| 19 | } |
| 20 | |
| 21 | func CanRead(user *model.User, meta *model.Meta, path string) bool { |
| 22 | // nil user is treated as internal/system context and bypasses per-user read restrictions |
| 23 | if user == nil { |
| 24 | return true |
| 25 | } |
| 26 | if meta != nil && len(meta.ReadUsers) > 0 && !slices.Contains(meta.ReadUsers, user.ID) && MetaCoversPath(meta.Path, path, meta.ReadUsersSub) { |
| 27 | return false |
| 28 | } |
| 29 | return true |
| 30 | } |
| 31 | |
| 32 | func CanWrite(user *model.User, meta *model.Meta, path string) bool { |
| 33 | // nil user is treated as internal/system context and bypasses per-user write restrictions |