path: root/src/config.rs

// Configuration module for SeckelAPI
use anyhow::{Context, Result};
use ipnet::IpNet;
use serde::Deserialize;
use std::collections::HashMap;
use std::fs;
use std::str::FromStr;

#[derive(Debug, Clone, Deserialize)]
pub struct Config {
    pub database: DatabaseConfig,
    pub server: ServerConfig,
    pub security: SecurityConfig,
    pub permissions: PermissionsConfig,
    pub logging: LoggingConfig,
    pub auto_generation: Option<HashMap<String, AutoGenerationConfig>>,
    pub scheduled_queries: Option<ScheduledQueriesConfig>,
}

#[derive(Debug, Clone, Deserialize)]
pub struct PermissionsConfig {
    #[serde(flatten)]
    pub power_levels: HashMap<String, PowerLevelPermissions>,
}

#[derive(Debug, Clone, Deserialize)]
pub struct PowerLevelPermissions {
    pub basic_rules: Vec<String>,
    pub advanced_rules: Option<Vec<String>>,
    pub max_limit: Option<u32>,
    pub max_where_conditions: Option<u32>,
    pub session_timeout_minutes: Option<u64>,
    pub max_concurrent_sessions: Option<u32>,
    #[serde(default = "default_true")]
    pub rollback_on_error: bool,
    #[serde(default = "default_false")]
    pub allow_batch_operations: bool,
    #[serde(default = "default_user_settings_access")]
    pub user_settings_access: UserSettingsAccess,
}

#[derive(Debug, Clone, Deserialize, PartialEq)]
#[serde(rename_all = "kebab-case")]
pub enum UserSettingsAccess {
    ReadOwnOnly,
    ReadWriteOwn,
    ReadWriteAll,
}

fn default_user_settings_access() -> UserSettingsAccess {
    UserSettingsAccess::ReadWriteOwn
}

#[derive(Debug, Clone, Deserialize)]
pub struct DatabaseConfig {
    pub host: String,
    pub port: u16,
    pub database: String,
    pub username: String,
    pub password: String,
    #[serde(default = "default_min_connections")]
    pub min_connections: u32,
    #[serde(default = "default_max_connections")]
    pub max_connections: u32,
    #[serde(default = "default_connection_timeout_seconds")]
    pub connection_timeout_seconds: u64,
    #[serde(default = "default_connection_timeout_wait")]
    pub connection_timeout_wait: u64,
    #[serde(default = "default_connection_check_interval")]
    pub connection_check: u64,
}

fn default_min_connections() -> u32 {
    1
}

fn default_max_connections() -> u32 {
    10
}

fn default_connection_timeout_seconds() -> u64 {
    30
}

fn default_connection_timeout_wait() -> u64 {
    5
}

fn default_connection_check_interval() -> u64 {
    30
}

#[derive(Debug, Clone, Deserialize)]
pub struct ServerConfig {
    pub host: String,
    pub port: u16,
    #[serde(default = "default_request_body_limit_mb")]
    pub request_body_limit_mb: usize,
}

fn default_request_body_limit_mb() -> usize {
    10 // 10 MB default
}

#[derive(Debug, Clone, Deserialize)]
pub struct SecurityConfig {
    pub whitelisted_pin_ips: Vec<String>,
    pub whitelisted_string_ips: Vec<String>,
    pub session_timeout_minutes: u64,
    pub refresh_session_on_activity: bool,
    pub max_concurrent_sessions: u32,
    pub session_cleanup_interval_minutes: u64,
    pub default_max_limit: u32,
    pub default_max_where_conditions: u32,
    #[serde(default = "default_hash_pins")]
    pub hash_pins: bool, // Whether to use bcrypt for PINs (false = plaintext)
    #[serde(default = "default_hash_tokens")]
    pub hash_tokens: bool, // Whether to use bcrypt for login_strings (false = plaintext)
    #[serde(default = "default_pin_column")]
    pub pin_column: String, // Database column name for PINs
    #[serde(default = "default_token_column")]
    pub token_column: String, // Database column name for login strings
    // Rate limiting
    #[serde(default = "default_enable_rate_limiting")]
    pub enable_rate_limiting: bool, // Master switch for rate limiting (disable for debugging)

    // Auth rate limiting
    #[serde(default = "default_auth_rate_limit_per_minute")]
    pub auth_rate_limit_per_minute: u32, // Max auth requests per IP per minute
    #[serde(default = "default_auth_rate_limit_per_second")]
    pub auth_rate_limit_per_second: u32, // Max auth requests per IP per second (burst protection)

    // API rate limiting
    #[serde(default = "default_api_rate_limit_per_minute")]
    pub api_rate_limit_per_minute: u32, // Max API calls per user per minute
    #[serde(default = "default_api_rate_limit_per_second")]
    pub api_rate_limit_per_second: u32, // Max API calls per user per second (burst protection)

    // Table configuration (moved from basics.toml)
    #[serde(default = "default_known_tables")]
    pub known_tables: Vec<String>,
    #[serde(default = "default_read_only_tables")]
    pub read_only_tables: Vec<String>,
    #[serde(default = "default_global_write_protected_columns")]
    pub global_write_protected_columns: Vec<String>,

    // User preferences access control
    #[serde(default = "default_user_settings_access")]
    pub default_user_settings_access: UserSettingsAccess,
}

fn default_known_tables() -> Vec<String> {
    vec![] // Empty by default, must be configured
}

fn default_read_only_tables() -> Vec<String> {
    vec![] // Empty by default
}

fn default_global_write_protected_columns() -> Vec<String> {
    vec!["id".to_string()] // Protect 'id' by default at minimum
}

fn default_hash_pins() -> bool {
    false // Default to plaintext (must be explicitly enabled for bcrypt hashing)
}

fn default_hash_tokens() -> bool {
    false // Default to plaintext (must be explicitly enabled for bcrypt hashing)
}

fn default_pin_column() -> String {
    "pin_code".to_string()
}

fn default_token_column() -> String {
    "login_string".to_string()
}

fn default_enable_rate_limiting() -> bool {
    true // Enable by default for security
}

fn default_auth_rate_limit_per_minute() -> u32 {
    10 // 10 login attempts per IP per minute (prevents brute force)
}

fn default_auth_rate_limit_per_second() -> u32 {
    5 // Max 5 login attempts per second (burst protection)
}

fn default_api_rate_limit_per_minute() -> u32 {
    60 // 60 API calls per user per minute
}

fn default_api_rate_limit_per_second() -> u32 {
    10 // Max 10 API calls per second (burst protection)
}

#[derive(Debug, Clone, Deserialize)]
pub struct LoggingConfig {
    pub request_log: Option<String>,
    pub query_log: Option<String>,
    pub error_log: Option<String>,
    pub warning_log: Option<String>,  // Warning messages
    pub info_log: Option<String>,     // Info messages
    pub combined_log: Option<String>, // Unified log with request IDs
    pub level: String,
    pub mask_passwords: bool,
    #[serde(default)]
    pub sensitive_fields: Vec<String>, // Fields to mask beyond password/pin
    #[serde(default)]
    pub custom_filters: Vec<CustomLogFilter>, // Regex-based log routing
}

#[derive(Debug, Clone, Deserialize)]
pub struct CustomLogFilter {
    pub name: String,
    pub output_file: String,
    pub pattern: String, // Regex pattern to match
    #[serde(default = "default_filter_enabled")]
    pub enabled: bool,
}

fn default_filter_enabled() -> bool {
    true
}

fn default_true() -> bool {
    true
}

fn default_false() -> bool {
    false
}

#[derive(Debug, Clone, Deserialize)]
pub struct AutoGenerationConfig {
    pub field: String,
    #[serde(rename = "type")]
    pub gen_type: String,
    pub length: Option<u32>,
    pub range_min: Option<u64>,
    pub range_max: Option<u64>,
    pub max_attempts: Option<u32>,
    #[serde(default = "default_on_action")]
    pub on_action: String, // "insert", "update", or "both"
}

fn default_on_action() -> String {
    "insert".to_string()
}

#[derive(Debug, Clone, Deserialize)]
pub struct ScheduledQueriesConfig {
    #[serde(default)]
    pub tasks: Vec<ScheduledQueryTask>,
}

#[derive(Debug, Clone, Deserialize)]
pub struct ScheduledQueryTask {
    pub name: String,
    pub description: String,
    pub query: String,
    pub interval_minutes: u64,
    #[serde(default = "default_enabled")]
    pub enabled: bool,
    #[serde(default = "default_run_on_startup")]
    pub run_on_startup: bool,
}

fn default_enabled() -> bool {
    true
}

fn default_run_on_startup() -> bool {
    true // Run immediately on startup by default
}

impl Config {
    pub fn load() -> Result<Self> {
        Self::load_from_folder()
    }

    fn load_from_folder() -> Result<Self> {
        // Load consolidated config files
        let basics_content =
            fs::read_to_string("config/basics.toml").context("Can't read config/basics.toml")?;
        let security_content = fs::read_to_string("config/security.toml")
            .context("Can't read config/security.toml")?;
        let logging_content =
            fs::read_to_string("config/logging.toml").context("Can't read config/logging.toml")?;

        // Parse individual sections
        #[derive(Deserialize)]
        struct BasicsWrapper {
            server: ServerConfig,
            database: DatabaseConfig,
            #[serde(default)]
            auto_generation: Option<HashMap<String, AutoGenerationConfig>>,
        }
        #[derive(Deserialize)]
        struct SecurityWrapper {
            security: SecurityConfig,
            permissions: PermissionsConfig,
        }
        #[derive(Deserialize)]
        struct LoggingWrapper {
            logging: LoggingConfig,
        }

        #[derive(Deserialize)]
        struct FunctionsWrapper {
            #[serde(default)]
            auto_generation: Option<HashMap<String, AutoGenerationConfig>>,
            #[serde(default)]
            scheduled_queries: Option<ScheduledQueriesConfig>,
        }

        let basics: BasicsWrapper =
            toml::from_str(&basics_content).context("Failed to parse basics.toml")?;
        let security: SecurityWrapper =
            toml::from_str(&security_content).context("Failed to parse security.toml")?;
        let logging: LoggingWrapper =
            toml::from_str(&logging_content).context("Failed to parse logging.toml")?;

        // Load functions.toml if it exists, otherwise use basics fallback
        let functions: FunctionsWrapper = if fs::metadata("config/functions.toml").is_ok() {
            let functions_content = fs::read_to_string("config/functions.toml")
                .context("Can't read config/functions.toml")?;
            toml::from_str(&functions_content).context("Failed to parse functions.toml")?
        } else {
            // Fallback to basics.toml for auto_generation
            FunctionsWrapper {
                auto_generation: basics.auto_generation.clone(),
                scheduled_queries: None,
            }
        };

        let config = Config {
            database: basics.database,
            server: basics.server,
            security: security.security,
            permissions: security.permissions,
            logging: logging.logging,
            auto_generation: functions.auto_generation,
            scheduled_queries: functions.scheduled_queries,
        };

        // Validate configuration
        config.validate()?;

        Ok(config)
    }

    /// Validate configuration values
    fn validate(&self) -> Result<()> {
        // Validate server port (u16 is already limited to 0-65535, just check for 0)
        if self.server.port == 0 {
            anyhow::bail!(
                "Invalid server.port: {} (must be 1-65535)",
                self.server.port
            );
        }

        // Validate database port (u16 is already limited to 0-65535, just check for 0)
        if self.database.port == 0 {
            anyhow::bail!(
                "Invalid database.port: {} (must be 1-65535)",
                self.database.port
            );
        }

        // Validate database connection details
        if self.database.host.trim().is_empty() {
            anyhow::bail!("database.host cannot be empty");
        }
        if self.database.database.trim().is_empty() {
            anyhow::bail!("database.database cannot be empty");
        }
        if self.database.username.trim().is_empty() {
            anyhow::bail!("database.username cannot be empty");
        }

        // Validate PIN whitelist IPs (can be CIDR or single IPs)
        for ip in &self.security.whitelisted_pin_ips {
            if IpNet::from_str(ip).is_err() && ip.parse::<std::net::IpAddr>().is_err() {
                anyhow::bail!("Invalid IP/CIDR in whitelisted_pin_ips: {}", ip);
            }
        }

        // Validate string auth whitelist IPs (can be CIDR or single IPs)
        for ip in &self.security.whitelisted_string_ips {
            if IpNet::from_str(ip).is_err() && ip.parse::<std::net::IpAddr>().is_err() {
                anyhow::bail!("Invalid IP/CIDR in whitelisted_string_ips: {}", ip);
            }
        }

        // Validate session timeout
        if self.security.session_timeout_minutes == 0 {
            anyhow::bail!("security.session_timeout_minutes must be greater than 0");
        }

        // Validate permission syntax
        for (power_level, perms) in &self.permissions.power_levels {
            // Validate power level is numeric
            if power_level.parse::<i32>().is_err() {
                anyhow::bail!("Invalid power level '{}': must be numeric", power_level);
            }

            // Validate basic rules format
            for rule in &perms.basic_rules {
                Self::validate_permission_rule(rule).with_context(|| {
                    format!("Invalid basic rule for power level {}", power_level)
                })?;
            }

            // Validate advanced rules format
            if let Some(advanced_rules) = &perms.advanced_rules {
                for rule in advanced_rules {
                    Self::validate_advanced_rule(rule).with_context(|| {
                        format!("Invalid advanced rule for power level {}", power_level)
                    })?;
                }
            }
        }

        // Validate logging configuration (paths are now optional)
        // No validation needed for optional log paths

        // Validate log level
        let valid_levels = ["trace", "debug", "info", "warn", "error"];
        if !valid_levels.contains(&self.logging.level.to_lowercase().as_str()) {
            anyhow::bail!(
                "Invalid logging.level '{}': must be one of: {}",
                self.logging.level,
                valid_levels.join(", ")
            );
        }

        Ok(())
    }

    /// Validate basic permission rule format (table:permission)
    fn validate_permission_rule(rule: &str) -> Result<()> {
        let parts: Vec<&str> = rule.split(':').collect();
        if parts.len() != 2 {
            anyhow::bail!(
                "Permission rule '{}' must be in format 'table:permission'",
                rule
            );
        }

        let table = parts[0];
        let permission = parts[1];

        if table.trim().is_empty() {
            anyhow::bail!("Table name cannot be empty in rule '{}'", rule);
        }

        // Validate permission type
        let valid_permissions = ["r", "rw", "rwd"];
        if !valid_permissions.contains(&permission) {
            anyhow::bail!(
                "Invalid permission '{}' in rule '{}': must be one of: {}",
                permission,
                rule,
                valid_permissions.join(", ")
            );
        }

        Ok(())
    }

    /// Validate advanced permission rule format (table.column:permission)
    fn validate_advanced_rule(rule: &str) -> Result<()> {
        let parts: Vec<&str> = rule.split(':').collect();
        if parts.len() != 2 {
            anyhow::bail!(
                "Advanced rule '{}' must be in format 'table.column:permission'",
                rule
            );
        }

        let table_col = parts[0];
        let permission = parts[1];

        // Validate table.column format
        let col_parts: Vec<&str> = table_col.split('.').collect();
        if col_parts.len() != 2 {
            anyhow::bail!("Advanced rule '{}' must have 'table.column' format", rule);
        }

        let table = col_parts[0];
        let column = col_parts[1];

        if table.trim().is_empty() {
            anyhow::bail!("Table name cannot be empty in rule '{}'", rule);
        }
        if column.trim().is_empty() {
            anyhow::bail!("Column name cannot be empty in rule '{}'", rule);
        }

        // Validate permission type
        let valid_permissions = ["r", "w", "rw", "block"];
        if !valid_permissions.contains(&permission) {
            anyhow::bail!(
                "Invalid permission '{}' in rule '{}': must be one of: {}",
                permission,
                rule,
                valid_permissions.join(", ")
            );
        }

        Ok(())
    }

    pub fn get_database_url(&self) -> String {
        format!(
            "mysql://{}:{}@{}:{}/{}",
            self.database.username,
            self.database.password,
            self.database.host,
            self.database.port,
            self.database.database
        )
    }

    pub fn is_pin_ip_whitelisted(&self, ip: &str) -> bool {
        self.is_ip_in_whitelist(ip, &self.security.whitelisted_pin_ips)
    }

    pub fn is_string_ip_whitelisted(&self, ip: &str) -> bool {
        self.is_ip_in_whitelist(ip, &self.security.whitelisted_string_ips)
    }

    fn is_ip_in_whitelist(&self, ip: &str, whitelist: &[String]) -> bool {
        let client_ip = match ip.parse::<std::net::IpAddr>() {
            Ok(addr) => addr,
            Err(_) => return false,
        };

        for allowed in whitelist {
            // Try to parse as a network (CIDR notation)
            if let Ok(network) = IpNet::from_str(allowed) {
                if network.contains(&client_ip) {
                    return true;
                }
            }
            // Try to parse as a single IP address
            else if let Ok(allowed_ip) = allowed.parse::<std::net::IpAddr>() {
                if client_ip == allowed_ip {
                    return true;
                }
            }
        }
        false
    }

    pub fn get_role_permissions(&self, power: i32) -> Vec<(String, String)> {
        let power_str = power.to_string();

        if let Some(power_perms) = self.permissions.power_levels.get(&power_str) {
            power_perms
                .basic_rules
                .iter()
                .filter_map(|perm| {
                    let parts: Vec<&str> = perm.split(':').collect();
                    if parts.len() == 2 {
                        Some((parts[0].to_string(), parts[1].to_string()))
                    } else {
                        None
                    }
                })
                .collect()
        } else {
            Vec::new()
        }
    }

    // Helper methods for new configuration sections
    pub fn get_known_tables(&self) -> Vec<String> {
        if self.security.known_tables.is_empty() {
            tracing::warn!("No known_tables configured in security.toml - returning empty list. Wildcard permissions (*) will not work.");
        }
        self.security.known_tables.clone()
    }

    pub fn is_read_only_table(&self, table: &str) -> bool {
        self.security.read_only_tables.contains(&table.to_string())
    }

    pub fn get_auto_generation_config(&self, table: &str) -> Option<&AutoGenerationConfig> {
        self.auto_generation
            .as_ref()
            .and_then(|configs| configs.get(table))
    }

    pub fn get_basic_permissions(&self, power: i32) -> Option<&Vec<String>> {
        self.permissions
            .power_levels
            .get(&power.to_string())
            .map(|p| &p.basic_rules)
    }

    pub fn get_advanced_permissions(&self, power: i32) -> Option<&Vec<String>> {
        self.permissions
            .power_levels
            .get(&power.to_string())
            .and_then(|p| p.advanced_rules.as_ref())
    }

    pub fn filter_readable_columns(
        &self,
        power: i32,
        table: &str,
        requested_columns: &[String],
    ) -> Vec<String> {
        if let Some(advanced_rules) = self.get_advanced_permissions(power) {
            let mut allowed_columns = Vec::new();
            let mut blocked_columns = Vec::new();
            let mut has_wildcard_block = false;
            let mut has_wildcard_allow = false;

            // Parse advanced rules for this table
            for rule in advanced_rules {
                if let Some((table_col, permission)) = rule.split_once(':') {
                    if let Some((rule_table, column)) = table_col.split_once('.') {
                        if rule_table == table {
                            match permission {
                                "block" => {
                                    if column == "*" {
                                        has_wildcard_block = true;
                                    } else {
                                        blocked_columns.push(column.to_string());
                                    }
                                }
                                "r" | "rw" => {
                                    if column == "*" {
                                        has_wildcard_allow = true;
                                    } else {
                                        allowed_columns.push(column.to_string());
                                    }
                                }
                                _ => {}
                            }
                        }
                    }
                }
            }

            // Filter requested columns based on rules
            let mut result = Vec::new();
            for column in requested_columns {
                let allow = if has_wildcard_block {
                    // If wildcard block, only allow specifically allowed columns
                    allowed_columns.contains(column)
                } else if has_wildcard_allow {
                    // If wildcard allow, block only specifically blocked columns
                    !blocked_columns.contains(column)
                } else {
                    // No wildcard rules, block specifically blocked columns
                    !blocked_columns.contains(column)
                };

                if allow {
                    result.push(column.clone());
                }
            }

            result
        } else {
            // No advanced rules, return all requested columns
            requested_columns.to_vec()
        }
    }

    pub fn filter_writable_columns(
        &self,
        power: i32,
        table: &str,
        requested_columns: &[String],
    ) -> Vec<String> {
        // First, apply global write-protected columns (these override everything)
        let mut globally_blocked: Vec<String> =
            self.security.global_write_protected_columns.clone();

        if let Some(advanced_rules) = self.get_advanced_permissions(power) {
            let mut allowed_columns = Vec::new();
            let mut blocked_columns = Vec::new();
            let mut has_wildcard_block = false;
            let mut has_wildcard_allow = false;

            // Parse advanced rules for this table
            for rule in advanced_rules {
                if let Some((table_col, permission)) = rule.split_once(':') {
                    if let Some((rule_table, column)) = table_col.split_once('.') {
                        if rule_table == table {
                            match permission {
                                "block" => {
                                    if column == "*" {
                                        has_wildcard_block = true;
                                    } else {
                                        blocked_columns.push(column.to_string());
                                    }
                                }
                                "w" | "rw" => {
                                    if column == "*" {
                                        has_wildcard_allow = true;
                                    } else {
                                        allowed_columns.push(column.to_string());
                                    }
                                }
                                "r" => {
                                    // Read-only: block from writing but not from reading
                                    blocked_columns.push(column.to_string());
                                }
                                _ => {}
                            }
                        }
                    }
                }
            }

            // Merge advanced_rules blocked columns with globally protected
            blocked_columns.append(&mut globally_blocked);

            // Filter requested columns based on rules
            let mut result = Vec::new();
            for column in requested_columns {
                let allow = if has_wildcard_block {
                    // If wildcard block, only allow specifically allowed columns
                    allowed_columns.contains(column)
                } else if has_wildcard_allow {
                    // If wildcard allow, block only specifically blocked columns
                    !blocked_columns.contains(column)
                } else {
                    // No wildcard rules, block specifically blocked columns
                    !blocked_columns.contains(column)
                };

                if allow {
                    result.push(column.clone());
                }
            }

            result
        } else {
            // No advanced rules, just filter out globally protected columns
            requested_columns
                .iter()
                .filter(|col| !globally_blocked.contains(col))
                .cloned()
                .collect()
        }
    }

    /// Get the max_limit for a specific power level (with fallback to next lower power level)
    pub fn get_max_limit(&self, power: i32) -> u32 {
        // Try exact match first
        if let Some(perms) = self.permissions.power_levels.get(&power.to_string()) {
            if let Some(limit) = perms.max_limit {
                return limit;
            }
        }

        // Find next lower power level
        let fallback_power = self.find_fallback_power_level(power);
        if let Some(fb_power) = fallback_power {
            tracing::warn!(
                "Power level {} not found in config, falling back to power level {}",
                power,
                fb_power
            );
            if let Some(perms) = self.permissions.power_levels.get(&fb_power.to_string()) {
                if let Some(limit) = perms.max_limit {
                    return limit;
                }
            }
        }

        // Ultimate fallback to default
        self.security.default_max_limit
    }

    /// Get the max_where_conditions for a specific power level (with fallback to next lower power level)
    pub fn get_max_where_conditions(&self, power: i32) -> u32 {
        // Try exact match first
        if let Some(perms) = self.permissions.power_levels.get(&power.to_string()) {
            if let Some(max_where) = perms.max_where_conditions {
                return max_where;
            }
        }

        // Find next lower power level
        let fallback_power = self.find_fallback_power_level(power);
        if let Some(fb_power) = fallback_power {
            tracing::warn!(
                "Power level {} not found in config, falling back to power level {}",
                power,
                fb_power
            );
            if let Some(perms) = self.permissions.power_levels.get(&fb_power.to_string()) {
                if let Some(max_where) = perms.max_where_conditions {
                    return max_where;
                }
            }
        }

        // Ultimate fallback to default
        self.security.default_max_where_conditions
    }

    /// Find the next lower configured power level (e.g., power=60 → fallback to 50)
    fn find_fallback_power_level(&self, power: i32) -> Option<i32> {
        let mut available_powers: Vec<i32> = self
            .permissions
            .power_levels
            .keys()
            .filter_map(|k| k.parse::<i32>().ok())
            .filter(|&p| p < power) // Only consider lower power levels
            .collect();

        available_powers.sort_by(|a, b| b.cmp(a)); // Sort descending
        available_powers.first().copied()
    }

    /// Get the session_timeout_minutes for a specific power level (with fallback to default)
    pub fn get_session_timeout(&self, power: i32) -> u64 {
        self.permissions
            .power_levels
            .get(&power.to_string())
            .and_then(|p| p.session_timeout_minutes)
            .unwrap_or(self.security.session_timeout_minutes)
    }

    /// Get the max_concurrent_sessions for a specific power level (with fallback to default)
    pub fn get_max_concurrent_sessions(&self, power: i32) -> u32 {
        self.permissions
            .power_levels
            .get(&power.to_string())
            .and_then(|p| p.max_concurrent_sessions)
            .unwrap_or(self.security.max_concurrent_sessions)
    }
}