Function has_default_resource_access

core/station/impl/src/core/authorization.rs:70–117

Checks if the user had access to the resource based on default rules (non-permission based). e.g. the user has access to their own user record, etc...

(user: &User, resource: &Resource)

///
/// e.g. the user has access to their own user record, etc...
fn has_default_resource_access(user: &User, resource: &Resource) -> bool {
    match &resource {
        &Resource::Request(RequestResourceAction::Read(ResourceId::Id(request_id))) => {
            match REQUEST_REPOSITORY.find_indexed_fields_by_request_id(request_id) {
                None => false,
                Some(request) => {
                    if request.approved_by.iter().any(|id| *id == user.id)
                        || request.rejected_by.iter().any(|id| *id == user.id)
                        || request.requested_by == user.id
                    {
                        return true;
                    }

                    let validator = RequestApprovalRightsEvaluator::new(
                        REQUEST_APPROVE_RIGHTS_REQUEST_POLICY_RULE_EVALUATOR.clone(),
                        user.id,
                        &request,
                    );

                    validator.evaluate().unwrap_or(false)
                }
            }
        }

        Resource::User(UserResourceAction::Read(ResourceId::Id(user_id))) => {
            // The user has access to their own user record.
            *user_id == user.id
        }
        Resource::Notification(action) => {
            match action {
                // The user can always list notifications.
                NotificationResourceAction::List => true,
                // The user cannot update arbitrary notifications.
                NotificationResourceAction::Update(ResourceId::Any) => false,
                NotificationResourceAction::Update(ResourceId::Id(id)) => {
                    let key = NotificationKey { id: *id };
                    if let Some(notification) = NOTIFICATION_REPOSITORY.get(&key) {
                        // The user has access to the user's own notifications.
                        notification.target_user_id == user.id
                    } else {
                        false
                    }
                }
            }
        }
        _ => false,
    }
}

/// This function checks if the user has the required privilege to perform the given action.
///