Method checkDirectAttribute

internal/engines/check.go:445–504

checkDirectAttribute constructs a CheckFunction that checks if a direct attribute permission check request is allowed or denied.

(
	request *base.PermissionCheckRequest,
)

// checkDirectAttribute constructs a CheckFunction that checks if a direct attribute
// permission check request is allowed or denied.
func (engine *CheckEngine) checkDirectAttribute(
	request *base.PermissionCheckRequest,
) CheckFunction {
	// We're returning a function here - this is the actual CheckFunction.
	return func(ctx context.Context) (*base.PermissionCheckResponse, error) {
		// Initial error declaration
		var err error

		// Create a new AttributeFilter with the entity type and ID from the request
		// and the requested permission.
		filter := &base.AttributeFilter{
			Entity: &base.EntityFilter{
				Type: request.GetEntity().GetType(),
				Ids:  []string{request.GetEntity().GetId()},
			},
			Attributes: []string{request.GetPermission()},
		}

		var val *base.Attribute

		// storageContext.NewContextualAttributes creates a new instance of ContextualAttributes based on the attributes
		// retrieved from the request context.
		val, err = storageContext.NewContextualAttributes(request.GetContext().GetAttributes()...).QuerySingleAttribute(filter)
		// An error occurred while querying the single attribute, so we return a denied response with empty metadata
		// and the error.
		if err != nil {
			return denied(emptyResponseMetadata()), err
		}

		if val == nil {
			// Use the data reader's QuerySingleAttribute method to find the relevant attribute
			val, err = engine.dataReader.QuerySingleAttribute(ctx, request.GetTenantId(), filter, request.GetMetadata().GetSnapToken())
			// If there was an error, return a denied response and the error.
			if err != nil {
				return denied(emptyResponseMetadata()), err
			}
		}

		// No attribute was found matching the provided filter. In this case, we return a denied response with empty metadata
		// and no error.
		if val == nil {
			return denied(emptyResponseMetadata()), nil
		}

		// Unmarshal the attribute value into a BoolValue message.
		var msg base.BooleanValue
		if err := val.GetValue().UnmarshalTo(&msg); err != nil {
			// If there was an error unmarshaling, return a denied response and the error.
			return denied(emptyResponseMetadata()), err
		}

		// If the attribute's value is true, return an allowed response.
		if msg.Data {
			return allowed(emptyResponseMetadata()), nil
		}

		// If the attribute's value is not true, return a denied response.
		return denied(emptyResponseMetadata()), nil