Method validateSODMax

model/constraint.go:222–241

validateSODMax validates a maximum role count constraint for a role set.

(constraint *Constraint, groupingPolicy [][]string)

// validateSODMax validates a maximum role count constraint for a role set.
func (model Model) validateSODMax(constraint *Constraint, groupingPolicy [][]string) error {
	userRoles := buildUserRoleMap(groupingPolicy)

	// Check if any user has more than maxCount roles from the role set
	for user, roles := range userRoles {
		count := 0
		for _, role := range constraint.Roles {
			if roles[role] {
				count++
			}
		}
		if count > constraint.MaxCount {
			return errors.NewConstraintViolationError(constraint.Key,
				fmt.Sprintf("user '%s' has %d roles from %v, exceeds maximum of %d",
					user, count, constraint.Roles, constraint.MaxCount))
		}
	}

	return nil
}

// validateRoleMax validates a role cardinality constraint.
func (model Model) validateRoleMax(constraint *Constraint, groupingPolicy [][]string) error {