Typedef

async function getCurrentUserPolicy(req, res, meta) {
  if (meta.user) {
    // We already have fetched the user (i.e. this policy has probably already been run in this request).
    return
  }
  const authHeader = req.getHeader('Authorization')
  if (!authHeader) {
    throw new AutonymError(AutonymError.UNAUTHORIZED, 'You must be logged in to perform this action.')
  }

  const [, token] = authHeader.split('Bearer ')
  const data = await verify(token)
  // Save data on meta object, which will be accessible on subsequent policies and store methods.
  meta.user = await User.findOne(data.userId)
}

function canCreatePostPolicy(req, res, meta) {
  // Access the user object saved in the previous policy. Note: this means this policy is tightly coupled to the
  // getCurrentUserPolicy and will throw an error if it is used in isolation, which would by default return a 500
  // error. We *could* `await getCurrentUserPolicy(req, res, meta)` here if we wanted to use this policy alone.
  if (!meta.user.privileges.includes('createPost')) {
    throw new AutonymError(AutonymError.FORBIDDEN, 'You must have the createPost privilege to perform this action.')
  }
}

const Post = new Model({
  name: 'post',
  policies: {
    create: { and: [getCurrentUserPolicy, canCreatePostPolicy] },
  },
  store: {
    // Since the `getCurrentUserPolicy` was called before inserting, the `user` object is available in the store
    // methods. If calling the API programmatically, e.g. `Post.create()`, this data will need to be supplied
    // manually in the `create` method, since policies are not called when using the model instance directly.
    create: (data, meta) => Db.insert({ ...data, authorId: meta.user.id }),
  }
})

const Post = new Model({
  name: 'post',
  policies: {
    create: {
      // Users must be logged in and have the proper permission to create a post
      preSchema: { and: [getCurrentUserPolicy, canCreatePostPolicy] },
      // Once the post is validated, it is safe to read and manipulate the request data
      postSchema: trimPostBodyPolicy,
    },
    find: {
      // All requests to get all posts should include a header with the total count
      postStore: addTotalCountHeaderToResponsePolicy,
    },
    findOneAndUpdate: {
      // Users must be logged in and own the post that they are trying to update
      preSchema: { and: [getCurrentUserPolicy, userIsOwnerOfPostPolicy] },
      postSchema: trimPostBodyPolicy,
    },
    findOneAndDelete: {
      preStore: { and: [getCurrentUserPolicy, userIsOwnerOfPostPolicy] },
    },
  },
  store: {},
})

async function getCurrentUserPolicy(req, res, meta) {
  if (meta.user) {
    // We already have fetched the user (i.e. this policy has probably already been run in this request).
    return
  }
  const authHeader = req.getHeader('Authorization')
  if (!authHeader) {
    throw new AutonymError(AutonymError.UNAUTHORIZED, 'You must be logged in to perform this action.')
  }

  const [, token] = authHeader.split('Bearer ')
  const data = await verify(token)
  // Save data on meta object, which will be accessible on subsequent policies and store methods.
  meta.user = await User.findOne(data.userId)
}

function canCreatePostPolicy(req, res, meta) {
  // Access the user object saved in the previous policy. Note: this means this policy is tightly coupled to the
  // getCurrentUserPolicy and will throw an error if it is used in isolation, which would by default return a 500
  // error. We *could* `await getCurrentUserPolicy(req, res, meta)` here if we wanted to use this policy alone.
  if (!meta.user.privileges.includes('createPost')) {
    throw new AutonymError(AutonymError.FORBIDDEN, 'You must have the createPost privilege to perform this action.')
  }
}

function userIsOwnerOfPostPolicy(req, res, meta) {
  if (req.getId() !== req.meta.user.id) {
    throw new AutonymError(AutonymError.FORBIDDEN, 'You are not the owner of this post.')
  }
}

function trimPostBodyPolicy(req, res, meta) {
  // If this policy is in the postSchema hook, it is safe to get and set data.
  req.setData({ body: req.getData().body.trim() })
}

Post.count = () => Db.selectCount('posts')

async function addTotalCountHeaderToResponsePolicy(req, res, meta) {
  // If this policy is in the postStore hook, it is safe to get and modify the response data.

  const model = req.getModel()
  if (model.count) {
    const totalCount = await req.getModel().count()
    res.setHeader('X-Total-Count', totalCount)
  }
}

const Post = new Model({
  name: 'post',
  store: {
    create: data => Db.insert('posts', data),
    find: () => Db.selectAll('posts'),
    findOne: id => Db.selectOne('posts', { id }),
    findOneAndUpdate: (id, data) => Db.updateWhere('posts', { id }, data),
    findOneAndDelete: id => Db.deleteWhere('posts', { id }),

    // Column names are the same as properties on the data, but in snake-case
    serialize: data => mapKeys(data, property => snakeCase(property)),
    // Properties are the same as column names in the table, but in camel-case
    unserialize: data => mapKeys(data, columnName => camelCase(columnName)),
  },
})