mirror of
https://github.com/saltbo/zpan.git
synced 2026-09-24 23:22:31 +08:00
Jasper VanandClaude Opus 4.8
8abca2f88c
Collapse the two error conventions (string-reason `{ok:false,reason}` outcomes
and thrown domain-error classes) onto one. Usecases now produce typed `AppError`
values via factories (`notFound()`/`quotaExceeded()`/`featureBlocked()`/…);
handlers `throw result.error`; and `jsonError` (renamed from `renderError`) is the
single place that renders any error to an AIP-193 body + access-log line, in
`app.onError`/accessLog.
Why: the previous setup had a string→code mapping (`outcomeError` + the `OUTCOME`
table) living in parallel with a type→code mapping (`mapDomainError`), plus inline
`apiError(c, <status>, …)` calls that hand-wrote the status at every site — exactly
the drift that left the same `quota_exceeded` at 400 in one handler and 422 in the
rest. Now the status/reason live once, in the factory.
- Add `server/usecases/ports/app-error.ts`: `AppError` + factories. Status/reason
are baked in per factory, so no usecase or handler writes an HTTP code or a
magic-string reason. `AppError` also carries optional response headers
(`Retry-After`) via a `rateLimited()` factory.
- Delete `apiError`, `outcomeError`, the `OUTCOME` table, and the dead `ApiError`
class. The 67 inline guard/middleware `apiError` sites became `throw <factory>()`.
- Control-flow outcomes a handler branches on (not just renders) stay discriminated
reasons (e.g. `deleteObject` `not_trashed`); internal shared sub-usecases
(traffic-metering, licensing internals) keep string reasons, mapped at the boundary.
- Regenerate the Go OpenAPI client (saveShare gained a 422 response).
BREAKING CHANGE: POST /shares/{token}/objects quota rejection now returns 422
(was an inconsistent 400); every other quota path already returned 422.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
51 lines
1.5 KiB
TypeScript
51 lines
1.5 KiB
TypeScript
import { createMiddleware } from 'hono/factory'
|
|
import { forbidden, unauthorized } from '../usecases/ports'
|
|
import type { Env } from './platform'
|
|
|
|
const ROLE_LEVELS: Record<string, number> = {
|
|
owner: 3,
|
|
editor: 2,
|
|
viewer: 1,
|
|
member: 1,
|
|
}
|
|
|
|
export function requirePermission(
|
|
resource: string,
|
|
action: string,
|
|
opts: { minTeamRole?: 'viewer' | 'editor' | 'owner'; allowDownloader?: boolean } = {},
|
|
) {
|
|
return createMiddleware<Env>(async (c, next) => {
|
|
const principal = c.get('principal')
|
|
if (!principal) throw unauthorized('Unauthorized')
|
|
|
|
if (principal.kind === 'downloader') {
|
|
if (opts.allowDownloader) return next()
|
|
throw unauthorized('Unauthorized')
|
|
}
|
|
|
|
if (principal.kind === 'download-task-upload') throw unauthorized('Unauthorized')
|
|
|
|
if (principal.kind === 'api-key') {
|
|
if (!c.get('deps').apiKeys.hasApiKeyPermission(principal.permissions, resource, action)) {
|
|
throw forbidden('Forbidden')
|
|
}
|
|
return next()
|
|
}
|
|
|
|
const userId = c.get('userId')
|
|
if (!userId) throw unauthorized('Unauthorized')
|
|
if (!opts.minTeamRole) return next()
|
|
|
|
const orgId = c.get('orgId')
|
|
if (!orgId) throw unauthorized('Unauthorized')
|
|
|
|
const role = await c.get('deps').org.getMemberRole(orgId, userId)
|
|
if (role !== null) {
|
|
if ((ROLE_LEVELS[role] ?? 0) < ROLE_LEVELS[opts.minTeamRole]) throw forbidden('Forbidden')
|
|
return next()
|
|
}
|
|
if (await c.get('deps').org.isPersonalOrg(orgId)) return next()
|
|
throw forbidden('Forbidden')
|
|
})
|
|
}
|