| 105 | } |
| 106 | |
| 107 | func check(user *store.UserMessage, p permission.Permission, policy *storepb.IamPolicy, getPermissions func(role string) map[permission.Permission]bool, getGroupMembers func(groupName string) map[string]bool, skipAllUsers bool) bool { |
| 108 | userName := formatUserNameByType(user) |
| 109 | |
| 110 | for _, binding := range policy.GetBindings() { |
| 111 | if !utils.ValidateIAMBinding(binding) { |
| 112 | continue |
| 113 | } |
| 114 | permissions := getPermissions(binding.GetRole()) |
| 115 | if permissions == nil { |
| 116 | continue |
| 117 | } |
| 118 | if !permissions[p] { |
| 119 | continue |
| 120 | } |
| 121 | for _, member := range binding.GetMembers() { |
| 122 | if member == common.AllUsers && !skipAllUsers { |
| 123 | return true |
| 124 | } |
| 125 | if member == userName { |
| 126 | return true |
| 127 | } |
| 128 | if strings.HasPrefix(member, common.GroupPrefix) { |
| 129 | if members := getGroupMembers(member); members != nil { |
| 130 | if members[userName] { |
| 131 | return true |
| 132 | } |
| 133 | } |
| 134 | } |
| 135 | } |
| 136 | } |
| 137 | return false |
| 138 | } |
| 139 | |
| 140 | // formatUserNameByType returns the appropriate member name format based on user type. |
| 141 | // For regular users: users/{email} |