feat: complete pet SOP governance workflow

internal/access/scenario.go

@@ -0,0 +1,51 @@
+package access
+
+import (
+	"git.iwork-ai.com/xdc/iqudo-top1/internal/auth"
+	"git.iwork-ai.com/xdc/iqudo-top1/internal/model"
+	"gorm.io/gorm"
+)
+
+func ScopeScenarios(query *gorm.DB, principal auth.Principal, alias string) *gorm.DB {
+	if auth.HasPermission(principal, "*") {
+		return query.Where(alias+".tenant_id = ?", principal.TenantID)
+	}
+	teamVisible := auth.HasPermission(principal, "scenario.team_view")
+	return query.Where(
+		alias+".tenant_id = ? AND ("+alias+".visibility = ? OR "+alias+".created_by = ? OR ("+alias+".visibility = ? AND ?))",
+		principal.TenantID, "tenant", principal.UserID, "team", teamVisible,
+	)
+}
+
+func CanViewScenario(db *gorm.DB, principal auth.Principal, scenarioID uint64) bool {
+	var count int64
+	query := ScopeScenarios(db.Model(&model.Scenario{}), principal, "scenarios")
+	if err := query.Where("scenarios.id = ? AND scenarios.status <> ?", scenarioID, "archived").Count(&count).Error; err != nil {
+		return false
+	}
+	return count == 1
+}
+
+func CanEditScenario(db *gorm.DB, principal auth.Principal, scenarioID uint64) bool {
+	if !auth.HasPermission(principal, "scenario.edit") && !auth.HasPermission(principal, "*") {
+		return false
+	}
+	return CanViewScenario(db, principal, scenarioID)
+}
+
+func CanViewSOP(db *gorm.DB, principal auth.Principal, sopID uint64) bool {
+	var count int64
+	query := db.Table("sops s").Joins("JOIN scenarios sc ON sc.id = s.scenario_id")
+	query = ScopeScenarios(query, principal, "sc")
+	if err := query.Where("s.id = ? AND s.tenant_id = ? AND s.status <> ?", sopID, principal.TenantID, "archived").Count(&count).Error; err != nil {
+		return false
+	}
+	return count == 1
+}
+
+func CanEditSOP(db *gorm.DB, principal auth.Principal, sopID uint64) bool {
+	if !auth.HasPermission(principal, "sop.edit") && !auth.HasPermission(principal, "*") {
+		return false
+	}
+	return CanViewSOP(db, principal, sopID)
+}