Method validateRolePre

model/constraint.go:269–282

validateRolePre validates a prerequisite role constraint.

(constraint *Constraint, groupingPolicy [][]string)

// validateRolePre validates a prerequisite role constraint.
func (model Model) validateRolePre(constraint *Constraint, groupingPolicy [][]string) error {
	userRoles := buildUserRoleMap(groupingPolicy)

	// Check if any user has the main role without the prerequisite role
	for user, roles := range userRoles {
		if roles[constraint.Role] && !roles[constraint.PreReqRole] {
			return errors.NewConstraintViolationError(constraint.Key,
				fmt.Sprintf("user '%s' has role '%s' but lacks prerequisite role '%s'",
					user, constraint.Role, constraint.PreReqRole))
		}
	}

	return nil
}