Set sets a permission for a specific scope
(scope PermissionScope, level PermissionLevel)
| 137 | |
| 138 | // Set sets a permission for a specific scope |
| 139 | func (p *Permissions) Set(scope PermissionScope, level PermissionLevel) { |
| 140 | permissionsOpsLog.Printf("Setting permission: scope=%s, level=%s", scope, level) |
| 141 | if p.shorthand != "" { |
| 142 | // Convert from shorthand to explicit map, preserving all shorthand-implied permissions. |
| 143 | // This mirrors the hasAll expansion below so that callers adding a single scope to a |
| 144 | // shorthand (e.g. adding copilot-requests: write to read-all) do not lose the remaining |
| 145 | // shorthand-implied permissions. |
| 146 | shorthand := p.shorthand |
| 147 | permissionsOpsLog.Printf("Converting from shorthand %s to explicit map", shorthand) |
| 148 | p.shorthand = "" |
| 149 | if p.permissions == nil { |
| 150 | p.permissions = make(map[PermissionScope]PermissionLevel) |
| 151 | } |
| 152 | var shorthandLevel PermissionLevel |
| 153 | switch shorthand { |
| 154 | case "read-all": |
| 155 | shorthandLevel = PermissionRead |
| 156 | case "write-all": |
| 157 | shorthandLevel = PermissionWrite |
| 158 | case "none": |
| 159 | shorthandLevel = PermissionNone |
| 160 | } |
| 161 | for _, s := range GetAllPermissionScopes() { |
| 162 | if _, exists := p.permissions[s]; !exists { |
| 163 | // id-token does not support the read level |
| 164 | if s == PermissionIdToken && shorthandLevel == PermissionRead { |
| 165 | continue |
| 166 | } |
| 167 | p.permissions[s] = shorthandLevel |
| 168 | } |
| 169 | } |
| 170 | } |
| 171 | if p.hasAll { |
| 172 | // Convert from all to explicit map |
| 173 | permissionsOpsLog.Printf("Converting from all:%s to explicit map", p.allLevel) |
| 174 | if p.permissions == nil { |
| 175 | p.permissions = make(map[PermissionScope]PermissionLevel) |
| 176 | } |
| 177 | // Expand all permissions to explicit permissions first |
| 178 | for _, s := range GetAllPermissionScopes() { |
| 179 | if _, exists := p.permissions[s]; !exists { |
| 180 | p.permissions[s] = p.allLevel |
| 181 | } |
| 182 | } |
| 183 | p.hasAll = false |
| 184 | p.allLevel = "" |
| 185 | } |
| 186 | p.permissions[scope] = level |
| 187 | } |
| 188 | |
| 189 | // GetExplicit returns the permission level only if the scope was explicitly declared in the |
| 190 | // permissions map. Unlike Get, it never returns a level derived from shorthand (read-all / |