Method checkPrivileges

src/jrd/trace/TraceService.cpp:343–389

}

bool TraceSvcJrd::checkPrivileges(TraceSession& session)
{
	// Our service run in embedded mode and have no auth info - trust user name as is
	if (m_admin || (m_user.hasData() && (m_user == session.ses_user)))
		return true;

	// Other session is fully authorized - try to map our auth info using other's
	// security database
	if (session.ses_auth.hasData())
	{
		AuthReader::Info info;
		for (AuthReader rdr(session.ses_auth); rdr.getInfo(info); rdr.moveNext())
		{
			string s_user, t_role;

			PathName dummy;
			RefPtr<const Config> config;
			expandDatabaseName(info.secDb.hasData() ?
				info.secDb.ToPathName() : m_svc.getExpectedDb(), dummy, &config);

			Mapping mapping(Mapping::MAP_NO_FLAGS, m_svc.getCryptCallback());
			UserId::Privileges priv;
			mapping.needSystemPrivileges(priv);
			mapping.setAuthBlock(m_authBlock);
			mapping.setErrorMessagesContextName("services manager");
			mapping.setSqlRole(m_svc.getRoleName());
			mapping.setSecurityDbAlias(config->getSecurityDatabase(), nullptr);

			if (mapping.mapUser(s_user, t_role) & Mapping::MAP_ERROR_NOT_THROWN)
			{
				// Error in mapUser() means missing context, therefore...
				continue;
			}

			t_role.upper();

			// TODO: add privileges for list\manage sessions and check it here
			if (s_user == DBA_USER_NAME || t_role == ADMIN_ROLE || s_user == session.ses_user)
				return true;
		}
	}
	// Other session's service run in embedded mode - check our user name as is
	else if (m_svc.getUserName() == session.ses_user || m_svc.getUserAdminFlag())
		return true;

	return false;
}

// service entrypoint
int TRACE_main(UtilSvc* arg)