Started work on new layered setup, making a huge mess.

internal/auth/permissions.go

@@ -11,6 +11,8 @@ func AllPermissions() map[string]string {
 		"channel.add":      "Can add channels",
 		"channel.edit":     "Can edit channels",
 		"channel.remove":   "Can remove channels",
+		"comment.edit":     "Can edit non-owned comments",
+		"comment.remove":   "Can remove non-owned comments",
 		"log.add":          "Can add logs",
 		"log.edit":         "Can edit logs",
 		"log.remove":       "Can remove logs",

internal/auth/permitted.go

@@ -0,0 +1,53 @@
+package auth
+
+import (
+	"context"
+	"reflect"
+
+	"git.aiterp.net/rpdata/api/models"
+)
+
+// CheckPermission does some magic.
+func CheckPermission(ctx context.Context, op string, obj interface{}) error {
+	token := TokenFromContext(ctx)
+	if token == nil {
+		return ErrUnauthenticated
+	}
+
+	if reflect.TypeOf(obj).Kind() != reflect.Ptr {
+		return CheckPermission(ctx, op, &obj)
+	}
+
+	var authorized = false
+
+	switch v := obj.(type) {
+	case *models.Channel:
+		authorized = token.Permitted("channel." + op)
+	case *models.Character:
+		authorized = token.PermittedUser(v.Author, "member", "character."+op)
+	case *models.Chapter:
+		authorized = token.PermittedUser(v.Author, "member", "chapter."+op)
+	case *models.Comment:
+		if op == "add" && v.Author != token.UserID {
+			return ErrInvalidOperation
+		}
+
+		authorized = token.PermittedUser(v.Author, "member", "comment."+op)
+	case *models.File:
+		authorized = token.PermittedUser(v.Author, "member", "file."+op)
+	case *models.Log:
+		authorized = token.Permitted("log." + op)
+	case *models.Post:
+		authorized = token.Permitted("post." + op)
+	case *models.Story:
+		authorized = token.PermittedUser(v.Author, "member", "story."+op)
+	case *models.User:
+		authorized = token.Permitted("user." + op)
+	}
+
+	if !authorized {
+		return ErrUnauthorized
+	}
+
+	return nil
+}

internal/auth/token.go

@@ -36,6 +36,15 @@ var ErrWrongPermissions = errors.New("User does not have these permissions")
 // ErrDeletedUser is returned by CheckToken if the key can represent this user, but the user doesn't exist.
 var ErrDeletedUser = errors.New("User was not found")
 
+// ErrUnauthenticated is returned when the user is not authenticated
+var ErrUnauthenticated = errors.New("You are not authenticated")
+
+// ErrUnauthorized is returned when the user doesn't have access to this resource
+var ErrUnauthorized = errors.New("You are not authorized to perform this action")
+
+// ErrInvalidOperation is returned for operations that should never be allowed
+var ErrInvalidOperation = errors.New("No permission exists for this operation")
+
 // TokenFromContext gets the token from context.
 func TokenFromContext(ctx context.Context) *models.Token {
 	token, ok := ctx.Value(contextKey).(*models.Token)