), " => ", per)
 					if per >= 4 {
@@ -324,8 +324,8 @@ func init() {
 
 					//check if the current user have access to this resource
 					log.Trace("check if the current user have access to this resource")
-					perm, err := sharingService.GetUserExplicitEffectivePermission(userID, share.NewResourceEntity(resourceCategoryType, resourceCategoryID, ""))
-					log.Trace("user have access to this parent object", perm, err)
+					perm, err := sharingService.GetUserExplicitEffectivePermission(sessionUser, share.NewResourceEntity(resourceCategoryType, resourceCategoryID, ""))
+					log.Error("user have access to this parent object", perm, err)
 					if err == nil {
 						//TODO, not right permission, just 403
 						//self or not inherit any permission, we should throw a permission error
@@ -337,7 +337,7 @@ func init() {
 					}
 				} else {
 					//for none-documents search
-					ids, err := sharingService.GetResourceIDsByResourceTypeAndUserID(sessionUser, resourceType)
+					ids, err := sharingService.GetResourceIDsByResourceTypeForUser(sessionUser, resourceType)
 					log.Debug("user have access to this parent object", ids, err)
 					if err == nil {
 						//TODO, not permission, just 403
@@ -356,7 +356,7 @@ func init() {
 						//we are search files in specify folder/path
 						//check if the current user have access to this filtered path
 						var rules []share.SharingRecord
-						rules, _ = share.GetSharingRules(security.PrincipalTypeUser, userID, resourceType, "", resourceParentPath, globalShareMustFilters)
+						rules, _ = share.GetSharingRules(sessionUser, resourceType, "", resourceParentPath, globalShareMustFilters)
 						log.Trace("get all shared rules: ", resourceParentPath, ",type:", resourceType, " => ", util.MustToJSON(rules))
 
 						if len(rules) > 0 {
@@ -428,7 +428,8 @@ func init() {
 						}
 					} else {
 						var rules []share.SharingRecord
-						rules, _ = share.GetSharingRules(security.PrincipalTypeUser, userID, resourceType, "", resourceParentPath, globalShareMustFilters)
+						rules, _ = share.GetSharingRules(sessionUser, resourceType, "", resourceParentPath, globalShareMustFilters)
+						log.Error("user have access to this parent object", util.MustToJSON(rules))
 						if len(rules) > 0 {
 							allowedIDs := []string{}
 							allowedFolderPaths := []string{}
@@ -500,7 +501,7 @@ func init() {
 				if ctx.GetBool(orm.SharingCategoryCheckingChildrenEnabled, false) {
 					//eg: get datasource list by find out which doc was shared to you
 					log.Debug("this is a category, filter out by child shared rules")
-					vids, _ := sharingService.GetCategoryObjectFromSharedObjects(userID, resourceType)
+					vids, _ := sharingService.GetCategoryObjectFromSharedObjects(sessionUser, resourceType)
 					log.Trace("get shared ids via children: ", resourceType, " => ", vids)
 					if len(vids) > 0 {
 						bq.ShouldClauses = append(bq.ShouldClauses, orm.TermsQuery("id", vids))

modules/security/share/api.go

@@ -5,11 +5,12 @@
 package share
 
 import (
+	"net/http"
+
 	"infini.sh/framework/core/api"
 	httprouter "infini.sh/framework/core/api/router"
 	"infini.sh/framework/core/orm"
 	"infini.sh/framework/core/security"
-	"net/http"
 )
 
 type APIHandler struct {
@@ -24,12 +25,16 @@ func (h APIHandler) batchGetShares(w http.ResponseWriter, req *http.Request, ps
 	ctx := orm.NewContextWithParent(req.Context())
 	service := NewSharingService()
 
-	docs, err := service.BatchGetShares(ctx, "", obj)
+	docs, err := service.BatchGetShares(ctx, nil, obj)
 	if err != nil {
 		h.WriteError(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
 
+	user := security.MustGetUserFromContext(ctx.Context)
+
+	docs = service.MergeWithTeamRules(user, docs)
+
 	h.WriteJSON(w, docs, 200)
 }
 

modules/security/share/core.go

@@ -6,6 +6,7 @@ package share
 
 import (
 	"fmt"
+
 	"infini.sh/framework/core/orm"
 )
 
@@ -18,11 +19,15 @@ type SharingRecord struct {
 	ResourceIsFolder    bool   `json:"resource_is_folder,omitempty" elastic_mapping:"resource_is_folder:{type:boolean}"`       //eg: the resource is a folder, means we are sharing a folder
 	PathPattern         string `json:"path_pattern,omitempty" elastic_mapping:"path_pattern:{type:keyword}"`                   // e.g., "/documents/*" for wildcards
 	Recursive           bool   `json:"recursive,omitempty" elastic_mapping:"recursive:{type:boolean}"`                         // Apply to sub-paths
-	InheritedFrom       string `json:"inherited_from,omitempty" elastic_mapping:"inherited_from:{type:keyword}"`               // Parent share ID
+	InheritedType       string `json:"inherited_type,omitempty" elastic_mapping:"inherited_type:{type:keyword}"`               // Inherited type
+	InheritedFrom       string `json:"inherited_from,omitempty" elastic_mapping:"inherited_from:{type:keyword}"`               // Inherited from ID
 	InheritedFromFolder string `json:"inherited_from_folder,omitempty" elastic_mapping:"inherited_from_folder:{type:keyword}"` // Parent share ID
 	Via                 string `json:"via,omitempty" elastic_mapping:"via:{type:keyword}"`                                     // via: direct / inherit
 }
 
+const InheritedTypeTeam = "team"
+const InheritedTypeParentFolder = "parent_folder"
+
 const ViaInherit = "inherit"
 
 type SimplifySharingRecord struct {