RBAC & Permissions Logic

class AuthService {

  /** Authenticate user — validate credentials + check lockout + audit */
  async authenticate(username, password) {
    const user = await User.findOne({ username });
    if (!user) { await this.auditLog(null, 'login', 'user_not_found'); throw new AuthError(); }
    if (user.is_locked) { await this.auditLog(user.user_id, 'login', 'account_locked'); throw new AccountLockedError(); }
    const valid = await bcrypt.compare(password, user.password_hash);
    if (!valid) {
      await this.incrementFailedAttempts(user.user_id);
      await this.auditLog(user.user_id, 'login', 'invalid_password');
      throw new AuthError();
    }
    await this.auditLog(user.user_id, 'login', 'success');
    return user;
  }

  /** Verify MFA — TOTP validation against user's mfa_config */
  async verifyMFA(userId, code) {
    const config = await MfaConfig.findOne({ user_id: userId, is_verified: true });
    if (!config) throw new MfaNotConfiguredError();
    const valid = totp.verify({ token: code, secret: config.secret });
    if (!valid) { await this.auditLog(userId, 'mfa', 'failed'); throw new MfaError(); }
    await this.auditLog(userId, 'mfa', 'success');
    return true;
  }

  /** Create session — JWT generation with entity/project claims */
  async createSession(userId) {
    const roles = await this.getEffectiveRoles(userId);
    const token = jwt.sign(
      { user_id: userId, roles: roles.map(r => r.role_code) },
      process.env.JWT_SECRET, { expiresIn: '8h' }
    );
    await UserSession.create({
      user_id: userId, token_hash: sha256(token),
      ip_address: req.ip, device_type: req.headers['user-agent'],
      expires_at: new Date(Date.now() + 8 * 3600000)
    });
    return token;
  }
}

class PermissionService {

  /** Core permission check — module.feature.action against user's effective permissions */
  async hasPermission(userId, module, feature, action, entityId, projectId) {
    const roles = await this.getEffectiveRoles(userId, entityId, projectId);
    const roleIds = roles.map(r => r.role_id);
    const perms = await RolePermission.findAll({
      role_id: { $in: roleIds },
      include: [{ model: Permission, where: { module, feature, action } }]
    });
    if (perms.length === 0) {
      await this.auditLog(userId, 'permission_denied', `${module}.${feature}.${action}`);
      return false;
    }
    return true;
  }

  /** Get effective roles — union of direct roles + delegated roles */
  async getEffectiveRoles(userId, entityId, projectId) {
    const now = new Date();
    // Direct roles scoped to entity/project
    const direct = await UserRole.findAll({
      user_id: userId,
      entity_id: { $in: [entityId, null] },
      project_id: { $in: [projectId, null] },
      valid_from: { $lte: now }, valid_to: { $gte: now }
    });
    // Delegated roles from active delegations
    const delegations = await Delegation.findAll({
      delegate_id: userId, valid_from: { $lte: now }, valid_to: { $gte: now }
    });
    const delegatedRoles = [];
    for (const d of delegations) {
      const roles = await UserRole.findAll({ user_id: d.delegator_id });
      delegatedRoles.push(...roles.filter(r => !d.module_scope || r.module === d.module_scope));
    }
    return [...direct, ...delegatedRoles];
  }

  /** Enforce password policy — complexity + history check */
  async enforcePasswordPolicy(userId, newPassword) {
    const policy = await PasswordPolicy.findOne({ is_active: true });
    if (newPassword.length < policy.min_length) throw new PolicyError('too_short');
    if (!/[A-Z]/.test(newPassword)) throw new PolicyError('needs_uppercase');
    if (!/[0-9]/.test(newPassword)) throw new PolicyError('needs_digit');
    if (!/[!@#$%]/.test(newPassword)) throw new PolicyError('needs_special');
    // Check password history (last 5 passwords)
    const history = await PasswordHistory.findAll({ user_id: userId, limit: 5 });
    for (const h of history) {
      if (await bcrypt.compare(newPassword, h.hash)) throw new PolicyError('reused');
    }
    return true;
  }
}

// Row-Level Security Middleware
function applyDataScope(query, user, scopeLevel) {
  // Always apply tenant isolation (mandatory)
  query.where.tenant_id = user.tenant_id;

  switch (scopeLevel) {
    case 'entity':
      query.where.entity_id = { $in: user.assigned_entity_ids };
      break;
    case 'department':
      query.where.department_id = user.department_id;
      break;
    case 'location':
      query.where.location_id = { $in: user.assigned_location_ids };
      break;
    case 'own':
      query.where.created_by = user.user_id;
      break;
    // 'all' = no additional filter (tenant scope only)
  }
  return query;
}

// Status-Based ACL Check
async function canTransition(userId, entityType, entityId, targetStatus) {
  const entity = await getEntity(entityType, entityId);
  const currentStatus = await StatusMaster.findById(entity.status_id);

  // Terminal status — no further transitions allowed
  if (currentStatus.is_terminal) return { allowed: false, reason: 'terminal_status' };

  // Check if transition is defined in state machine
  const transition = await StatusTransition.findOne({
    from_status_id: currentStatus.id,
    to_status_id: targetStatus.id,
    is_active: true
  });
  if (!transition) return { allowed: false, reason: 'invalid_transition' };

  // Verify user has required role for this transition
  const userRoles = await getUserRoleCodes(userId);
  if (!userRoles.includes(transition.required_role))
    return { allowed: false, reason: 'insufficient_role' };

  // Check if transition requires approval workflow
  if (transition.requires_approval)
    return { allowed: true, requires_approval: true };

  return { allowed: true, requires_approval: false };
}