(actor MutationActor, kind ResourceKind, scope ResourceScope)
| 117 | } |
| 118 | |
| 119 | func validateActorWriteAccess(actor MutationActor, kind ResourceKind, scope ResourceScope) error { |
| 120 | if !actorAllowsKind(actor, kind) { |
| 121 | return fmt.Errorf("%w: actor cannot access resource kind %q", ErrPermissionDenied, kind) |
| 122 | } |
| 123 | if !actorAllowsScopeKind(actor, scope.Kind) { |
| 124 | return fmt.Errorf("%w: actor cannot access scope kind %q", ErrPermissionDenied, scope.Kind) |
| 125 | } |
| 126 | if !actorAllowsScope(actor, scope) { |
| 127 | return fmt.Errorf("%w: actor max scope does not allow %q/%q", ErrPermissionDenied, scope.Kind, scope.ID) |
| 128 | } |
| 129 | return nil |
| 130 | } |
| 131 | |
| 132 | func validateActorReadAccess(actor MutationActor, record RawRecord) error { |
| 133 | if !actorAllowsKind(actor, record.Kind) { |
no test coverage detected