Function intersectAllow

coderd/rbac/allowlist.go:244–272

intersectAllow returns the set of permit entries that satisfy both the scope element and the database allow list.

(scopeElem AllowListElement, dbList []AllowListElement)

// intersectAllow returns the set of permit entries that satisfy both the scope
// element and the database allow list.
func intersectAllow(scopeElem AllowListElement, dbList []AllowListElement) []AllowListElement {
	// Scope element is wildcard -> intersection is db list.
	if scopeElem.Type == policy.WildcardSymbol && scopeElem.ID == policy.WildcardSymbol {
		return dbList
	}

	result := make([]AllowListElement, 0)
	for _, dbElem := range dbList {
		// DB entry wildcard -> keep scope element.
		if dbElem.Type == policy.WildcardSymbol && dbElem.ID == policy.WildcardSymbol {
			result = append(result, scopeElem)
			continue
		}

		if !typeMatches(scopeElem.Type, dbElem.Type) {
			continue
		}

		if !idMatches(scopeElem.ID, dbElem.ID) {
			continue
		}

		result = append(result, AllowListElement{
			Type: intersectType(scopeElem.Type, dbElem.Type),
			ID:   intersectID(scopeElem.ID, dbElem.ID),
		})
	}
	return result
}

func typeMatches(scopeType, dbType string) bool {
	return scopeType == dbType || scopeType == policy.WildcardSymbol || dbType == policy.WildcardSymbol