[feat] Role and Permission system

deepwell/migrations/20220906103252_deepwell.sql

@@ -934,6 +934,77 @@ CREATE INDEX forum_post_parent_idx ON forum_post (parent_post_id);
 CREATE INDEX forum_post_latest_revision_idx ON forum_post (latest_revision_id);
 CREATE INDEX forum_post_revision_lookup_idx ON forum_post_revision (forum_post_id, revision_number DESC);
 
+--
+-- Role / permission system
+--
+
+-- Lookup table for permissions. This is shared across all sites.
+CREATE TABLE permission (
+    permission_id BIGSERIAL PRIMARY KEY,
+    description TEXT NOT NULL,
+    resource_type TEXT NOT NULL,
+    action TEXT NOT NULL,
+
+    UNIQUE (resource_type, action)
+);
+
+-- Roles in a site.
+CREATE TABLE role (
+    role_id BIGSERIAL PRIMARY KEY,
+
+    -- Denotes a unique role in a site. A user may be an admin in one site but a regular site member in another.
+    site_id BIGINT NOT NULL REFERENCES site(site_id),
+    name TEXT NOT NULL,
+    description TEXT NOT NULL,
+    from_wikidot BOOLEAN NOT NULL DEFAULT false,
+
+    -- Virtual roles are invisible to the user, granted by the system under specific conditions
+    -- i.e. Guest role granted when a non-member visits the site,
+    -- or Author role granted when a user interacts with a page they authored.
+    -- Virtual roles are visible to admins where they can select the role's permissions.
+    -- Virtual roles cannot be manually assigned.
+    is_virtual BOOLEAN NOT NULL DEFAULT false,
+
+    -- System roles cannot be deleted (i.e. Admin)
+    is_system BOOLEAN NOT NULL DEFAULT false,
+
+    -- Rudimentary role hierarchy.
+    -- Roles with higher level are granted more permissions than roles with lower levels.
+    -- Users with role management permissions can only grant roles with lower levels and affect users of lower levels.
+    level INTEGER NOT NULL CHECK (level >= 0),
+
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+    updated_at TIMESTAMP WITH TIME ZONE,
+    deleted_at TIMESTAMP WITH TIME ZONE,
+
+    UNIQUE (site_id, name)
+);
+
+-- Role permissions (many-to-many)
+CREATE TABLE role_permission (
+    role_id BIGINT NOT NULL REFERENCES role(role_id),
+    permission_id BIGINT NOT NULL REFERENCES permission(permission_id),
+    PRIMARY KEY (role_id, permission_id)
+);
+
+-- User role assignments (many-to-many)
+CREATE TABLE user_role (
+    user_id BIGINT NOT NULL REFERENCES "user"(user_id),
+    role_id BIGINT NOT NULL REFERENCES role(role_id),
+    -- Denormalized FK to avoid a join.
+    site_id BIGINT NOT NULL REFERENCES site(site_id),
+
+    assigned_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+    assigned_by BIGINT NOT NULL REFERENCES "user"(user_id),
+    expires_at TIMESTAMP WITH TIME ZONE,
+    deleted_at TIMESTAMP WITH TIME ZONE,
+    PRIMARY KEY (user_id, role_id)
+);
+
+-- Index for permission lookup.
+CREATE UNIQUE INDEX permission_resource_action_idx ON permission
+    (resource_type, action);
+
 --
 -- Audit Log
 --

deepwell/seeder/permissions.json

@@ -0,0 +1,42 @@
+[
+    {
+        "description": "Can view and read pages",
+        "resource-type": "page",
+        "action": "view"
+    },
+    {
+        "description": "Can edit existing pages",
+        "resource-type": "page",
+        "action": "edit"
+    },
+    {
+        "description": "Can create new pages",
+        "resource-type": "page",
+        "action": "create"
+    },
+    {
+        "description": "Can delete pages",
+        "resource-type": "page",
+        "action": "delete"
+    },
+    {
+        "description": "Can rename/move pages",
+        "resource-type": "page",
+        "action": "rename"
+    },
+    {
+        "description": "Can view role assignments",
+        "resource-type": "role",
+        "action": "view"
+    },
+    {
+        "description": "Can assign roles to users",
+        "resource-type": "role",
+        "action": "assign"
+    },
+    {
+        "description": "Can remove roles from users",
+        "resource-type": "role",
+        "action": "remove"
+    }
+]

deepwell/seeder/roles.json

@@ -0,0 +1,117 @@
+[
+    {
+        "name": "root",
+        "description": "Root user with full site permissions",
+        "is-virtual": false,
+        "is-system": true,
+        "level": 100,
+        "permissions": [
+            "page:view",
+            "page:edit",
+            "page:create",
+            "page:delete",
+            "page:rename",
+            "role:view",
+            "role:assign",
+            "role:remove"
+        ]
+    },
+    {
+        "name": "admin",
+        "description": "Site administrator with full control",
+        "is-virtual": false,
+        "is-system": false,
+        "level": 99,
+        "permissions": [
+            "page:view",
+            "page:edit",
+            "page:create",
+            "page:delete",
+            "page:rename",
+            "role:view",
+            "role:assign",
+            "role:remove"
+        ]
+    },
+    {
+        "name": "moderator",
+        "description": "Site moderator with full control over pages",
+        "is-virtual": false,
+        "is-system": false,
+        "level": 90,
+        "permissions": [
+            "page:view",
+            "page:edit",
+            "page:create",
+            "page:delete",
+            "role:view"
+        ]
+    },
+    {
+        "name": "member",
+        "description": "Regular site member",
+        "is-virtual": false,
+        "is-system": true,
+        "level": 10,
+        "permissions": [
+            "page:view",
+            "page:edit",
+            "page:create"
+        ]
+    },
+    {
+        "name": "guest",
+        "description": "Virtual role for all non-members, including registered and anonymous users.",
+        "is-virtual": true,
+        "is-system": true,
+        "level": 1,
+        "permissions": [
+            "page:view"
+        ]
+    },
+    {
+        "name": "registered",
+        "description": "Virtual role for registered and logged-in users.",
+        "is-virtual": true,
+        "is-system": true,
+        "level": 1,
+        "permissions": [
+            "page:view"
+        ]
+    },
+    {
+        "name": "anonymous",
+        "description": "Virtual role for unregistered or logged out users.",
+        "is-virtual": true,
+        "is-system": true,
+        "level": 1,
+        "permissions": [
+            "page:view"
+        ]
+    },
+    {
+        "name": "everyone",
+        "description": "Virtual role for all users, regardless of membership or registration status.",
+        "is-virtual": true,
+        "is-system": true,
+        "level": 1,
+        "permissions": [
+            "page:view"
+        ]
+    },
+    {
+        "name": "page-author",
+        "description": "Virtual role granted to the user when they visit a page that they authored, based on the page attribution metadata.",
+        "is-virtual": true,
+        "is-system": true,
+        "level": 1,
+        "permissions": [
+            "page:view",
+            "page:edit",
+            "page:create",
+            "page:delete",
+            "page:rename"
+        ]
+    }
+]
+

deepwell/seeder/users.json

@@ -104,5 +104,22 @@
             "demo",
             "demo-user"
         ]
+    },
+    {
+        "id": 6,
+        "type": "regular",
+        "name": "Guest",
+        "slug": "guest",
+        "email": "guest@wikijump",
+        "password": "guestuser1",
+        "locales": ["en"],
+        "real_name": "Guest",
+        "gender": null,
+        "birthday": null,
+        "location": "Everywhere and nowhere",
+        "biography": "Wikijump guest user",
+        "user_page": null,
+        "aliases": [
+        ]
     }
 ]

deepwell/src/api.rs

@@ -305,6 +305,7 @@ async fn build_module(app_state: ServerState) -> Result<RpcModule<ServerState>>
     register!("page_get_score", page_get_score);
     register!("page_get_files", page_get_files);
     register!("page_edit", page_edit);
+    register!("page_edit_permission", page_edit_permission);
     register!("page_delete", page_delete);
     register!("page_move", page_move);
     register!("page_rollback", page_rollback);

deepwell/src/database/seeder/data.rs

@@ -34,6 +34,8 @@ pub struct SeedData {
     pub pages: HashMap<String, Vec<Page>>,
     pub files: HashMap<String, HashMap<String, Vec<File>>>,
     pub filters: Vec<Filter>,
+    pub permissions: Vec<Permission>,
+    pub roles: Vec<Role>,
 }
 
 impl SeedData {
@@ -77,13 +79,23 @@ impl SeedData {
         let filters: Vec<Filter> =
             Self::load_json(&mut path, "filters").or_raise(make_error)?;
 
+        // Load permissions data (platform-wide)
+        let permissions: Vec<Permission> =
+            Self::load_json(&mut path, "permissions").or_raise(make_error)?;
+
+        // Load roles template
+        let roles: Vec<Role> =
+            Self::load_json(&mut path, "roles").or_raise(make_error)?;
+
         // Build and return
         Ok(SeedData {
             users,
             sites,
             pages: site_pages,
             files,
             filters,
+            permissions,
+            roles,
         })
     }
 
@@ -214,3 +226,22 @@ pub struct File {
     #[serde(default)]
     pub deleted: bool,
 }
+
+#[derive(Deserialize, Debug)]
+#[serde(rename_all = "kebab-case")]
+pub struct Permission {
+    pub description: String,
+    pub resource_type: String,
+    pub action: String,
+}
+
+#[derive(Deserialize, Debug)]
+#[serde(rename_all = "kebab-case")]
+pub struct Role {
+    pub name: String,
+    pub description: String,
+    pub is_virtual: bool,
+    pub is_system: bool,
+    pub level: i32,
+    pub permissions: Vec<String>,
+}