Method checkTupleToSubjectSet

internal/check/rewrites.go:242–287

checkTupleToSubjectSet rewrites the relation tuple to use the subject-set relation. Given a relation tuple like docs:readme#editor@user, and a tuple-to-subject-set rewrite with the relation "parent" and the computed subject-set relation "owner", the following checks will be performed: - query for

(
	tuple *relationTuple,
	subjectSet *ast.TupleToSubjectSet,
	restDepth int,
)

//
// * For each matching subject, then check if subject#owner@user.
func (e *Engine) checkTupleToSubjectSet(
	tuple *relationTuple,
	subjectSet *ast.TupleToSubjectSet,
	restDepth int,
) checkgroup.CheckFunc {
	if restDepth < 0 {
		e.d.Logger().Debug("reached max-depth, therefore this query will not be further expanded")
		return checkgroup.UnknownMemberFunc
	}

	e.d.Logger().
		WithField("request", tuple.String()).
		WithField("tuple to subject-set relation", subjectSet.Relation).
		WithField("tuple to subject-set computed", subjectSet.ComputedSubjectSetRelation).
		Trace("check tuple to subjectSet")

	return func(ctx context.Context, resultCh chan<- checkgroup.Result) {
		g := checkgroup.New(ctx)
		for nextPage, _ := keysetpagination.NewPaginator(); !nextPage.IsLast(); {
			var tuples []*relationTuple
			var err error
			tuples, nextPage, err = e.d.RelationTupleManager().GetRelationTuples(ctx, &query{
				Namespace: &tuple.Namespace,
				Object:    &tuple.Object,
				Relation:  &subjectSet.Relation,
			},
				nextPage.ToOptions()...)
			if err != nil {
				g.Add(checkgroup.ErrorFunc(err))
				return
			}

			for _, t := range tuples {
				if subSet, ok := t.Subject.(*relationtuple.SubjectSet); ok {
					g.Add(e.checkIsAllowed(ctx, &relationTuple{
						Namespace: subSet.Namespace,
						Object:    subSet.Object,
						Relation:  subjectSet.ComputedSubjectSetRelation,
						Subject:   tuple.Subject,
					}, restDepth-1, false))
				}
			}
		}
		resultCh <- g.Result()
	}
}