Function authorizePreds

edgraph/access.go:620–658

(ctx context.Context, userData *userData, preds []string,
	aclOp *acl.Operation)

}

func authorizePreds(ctx context.Context, userData *userData, preds []string,
	aclOp *acl.Operation) *authPredResult {

	if !worker.AclCachePtr.Loaded() {
		RefreshACLs(ctx)
	}

	userId := userData.userId
	groupIds := userData.groupIds
	ns := userData.namespace
	blockedPreds := make(map[string]struct{})
	for _, pred := range preds {
		nsPred := x.NamespaceAttr(ns, pred)
		if err := worker.AclCachePtr.AuthorizePredicate(groupIds, nsPred, aclOp); err != nil {
			logAccess(&accessEntry{
				userId:    userId,
				groups:    groupIds,
				preds:     preds,
				operation: aclOp,
				allowed:   false,
			})
			blockedPreds[pred] = struct{}{}
		}
	}
	if worker.HasAccessToAllPreds(ns, groupIds, aclOp) {
		// Setting allowed to nil allows access to all predicates. Note that the access to ACL
		// predicates will still be blocked.
		return &authPredResult{allowed: nil, blocked: blockedPreds}
	}
	// User can have multiple permission for same predicate, add predicate
	allowedPreds := make([]string, 0, len(worker.AclCachePtr.GetUserPredPerms(userId)))
	// only if the acl.Op is covered in the set of permissions for the user
	for predicate, perm := range worker.AclCachePtr.GetUserPredPerms(userId) {
		if (perm & aclOp.Code) > 0 {
			allowedPreds = append(allowedPreds, predicate)
		}
	}
	return &authPredResult{allowed: allowedPreds, blocked: blockedPreds}
}

// authorizeAlter parses the Schema in the operation and authorizes the operation
// using the worker.AclCachePtr. It will return error if any one of the predicates