projectVisibilityPredicate builds a project predicate that accepts a project iff it belongs to one of the allowed orgs AND, when RBAC applies to that org, the project is in the caller's visible set. Returns nil when no org grants any project visibility, so callers can fall back to other visibility p
(orgIDs []uuid.UUID, visibleProjectsMap map[uuid.UUID][]uuid.UUID)
| 289 | // visible set. Returns nil when no org grants any project visibility, so callers can fall back |
| 290 | // to other visibility paths (e.g. public workflows). |
| 291 | func projectVisibilityPredicate(orgIDs []uuid.UUID, visibleProjectsMap map[uuid.UUID][]uuid.UUID) predicate.Project { |
| 292 | perOrg := make([]predicate.Project, 0, len(orgIDs)) |
| 293 | for _, orgID := range orgIDs { |
| 294 | visible, hasRBAC := visibleProjectsMap[orgID] |
| 295 | if !hasRBAC { |
| 296 | perOrg = append(perOrg, project.HasOrganizationWith(organization.ID(orgID))) |
| 297 | continue |
| 298 | } |
| 299 | if len(visible) == 0 { |
| 300 | continue // RBAC applies but no project is visible in this org |
| 301 | } |
| 302 | perOrg = append(perOrg, project.And( |
| 303 | project.HasOrganizationWith(organization.ID(orgID)), |
| 304 | project.IDIn(visible...), |
| 305 | )) |
| 306 | } |
| 307 | if len(perOrg) == 0 { |
| 308 | return nil |
| 309 | } |
| 310 | return project.Or(perOrg...) |
| 311 | } |
| 312 | |
| 313 | // max number of recursive levels to traverse |
| 314 | // we just care about 1 level, i.e att -> commit, or commit -> attestation |
no test coverage detected