Method RevokedCollectionChannels

auth/user.go:292–404

RevokedCollectionChannels returns a map of revoked channels for the collection => most recent sequence at which access to that channel was lost Steps: Get revoked roles and for each: - Revoke the current channels if the role is deleted - Revoke the role revoked channels Get current roles and for ea

(scope string, collection string, since uint64, lowSeq uint64, triggeredBy uint64)

// Get user:
//   - Revoke users revoked channels
func (user *userImpl) RevokedCollectionChannels(scope string, collection string, since uint64, lowSeq uint64, triggeredBy uint64) (RevokedChannels, error) {
	// checkSeq represents the value that we use to 'diff' against ie. What channels did the user have at checkSeq but
	// no longer has.
	// In the event we have a lowSeq that will be used.
	// In the event we do not have a lowSeq but have a triggeredBy that will be used.
	// In the event we have neither lowSeq or triggeredBy the 'regular' seq value will be used.
	var checkSeq uint64
	if lowSeq > 0 {
		checkSeq = lowSeq
	} else if triggeredBy > 0 {
		checkSeq = triggeredBy
	} else {
		checkSeq = since
	}

	// Note
	// entry.EndSeq > checkSeq || entry.EndSeq == triggeredBy
	// The above check is used in a number of places and represents:
	// If there has been a revocation somewhere after the since value or we're in an interrupted revocation backfill
	// at the point a revocation occurred we should return this as a channel to revoke.

	accessibleChannels, err := user.InheritedCollectionChannels(scope, collection)
	if err != nil {
		return nil, err
	}
	// Get revoked roles
	rolesToRevoke := map[string]uint64{}
	roleHistory := user.RoleHistory()
	for roleName, history := range roleHistory {
		if !user.RoleNames().Contains(roleName) {
			for _, entry := range history.Entries {
				if entry.EndSeq > checkSeq || entry.EndSeq == triggeredBy {
					mostRecentEndSeq := history.Entries[len(history.Entries)-1]
					rolesToRevoke[roleName] = mostRecentEndSeq.EndSeq
				}
			}
		}
	}

	// Store revoked channels to return
	// addToCombined adds to this return map or updates if required based on requirement to have largest triggeredBy val
	combinedRevokedChannels := RevokedChannels{}

	// revokeChannelHistoryProcessing iterates over a principals channel history and if not accessible add to combined
	revokeChannelHistoryProcessing := func(princ Principal) {
		for chanName, history := range princ.CollectionChannelHistory(scope, collection) {
			if !accessibleChannels.Contains(chanName) {
				for _, entry := range history.Entries {
					if entry.EndSeq > checkSeq || entry.EndSeq == triggeredBy {
						mostRecentEndSeq := history.Entries[len(history.Entries)-1]
						combinedRevokedChannels.add(chanName, mostRecentEndSeq.EndSeq)
					}
				}
			}
		}
	}

	// Iterate over revoked roles and revoke ALL channels (current and previous) from revoked roles that we don't have