Function AuthorizeGuardians

edgraph/access.go:1147–1171

AuthorizeGuardians authorizes the operation for users which belong to Guardians group. NOTE: The caller should not wrap the error returned. If needed, propagate the GRPC error code.

(ctx context.Context)

// AuthorizeGuardians authorizes the operation for users which belong to Guardians group.
// NOTE: The caller should not wrap the error returned. If needed, propagate the GRPC error code.
func AuthorizeGuardians(ctx context.Context) error {
	if worker.Config.AclSecretKey == nil {
		// the user has not turned on the acl feature
		return nil
	}

	userData, err := extractUserAndGroups(ctx)
	switch {
	case err == x.ErrNoJwt:
		return status.Error(codes.PermissionDenied, err.Error())
	case err != nil:
		return status.Error(codes.Unauthenticated, err.Error())
	default:
		userId := userData.userId
		groupIds := userData.groupIds

		if !x.IsSuperAdmin(groupIds) {
			// Deny access for members of non-guardian groups
			return status.Error(codes.PermissionDenied, fmt.Sprintf("Only guardians are "+
				"allowed access. User '%v' is not a member of guardians group.", userId))
		}
	}

	return nil
}

/*
addUserFilterToQuery applies makes sure that a user can access only its own