Struct denyContainingAuthorizer

usecases/objects/references_namespace_test.go:1129–1131

denyContainingAuthorizer is a test-only authorizer that denies any Authorize call whose resources include a path containing the configured substring, and allows everything else. Used to model "user has UPDATE on source but not READ on target" without pulling in the full RBAC stack.

// and allows everything else. Used to model "user has UPDATE on source but
// not READ on target" without pulling in the full RBAC stack.
type denyContainingAuthorizer struct {
	deny string
}

func (a *denyContainingAuthorizer) Authorize(ctx context.Context, principal *models.Principal, verb string, resources ...string) error {
	for _, r := range resources {