Skip to main content

kcode_k1_web_code_authority/
lib.rs

1use kcode_k1_access::{AccessContext, Authority};
2use kcode_k1_groups::{GroupId, K1Groups, TxId};
3use kcode_k1_web_package::WebFamily;
4
5pub fn authorize_workspace(
6    context: &AccessContext,
7    groups: &K1Groups,
8    family: &WebFamily,
9) -> Result<bool, String> {
10    let web_bytes = *family.authority().transaction_id().as_bytes();
11    let authority = TxId::from_bytes(web_bytes);
12    let user = context.user();
13    if authority.as_bytes() == user.as_tx_id().as_bytes() {
14        return Ok(!context.filter().contains(Authority::User(user)));
15    }
16    let group = GroupId::new(authority);
17    if group.sentinel().is_some() || context.filter().contains(Authority::Group(group)) {
18        return Ok(false);
19    }
20    let memberships = groups.memberships(user, context.model())?;
21    Ok(memberships.user_groups().contains(&group) && memberships.model_groups().contains(&group))
22}