src/security/LevelBasedPermissionManager.ts

/*
 * This file is part of SudoBot.
 *
 * Copyright (C) 2021-2023 OSN Developers.
 *
 * SudoBot is free software; you can redistribute it and/or modify it
 * under the terms of the GNU Affero General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * SudoBot is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with SudoBot. If not, see <https://www.gnu.org/licenses/>.
 */

import { PermissionLevel } from "@prisma/client";
import { GuildMember, PermissionsBitField, PermissionsString, Snowflake } from "discord.js";
import { GetMemberPermissionInGuildResult } from "../services/PermissionManager";
import AbstractPermissionManager from "./AbstractPermissionManager";
import { log, logInfo } from "../utils/Logger";
import { isSystemAdmin } from "../utils/utils";

export default class LevelBasedPermissionManager extends AbstractPermissionManager {
    protected cache: Record<`${Snowflake}_${"r" | "u"}_${Snowflake}`, PermissionLevel> = {};

    async sync() {
        const levels = await this.client.prisma.permissionLevel.findMany();

        this.cache = {};

        for (const level of levels) {
            for (const roleId of level.roles) {
                this.cache[`${level.guildId}_r_${roleId}`] = level;
            }

            for (const userId of level.users) {
                this.cache[`${level.guildId}_u_${userId}`] = level;
            }
        }

        logInfo(`[${this.constructor.name}] Synchronized permission levels`);
    }

    shouldModerate(member: GuildMember, moderator: GuildMember) {
        const memberLevel = this.getPermissionLevel(member);
        const moderatorLevel = this.getPermissionLevel(moderator);

        if (memberLevel >= moderatorLevel) {
            log("Member has higher/equal permission level than moderator");
            return false;
        }

        return true;
    }

    /**
     * TODO: Introduce a configuration option that allows to specify a permission level that is immune to automod
     */
    isImmuneToAutoMod(member: GuildMember) {
        const level = this.getPermissionLevel(member);
        return level === 100;
    }

    protected getMemberPermissionsFromHighestLevel(member: GuildMember, level: number) {
        const permissions = new PermissionsBitField();

        for (const key in this.cache) {
            if (!key.startsWith(`${member.guild.id}_r`)) {
                continue;
            }

            const entry = this.cache[key as keyof typeof this.cache];

            if (entry.level > level) {
                continue;
            }

            for (const permission of entry.grantedPermissions) {
                permissions.add(permission as PermissionsString);
            }
        }

        return permissions;
    }

    getPermissionLevel(member: GuildMember) {
        if (member.guild.ownerId === member.user.id || isSystemAdmin(this.client, member.user.id)) {
            return 100;
        }

        let level = this.cache[`${member.guild.id}_u_${member.id}`]?.level ?? 0;

        for (const roleId of member.roles.cache.keys()) {
            if (this.cache[`${member.guild.id}_r_${roleId}`]) {
                if (level < this.cache[`${member.guild.id}_r_${roleId}`].level) {
                    level = this.cache[`${member.guild.id}_r_${roleId}`].level;
                }
            }
        }

        return level;
    }

    getMemberPermissions(member: GuildMember, mergeWithDiscordPermissions = true): GetMemberPermissionInGuildResult {
        const level = this.getPermissionLevel(member);
        const permissions = this.getMemberPermissionsFromHighestLevel(member, level);

        if (mergeWithDiscordPermissions) {
            for (const permission of member.permissions.toArray()) {
                permissions.add(permission);
            }
        }

        for (const permission of this.cache[`${member.guild.id}_u_${member.id}`]?.grantedPermissions ?? []) {
            permissions.add(permission as PermissionsString);
        }

        return {
            type: "levels",
            permissions,
            level
        };
    }
}
1	/*
2	* This file is part of SudoBot.
3	*
4	* Copyright (C) 2021-2023 OSN Developers.
5	*
6	* SudoBot is free software; you can redistribute it and/or modify it
7	* under the terms of the GNU Affero General Public License as published by
8	* the Free Software Foundation, either version 3 of the License, or
9	* (at your option) any later version.
10	*
11	* SudoBot is distributed in the hope that it will be useful, but
12	* WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14	* GNU Affero General Public License for more details.
15	*
16	* You should have received a copy of the GNU Affero General Public License
17	* along with SudoBot. If not, see <https://www.gnu.org/licenses/>.
18	*/
19
20	import { PermissionLevel } from "@prisma/client";
21	import { GuildMember, PermissionsBitField, PermissionsString, Snowflake } from "discord.js";
22	import { GetMemberPermissionInGuildResult } from "../services/PermissionManager";
23	import AbstractPermissionManager from "./AbstractPermissionManager";
24	import { log, logInfo } from "../utils/Logger";
25	import { isSystemAdmin } from "../utils/utils";
26
27	export default class LevelBasedPermissionManager extends AbstractPermissionManager {
28	protected cache: Record<`${Snowflake}_${"r" \| "u"}_${Snowflake}`, PermissionLevel> = {};
29
30	async sync() {
31	const levels = await this.client.prisma.permissionLevel.findMany();
32
33	this.cache = {};
34
35	for (const level of levels) {
36	for (const roleId of level.roles) {
37	this.cache[`${level.guildId}_r_${roleId}`] = level;
38	}
39
40	for (const userId of level.users) {
41	this.cache[`${level.guildId}_u_${userId}`] = level;
42	}
43	}
44
45	logInfo(`[${this.constructor.name}] Synchronized permission levels`);
46	}
47
48	shouldModerate(member: GuildMember, moderator: GuildMember) {
49	const memberLevel = this.getPermissionLevel(member);
50	const moderatorLevel = this.getPermissionLevel(moderator);
51
52	if (memberLevel >= moderatorLevel) {
53	log("Member has higher/equal permission level than moderator");
54	return false;
55	}
56
57	return true;
58	}
59
60	/**
61	* TODO: Introduce a configuration option that allows to specify a permission level that is immune to automod
62	*/
63	isImmuneToAutoMod(member: GuildMember) {
64	const level = this.getPermissionLevel(member);
65	return level === 100;
66	}
67
68	protected getMemberPermissionsFromHighestLevel(member: GuildMember, level: number) {
69	const permissions = new PermissionsBitField();
70
71	for (const key in this.cache) {
72	if (!key.startsWith(`${member.guild.id}_r`)) {
73	continue;
74	}
75
76	const entry = this.cache[key as keyof typeof this.cache];
77
78	if (entry.level > level) {
79	continue;
80	}
81
82	for (const permission of entry.grantedPermissions) {
83	permissions.add(permission as PermissionsString);
84	}
85	}
86
87	return permissions;
88	}
89
90	getPermissionLevel(member: GuildMember) {
91	if (member.guild.ownerId === member.user.id \|\| isSystemAdmin(this.client, member.user.id)) {
92	return 100;
93	}
94
95	let level = this.cache[`${member.guild.id}_u_${member.id}`]?.level ?? 0;
96
97	for (const roleId of member.roles.cache.keys()) {
98	if (this.cache[`${member.guild.id}_r_${roleId}`]) {
99	if (level < this.cache[`${member.guild.id}_r_${roleId}`].level) {
100	level = this.cache[`${member.guild.id}_r_${roleId}`].level;
101	}
102	}
103	}
104
105	return level;
106	}
107
108	getMemberPermissions(member: GuildMember, mergeWithDiscordPermissions = true): GetMemberPermissionInGuildResult {
109	const level = this.getPermissionLevel(member);
110	const permissions = this.getMemberPermissionsFromHighestLevel(member, level);
111
112	if (mergeWithDiscordPermissions) {
113	for (const permission of member.permissions.toArray()) {
114	permissions.add(permission);
115	}
116	}
117
118	for (const permission of this.cache[`${member.guild.id}_u_${member.id}`]?.grantedPermissions ?? []) {
119	permissions.add(permission as PermissionsString);
120	}
121
122	return {
123	type: "levels",
124	permissions,
125	level
126	};
127	}
128	}