canReadWorksheet check if the principal can read the worksheet. worksheet is readable when the user has bb.worksheets.get permission on the workspace, or. PRIVATE: the creator only. PROJECT_WRITE: all members with bb.projects.get permission in the project. PROJECT_READ: all members with bb.projects.
(ctx context.Context, worksheet *store.WorkSheetMessage)
| 443 | // PROJECT_WRITE: all members with bb.projects.get permission in the project. |
| 444 | // PROJECT_READ: all members with bb.projects.get permission in the project. |
| 445 | func (s *WorksheetService) canReadWorksheet(ctx context.Context, worksheet *store.WorkSheetMessage) (bool, error) { |
| 446 | user, ok := GetUserFromContext(ctx) |
| 447 | if !ok { |
| 448 | return false, connect.NewError(connect.CodeInternal, errors.Errorf("user not found")) |
| 449 | } |
| 450 | |
| 451 | // Worksheet creator and workspace bb.worksheets.get can always read. |
| 452 | if worksheet.Creator == user.Email { |
| 453 | return true, nil |
| 454 | } |
| 455 | ok, err := s.iamManager.CheckPermission(ctx, permission.WorksheetsManage, user, common.GetWorkspaceIDFromContext(ctx)) |
| 456 | if err != nil { |
| 457 | return false, connect.NewError(connect.CodeInternal, errors.Errorf("failed to check permission with error: %v", err.Error())) |
| 458 | } |
| 459 | if ok { |
| 460 | return true, nil |
| 461 | } |
| 462 | |
| 463 | switch worksheet.Visibility { |
| 464 | case store.PrivateWorkSheet: |
| 465 | return false, nil |
| 466 | case store.ProjectReadWorkSheet, store.ProjectWriteWorkSheet: |
| 467 | // Check the "bb.worksheets.get" permission in the project. |
| 468 | return s.checkWorksheetPermission(ctx, worksheet.ProjectID, user, permission.WorksheetsGet) |
| 469 | default: |
| 470 | return false, nil |
| 471 | } |
| 472 | } |
| 473 | |
| 474 | func (s *WorksheetService) checkWorksheetPermission( |
| 475 | ctx context.Context, |
no test coverage detected