Middleware to authorize a request Checks if the caller is authorized to access all the requested resources. If the provided list of resources is empty, the caller is by default unauthorized.
(ctx: &CallContext, resources: &[Resource])
| 18 | /// |
| 19 | /// If the provided list of resources is empty, the caller is by default unauthorized. |
| 20 | pub fn authorize(ctx: &CallContext, resources: &[Resource]) { |
| 21 | SYSTEM_SERVICE.assert_system_readiness(); |
| 22 | |
| 23 | if resources.is_empty() { |
| 24 | trap("Unauthorized access: no resource provided"); |
| 25 | } |
| 26 | |
| 27 | let mut unauthorized_resources: Vec<String> = Vec::new(); |
| 28 | let allowed_resources = resources |
| 29 | .iter() |
| 30 | .map(|resource| { |
| 31 | let allowed = Authorization::is_allowed(ctx, resource); |
| 32 | |
| 33 | if !allowed { |
| 34 | unauthorized_resources.push(format!("{resource}")); |
| 35 | } |
| 36 | |
| 37 | allowed |
| 38 | }) |
| 39 | .collect::<Vec<bool>>(); |
| 40 | |
| 41 | if allowed_resources.contains(&false) { |
| 42 | trap(&format!( |
| 43 | "Unauthorized access to resources: {}", |
| 44 | unauthorized_resources.join(", ") |
| 45 | )); |
| 46 | } |
| 47 | } |
| 48 | |
| 49 | pub fn use_canister_call_metric<T>(called_method: &str, result: &ApiResult<T>) |
| 50 | where |