Resolve full permission chain for EXPLAIN PERMISSION.
(
permission: &str,
collection: &str,
identity: &AuthenticatedIdentity,
auth_ctx: &AuthContext,
state: &crate::control::state::SharedState,
)
| 27 | |
| 28 | /// Resolve full permission chain for EXPLAIN PERMISSION. |
| 29 | pub fn explain_permission( |
| 30 | permission: &str, |
| 31 | collection: &str, |
| 32 | identity: &AuthenticatedIdentity, |
| 33 | auth_ctx: &AuthContext, |
| 34 | state: &crate::control::state::SharedState, |
| 35 | ) -> PermissionExplanation { |
| 36 | let mut steps = Vec::new(); |
| 37 | let user_id = identity.user_id.to_string(); |
| 38 | |
| 39 | // 1. Account status. |
| 40 | let status_ok = auth_ctx.check_status().is_ok(); |
| 41 | steps.push(ExplainStep { |
| 42 | check: "account_status".into(), |
| 43 | result: if status_ok { "PASS" } else { "DENY" }.into(), |
| 44 | source: format!("status={}", auth_ctx.status), |
| 45 | }); |
| 46 | if !status_ok { |
| 47 | return PermissionExplanation { |
| 48 | collection: collection.into(), |
| 49 | permission: permission.into(), |
| 50 | auth_user_id: user_id, |
| 51 | allowed: false, |
| 52 | steps, |
| 53 | }; |
| 54 | } |
| 55 | |
| 56 | // 2. Superuser check. |
| 57 | if identity.is_superuser { |
| 58 | steps.push(ExplainStep { |
| 59 | check: "superuser".into(), |
| 60 | result: "PASS (bypass all)".into(), |
| 61 | source: "identity.is_superuser=true".into(), |
| 62 | }); |
| 63 | return PermissionExplanation { |
| 64 | collection: collection.into(), |
| 65 | permission: permission.into(), |
| 66 | auth_user_id: user_id, |
| 67 | allowed: true, |
| 68 | steps, |
| 69 | }; |
| 70 | } |
| 71 | |
| 72 | // 3. Role-based permission. |
| 73 | let perm_enum = match permission.to_lowercase().as_str() { |
| 74 | "read" | "select" => super::identity::Permission::Read, |
| 75 | "write" | "insert" | "update" | "delete" => super::identity::Permission::Write, |
| 76 | "create" => super::identity::Permission::Create, |
| 77 | "drop" => super::identity::Permission::Drop, |
| 78 | "alter" => super::identity::Permission::Alter, |
| 79 | "admin" => super::identity::Permission::Admin, |
| 80 | "monitor" => super::identity::Permission::Monitor, |
| 81 | _ => super::identity::Permission::Read, |
| 82 | }; |
| 83 | let role_ok = super::identity::role_grants_permission( |
| 84 | &identity |
| 85 | .roles |
| 86 | .first() |
nothing calls this directly
no test coverage detected