Method is_allowed

core/station/impl/src/core/authorization.rs:23–64

(ctx: &CallContext, resource: &Resource)

impl Authorization {
    pub fn is_allowed(ctx: &CallContext, resource: &Resource) -> bool {
        // If the call is made by the system, then the access is granted by default.
        if ctx.caller_is_controller_or_self() {
            return true;
        }

        // Gets the expanded list of resources.
        // e.g. if the resource is for account(1), then the list will expand to [account(1), account(any)]
        let resources = resource.to_expanded_list();

        // Checks if the caller has access to the requested resource.
        resources.iter().any(|resource| {
            let permission = PERMISSION_SERVICE.get_permission(resource);

            // Checks if the resource is public, if so, then the access is granted.
            if permission.allowed_public() {
                return true;
            }

            if let Some(user) = ctx.user() {
                // If the user is not active, then the access is denied.
                if !user.is_active() {
                    return false;
                }

                // If the resource is available to authenticated users, then the access is granted.
                if permission.allowed_authenticated() {
                    return true;
                }

                // Validates if the user has access to the resource based on the default rules (non-permission based).
                if has_default_resource_access(user, resource) {
                    return true;
                }

                // Checks if the user has access to the resource based on the system permissions.
                return permission.is_allowed(user);
            }

            false
        })
    }
}

/// Checks if the user had access to the resource based on default rules (non-permission based).