RBAC & Contrôle d'Accès

// src/lib/services/access-control.ts
// Hiérarchie des rôles avec poids numérique
const roleWeight: Record = {
  viewer: 1,
  editor: 2,
  admin:  3,
  owner:  4,
};

// Vérification : Le rôle satisfait-il le niveau requis ?
export function roleSatisfies(
  role: ProjectRole | null, 
  required: RequiredRole
): boolean {
  if (!role) return false;
  return roleWeight[role] >= roleWeight[required];
}

// Résolution du rôle effectif (Owner > Team Member)
export async function getProjectRole(
  supabase, projectId, userId
): Promise {
  // 1. Vérifier si l'utilisateur est le propriétaire
  const { data: project } = await supabase
    .from("projects").select("owner_id")
    .eq("id", projectId).maybeSingle();

  if (project?.owner_id === userId) return "owner";

  // 2. Sinon, chercher dans team_members (actif uniquement)
  const { data: member } = await supabase
    .from("team_members")
    .select("role, status")
    .eq("project_id", projectId)
    .eq("member_user_id", userId)
    .eq("status", "active")  // ← Seulement les membres actifs
    .maybeSingle();

  return member?.role || null; // "admin" | "editor" | "viewer"
}

// Exemple : Protection d'une route de suppression
// src/app/api/connections/[id]/route.ts
export async function DELETE(req: Request, { params }) {
  const supabase = await createClient();
  const userId = await getAuthenticatedUserId(supabase);
  
  // Vérification RBAC : Admin ou Owner requis pour supprimer
  const canDelete = await userCanAccessProject(
    supabase, projectId, userId, "admin" // ← niveau minimum requis
  );

  if (!canDelete) {
    return NextResponse.json(
      { error: "Insufficient permissions. Admin role required." },
      { status: 403 }
    );
  }
  // ... exécution de la suppression
}

// src/lib/audit.ts — Service d'audit centralisé
export async function recordAuditEvent({
  supabase,
  projectId,
  userId,
  action,       // ex: "query.execute", "backup.create", "member.invite"
  entityType,   // ex: "database_connection", "automation", "dashboard"
  entityId,
  metadata,
}: AuditEventParams) {
  await supabase.from("audit_events").insert({
    project_id: projectId,
    user_id: userId,
    action,
    entity_type: entityType,
    entity_id: entityId,
    metadata,
    created_at: new Date().toISOString(),
  });
}

-- Migration: 20250412121100_dixx_rls_database_connections_team_rbac.sql
-- Politique RLS sur database_connections

-- Lecture : propriétaire du projet OU membre actif
CREATE POLICY "connections_select_team"
ON public.database_connections FOR SELECT
USING (
  project_id IN (
    SELECT p.id FROM projects p WHERE p.owner_id = auth.uid()
    UNION
    SELECT tm.project_id FROM team_members tm
    WHERE tm.member_user_id = auth.uid() AND tm.status = 'active'
  )
);

-- Écriture : propriétaire du projet OU admin de l'équipe
CREATE POLICY "connections_insert_owner_or_admin"
ON public.database_connections FOR INSERT
WITH CHECK (
  project_id IN (
    SELECT p.id FROM projects p WHERE p.owner_id = auth.uid()
    UNION
    SELECT tm.project_id FROM team_members tm
    WHERE tm.member_user_id = auth.uid() 
    AND tm.role IN ('admin') AND tm.status = 'active'
  )
);

// src/lib/crypto.ts (AES-256 encryption)
import crypto from "crypto";

const ENCRYPTION_KEY = process.env.ENCRYPTION_KEY!; // 32 bytes hex

export function encrypt(plainText: string): string {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv(
    "aes-256-cbc",
    Buffer.from(ENCRYPTION_KEY, "hex"),
    iv
  );
  const encrypted = Buffer.concat([
    cipher.update(Buffer.from(plainText, "utf8")),
    cipher.final(),
  ]);
  return iv.toString("hex") + ":" + encrypted.toString("hex");
}

export function decrypt(encryptedText: string): string {
  const [ivHex, encryptedHex] = encryptedText.split(":");
  const iv = Buffer.from(ivHex, "hex");
  const decipher = crypto.createDecipheriv(
    "aes-256-cbc",
    Buffer.from(ENCRYPTION_KEY, "hex"),
    iv
  );
  return Buffer.concat([
    decipher.update(Buffer.from(encryptedHex, "hex")),
    decipher.final(),
  ]).toString("utf8");
}