tududi/backend/services/applyPerms.js

const { sequelize } = require('../models');

function maxAccess(a, b) {
    if (a === 'rw' || b === 'rw') return 'rw';
    if (a === 'ro' || b === 'ro') return 'ro';
    return 'none';
}

async function applyPerms(tx, changes) {
    const { Permission } = require('../models');
    const upserts = changes.upserts || [];
    const deletes = changes.deletes || [];

    // Upserts: for SQLite we can emulate ON CONFLICT with find+create/update in tx
    for (const u of upserts) {
        const where = {
            user_id: u.userId,
            resource_type: u.resourceType,
            resource_uid: u.resourceUid,
        };
        const existing = await Permission.findOne({
            where,
            transaction: tx,
            lock: tx.LOCK.UPDATE,
        });
        if (existing) {
            const nextLevel = maxAccess(existing.access_level, u.accessLevel);
            await existing.update(
                {
                    access_level: nextLevel,
                    propagation: u.propagation || existing.propagation,
                    granted_by_user_id: u.grantedByUserId,
                    source_action_id:
                        u.sourceActionId || existing.source_action_id || null,
                },
                { transaction: tx }
            );
        } else {
            await Permission.create(
                {
                    user_id: u.userId,
                    resource_type: u.resourceType,
                    resource_uid: u.resourceUid,
                    access_level: u.accessLevel,
                    propagation: u.propagation || 'direct',
                    granted_by_user_id: u.grantedByUserId,
                    source_action_id: u.sourceActionId || null,
                },
                { transaction: tx }
            );
        }
    }

    // Deletes
    for (const d of deletes) {
        await Permission.destroy({
            where: {
                user_id: d.userId,
                resource_type: d.resourceType,
                resource_uid: d.resourceUid,
            },
            transaction: tx,
        });
    }
}

module.exports = { applyPerms };