Method Check

internal/engines/cache/check.go:47–97

Check performs a permission check for a given request, using the cached results if available.

(ctx context.Context, request *base.PermissionCheckRequest)

// Check performs a permission check for a given request, using the cached results if available.
func (c *CheckEngineWithCache) Check(ctx context.Context, request *base.PermissionCheckRequest) (response *base.PermissionCheckResponse, err error) {
	// Retrieve entity definition
	var en *base.EntityDefinition
	en, _, err = c.schemaReader.ReadEntityDefinition(ctx, request.GetTenantId(), request.GetEntity().GetType(), request.GetMetadata().GetSchemaVersion())
	if err != nil {
		return &base.PermissionCheckResponse{
			Can: base.CheckResult_CHECK_RESULT_DENIED,
			Metadata: &base.PermissionCheckResponseMetadata{
				CheckCount: 0,
			},
		}, err
	}

	isRelational := engines.IsRelational(en, request.GetPermission())

	// Try to get the cached result for the given request.
	res, found := c.getCheckKey(request, isRelational)

	// If a cached result is found, handle exclusion and return the result.
	if found {
		// Increase the hit count in the metrics.
		c.cacheHitHistogram.Record(ctx, 1)

		// If the request doesn't have the exclusion flag set, return the cached result.
		return &base.PermissionCheckResponse{
			Can:      res.GetCan(),
			Metadata: &base.PermissionCheckResponseMetadata{},
		}, nil
	}

	// Perform the actual permission check using the provided request.
	cres, err := c.checker.Check(ctx, request)
	// Check if there's an error or the response is nil, and return the result.
	if err != nil {
		return &base.PermissionCheckResponse{
			Can: base.CheckResult_CHECK_RESULT_DENIED,
			Metadata: &base.PermissionCheckResponseMetadata{
				CheckCount: 0,
			},
		}, err
	}

	// Add to histogram the response

	c.setCheckKey(request, &base.PermissionCheckResponse{
		Can:      cres.GetCan(),
		Metadata: &base.PermissionCheckResponseMetadata{},
	}, isRelational)
	// Return the result of the permission check.
	return cres, err
}

// GetCheckKey retrieves the value for the given key from the EngineKeys cache.
// It returns the PermissionCheckResponse if the key is found, and a boolean value