Method authorize

db/functions/function.go:264–299

Authorizes a User against the function config's Allow object: - The user's name must be contained in Users, OR - The user must have a role contained in Roles, OR - The user must have access to a channel contained in Channels. In Roles and Channels, patterns of the form `${param}` are expanded using

(user auth.User, args map[string]any)

// - The user must have access to a channel contained in Channels.
// In Roles and Channels, patterns of the form `${param}` are expanded using `args` and `user`.
func (fn *functionImpl) authorize(user auth.User, args map[string]any) error {
	allow := fn.Allow
	if user == nil {
		return nil // User is admin
	} else if allow != nil { // No Allow object means admin-only
		if allow.Users.Contains(user.Name()) {
			return nil // User is explicitly allowed
		}
		userRoles := user.RoleNames()
		for _, rolePattern := range allow.Roles {
			if role, err := expandPattern(rolePattern, args, user); err != nil {
				return err
			} else if userRoles.Contains(role) {
				return nil // User has one of the allowed roles
			}
		}
		// Check if the user has access to one of the given channels.
		for _, channelPattern := range allow.Channels {
			if channelPattern == channels.AllChannelWildcard {
				return nil
			}
			channel, err := expandPattern(channelPattern, args, user)
			if err != nil {
				return err
			}
			canSee, err := user.CanSeeCollectionChannel(base.DefaultScope, base.DefaultCollection, channel)
			if err != nil {
				return err
			}
			if canSee {
				return nil // User has access to one of the allowed channels
			}
		}
	}
	return user.UnauthError(base.HTTPErrorf(http.StatusForbidden, "You are not allowed to call %s %q", fn.typeName, fn.name))
}

// Expands patterns of the form `${param}` in `pattern`, looking up each such
// `param` in the `args` map and substituting its value.