Move webhook operations to service resource

messaging/internal/service/access_control.go

@@ -62,6 +62,22 @@ func (svc accessControl) CanCreateGroupChannel(ctx context.Context) bool {
 	return svc.can(ctx, types.MessagingPermissionResource, "channel.group.create", permissions.Allowed)
 }
 
+func (svc accessControl) CanCreateWebhook(ctx context.Context) bool {
+	return svc.can(ctx, types.MessagingPermissionResource, "webhook.create")
+}
+
+func (svc accessControl) CanManageWebhooks(ctx context.Context) bool {
+	return svc.can(ctx, types.MessagingPermissionResource, "webhook.manage.all")
+}
+
+func (svc accessControl) CanManageOwnWebhooks(ctx context.Context, wh *types.Webhook) bool {
+	if wh.UserID != auth.GetIdentityFromContext(ctx).Identity() {
+		return false
+	}
+
+	return svc.can(ctx, types.MessagingPermissionResource, "webhook.manage.own")
+}
+
 func (svc accessControl) CanUpdateChannel(ctx context.Context, ch *types.Channel) bool {
 	return svc.can(ctx, ch, "update", svc.isChannelOwnerFallback(ctx, ch))
 }
@@ -98,14 +114,6 @@ func (svc accessControl) CanManageChannelMembers(ctx context.Context, ch *types.
 	return svc.can(ctx, ch, "members.manage", svc.isChannelOwnerFallback(ctx, ch))
 }
 
-func (svc accessControl) CanManageWebhooks(ctx context.Context, webhook *types.Webhook) bool {
-	return svc.can(ctx, webhook, "webhook.manage.all")
-}
-
-func (svc accessControl) CanManageOwnWebhooks(ctx context.Context, webhook *types.Webhook) bool {
-	return svc.can(ctx, webhook, "webhook.manage.own")
-}
-
 func (svc accessControl) CanManageChannelAttachments(ctx context.Context, ch *types.Channel) bool {
 	return svc.can(ctx, ch, "attachments.manage")
 }
@@ -209,7 +217,6 @@ func (svc accessControl) DefaultRules() permissions.RuleSet {
 	var (
 		messaging = types.MessagingPermissionResource
 		channels  = types.ChannelPermissionResource.AppendWildcard()
-		webhooks  = types.WebhookPermissionResource.AppendWildcard()
 
 		allowAdm = func(res permissions.Resource, op permissions.Operation) *permissions.Rule {
 			return &permissions.Rule{
@@ -228,6 +235,9 @@ func (svc accessControl) DefaultRules() permissions.RuleSet {
 		allowAdm(messaging, "channel.public.create"),
 		allowAdm(messaging, "channel.private.create"),
 		allowAdm(messaging, "channel.group.create"),
+		allowAdm(messaging, "webhook.create"),
+		allowAdm(messaging, "webhook.manage.all"),
+		allowAdm(messaging, "webhook.manage.own"),
 
 		allowAdm(channels, "update"),
 		allowAdm(channels, "leave"),
@@ -249,8 +259,5 @@ func (svc accessControl) DefaultRules() permissions.RuleSet {
 		allowAdm(channels, "message.send"),
 		allowAdm(channels, "message.reply"),
 		allowAdm(channels, "message.react"),
-
-		allowAdm(webhooks, "webhook.manage.all"),
-		allowAdm(webhooks, "webhook.manage.own"),
 	}
 }

messaging/internal/service/webhook.go

@@ -36,7 +36,8 @@ type (
 	}
 
 	webhookAccessController interface {
-		CanManageWebhooks(context.Context, *types.Webhook) bool
+		CanCreateWebhook(context.Context) bool
+		CanManageWebhooks(context.Context) bool
 		CanManageOwnWebhooks(context.Context, *types.Webhook) bool
 	}
 
@@ -98,7 +99,7 @@ func (svc webhook) Create(kind types.WebhookKind, channelID uint64, params types
 		OutgoingURL:     params.OutgoingURL,
 	}
 
-	if !svc.ac.CanManageWebhooks(svc.ctx, webhook) && !svc.ac.CanManageOwnWebhooks(svc.ctx, webhook) {
+	if !svc.ac.CanCreateWebhook(svc.ctx) {
 		return nil, errors.WithStack(ErrNoPermissions)
 	}
 
@@ -126,13 +127,12 @@ func (svc webhook) Create(kind types.WebhookKind, channelID uint64, params types
 }
 
 func (svc webhook) Update(webhookID uint64, kind types.WebhookKind, channelID uint64, params types.WebhookRequest) (*types.Webhook, error) {
-	var userID = repository.Identity(svc.ctx)
 	webhook, err := svc.Get(webhookID)
 	if err != nil {
 		return nil, err
 	}
 
-	if !svc.ac.CanManageWebhooks(svc.ctx, webhook) && !(webhook.OwnerUserID == userID && svc.ac.CanManageOwnWebhooks(svc.ctx, webhook)) {
+	if !svc.ac.CanManageOwnWebhooks(svc.ctx, webhook) || !svc.ac.CanManageWebhooks(svc.ctx) {
 		return nil, errors.WithStack(ErrNoPermissions)
 	}
 
@@ -166,7 +166,7 @@ func (svc webhook) Delete(webhookID uint64) error {
 	if err != nil {
 		return err
 	}
-	if svc.ac.CanManageWebhooks(svc.ctx, webhook) {
+	if !svc.ac.CanManageOwnWebhooks(svc.ctx, webhook) || !svc.ac.CanManageWebhooks(svc.ctx) {
 		return svc.webhook.Delete(webhookID)
 	}
 	var userID = repository.Identity(svc.ctx)