Method checkComputedUserSet

internal/engines/check.go:403–419

metadata to determine if the computed user set should be excluded from the result. checkComputedUserSet is a method of CheckEngine that checks permissions using the ComputedUserSet data structure. It returns a CheckFunction closure that performs the check.

(
	request *base.PermissionCheckRequest, // The request containing details about the permission to be checked
	cu *base.ComputedUserSet, // The computed user set containing user set information
)

// checkComputedUserSet is a method of CheckEngine that checks permissions using the
// ComputedUserSet data structure. It returns a CheckFunction closure that performs the check.
func (engine *CheckEngine) checkComputedUserSet(
	request *base.PermissionCheckRequest, // The request containing details about the permission to be checked
	cu *base.ComputedUserSet, // The computed user set containing user set information
) CheckFunction {
	// The returned CheckFunction invokes a permission check with a new request that is almost the same
	// as the incoming request, but changes the Permission to be the relation defined in the computed user set.
	// This is how the check "descends" into the computed user set to check permissions there.
	return engine.invoke(&base.PermissionCheckRequest{
		TenantId:   request.GetTenantId(), // Tenant ID from the incoming request
		Entity:     request.GetEntity(),   // Entity from the incoming request
		Permission: cu.GetRelation(),      // Permission is set to the relation defined in the computed user set
		Subject:    request.GetSubject(),  // The subject from the incoming request
		Metadata:   request.GetMetadata(), // Metadata from the incoming request
		Context:    request.GetContext(),
		Arguments:  request.GetArguments(),
	})
}

// checkComputedAttribute constructs a CheckFunction that checks if a computed attribute
// permission check request is allowed or denied.