Method canWriteWorksheet

backend/api/v1/worksheet_service.go:408–438

canWriteWorksheet check if the principal can write the worksheet. worksheet is writable when the user has bb.worksheets.manage permission on the workspace, or. PRIVATE: the creator. PROJECT_WRITE: all members with bb.projects.get permission in the project.

(ctx context.Context, worksheet *store.WorkSheetMessage)

// PRIVATE: the creator.
// PROJECT_WRITE: all members with bb.projects.get permission in the project.
func (s *WorksheetService) canWriteWorksheet(ctx context.Context, worksheet *store.WorkSheetMessage) (bool, error) {
	user, ok := GetUserFromContext(ctx)
	if !ok {
		return false, connect.NewError(connect.CodeInternal, errors.Errorf("user not found"))
	}

	// Worksheet creator and workspace "bb.worksheets.manage" can always write.
	if worksheet.Creator == user.Email {
		return true, nil
	}
	ok, err := s.iamManager.CheckPermission(ctx, permission.WorksheetsManage, user, common.GetWorkspaceIDFromContext(ctx))
	if err != nil {
		return false, connect.NewError(connect.CodeInternal, errors.Errorf("failed to check permission with error: %v", err.Error()))
	}
	if ok {
		return true, nil
	}

	switch worksheet.Visibility {
	case store.PrivateWorkSheet:
		return false, nil
	case store.ProjectReadWorkSheet:
		// For READ visibility, check the "bb.worksheets.manage" permission in the project.
		return s.checkWorksheetPermission(ctx, worksheet.ProjectID, user, permission.WorksheetsManage)
	case store.ProjectWriteWorkSheet:
		// For READ visibility, needs "bb.worksheets.get" permission in the project.
		return s.checkWorksheetPermission(ctx, worksheet.ProjectID, user, permission.WorksheetsGet)
	default:
		return false, nil
	}
}

// canReadWorksheet check if the principal can read the worksheet.
// worksheet is readable when the user has bb.worksheets.get permission on the workspace, or.