Method validateSOD

model/constraint.go:202–219

validateSOD validates a Separation of Duties constraint.

(constraint *Constraint, groupingPolicy [][]string)

// validateSOD validates a Separation of Duties constraint.
func (model Model) validateSOD(constraint *Constraint, groupingPolicy [][]string) error {
	if len(constraint.Roles) != 2 {
		return errors.NewConstraintViolationError(constraint.Key, "sod requires exactly 2 roles")
	}

	role1, role2 := constraint.Roles[0], constraint.Roles[1]
	userRoles := buildUserRoleMap(groupingPolicy)

	// Check if any user has both roles
	for user, roles := range userRoles {
		if roles[role1] && roles[role2] {
			return errors.NewConstraintViolationError(constraint.Key,
				fmt.Sprintf("user '%s' cannot have both roles '%s' and '%s'", user, role1, role2))
		}
	}

	return nil
}

// validateSODMax validates a maximum role count constraint for a role set.
func (model Model) validateSODMax(constraint *Constraint, groupingPolicy [][]string) error {