Function doIAMPermissionCheck

backend/api/v1/acl.go:239–293

(ctx context.Context, iamManager *iam.Manager, fullMethod string, user *store.UserMessage, authContext *common.AuthContext)

}

func doIAMPermissionCheck(ctx context.Context, iamManager *iam.Manager, fullMethod string, user *store.UserMessage, authContext *common.AuthContext) (bool, []string, error) {
	if auth.IsAuthenticationSkipped(fullMethod, authContext) {
		return true, nil, nil
	}
	if authContext.AuthMethod != common.AuthMethodIAM {
		return true, nil, nil
	}
	// Handle GetProject() error status.
	if len(authContext.Resources) == 0 {
		return false, nil, errors.Errorf("no resource found for IAM auth method")
	}

	var hasWorkspaceResource bool
	projectIDMap := make(map[string]bool)
	workspaceID := common.GetWorkspaceIDFromContext(ctx)
	for _, resource := range authContext.Resources {
		switch resource.Type {
		case common.ResourceTypeWorkspace:
			hasWorkspaceResource = true
		case common.ResourceTypeProject:
			projectIDMap[resource.ID] = true
		default:
			return false, nil, errors.Errorf("unknown resource type %v", resource.Type)
		}
	}

	if hasWorkspaceResource {
		ok, err := iamManager.CheckPermission(ctx, authContext.Permission, user, workspaceID)
		if err != nil {
			return false, nil, err
		}
		if !ok {
			return false, nil, nil
		}
	}
	if len(projectIDMap) > 0 {
		var projectIDs []string
		for projectID := range projectIDMap {
			projectIDs = append(projectIDs, projectID)
		}
		ok, err := iamManager.CheckPermission(ctx, authContext.Permission, user, workspaceID, projectIDs...)
		if err != nil {
			return false, nil, err
		}
		if ok {
			return true, nil, nil
		}
		projectResources := []string{}
		for _, id := range projectIDs {
			projectResources = append(projectResources, common.FormatProject(id))
		}
		return false, projectResources, nil
	}
	return true, nil, nil
}

var workspaceRegex = regexp.MustCompile(`^workspaces/[^/]+`)
var projectRegex = regexp.MustCompile(`^projects/[^/]+`)