(storeManager *common.StoreManager, operationUser string, currentUser *common.User)
| 402 | } |
| 403 | |
| 404 | func userHasAccess(storeManager *common.StoreManager, operationUser string, currentUser *common.User) bool { |
| 405 | // get current role |
| 406 | role, exists, err := storeManager.GetRole(currentUser.Tenant, currentUser.Role) |
| 407 | if err != nil || !exists { |
| 408 | return false |
| 409 | } |
| 410 | // currentUser name and tenant |
| 411 | // operationUser = tenant:username |
| 412 | operationUserInfo := strings.Split(operationUser, ":") |
| 413 | if len(operationUserInfo) < 2 { |
| 414 | return false |
| 415 | } |
| 416 | tenant, username := operationUserInfo[0], operationUserInfo[1] |
| 417 | |
| 418 | // platform can operation all user data |
| 419 | // tenant only operation current tenant user |
| 420 | if currentUser.Tenant != common.DefaultAdminTenant && currentUser.Tenant != tenant { |
| 421 | return false |
| 422 | } |
| 423 | if (role.ObjectType == "all") || (currentUser.Tenant == tenant && currentUser.Username == username) { |
| 424 | return true |
| 425 | } |
| 426 | // operation user is managed by role(object users: tenant:user) |
| 427 | for _, enableUser := range role.ObjectUsers { |
| 428 | if operationUser == enableUser { |
| 429 | return true |
| 430 | } |
| 431 | } |
| 432 | return false |
| 433 | |
| 434 | } |
no test coverage detected