CanAssignRole is a helper function that returns true if the user can assign the specified role. This also can be used for removing a role. This is a simple implementation for now.
(subjectHasRoles ExpandableRoles, assignedRole RoleIdentifier)
| 815 | // the specified role. This also can be used for removing a role. |
| 816 | // This is a simple implementation for now. |
| 817 | func CanAssignRole(subjectHasRoles ExpandableRoles, assignedRole RoleIdentifier) bool { |
| 818 | // For CanAssignRole, we only care about the names of the roles. |
| 819 | roles := subjectHasRoles.Names() |
| 820 | |
| 821 | for _, myRole := range roles { |
| 822 | if myRole.OrganizationID != uuid.Nil && myRole.OrganizationID != assignedRole.OrganizationID { |
| 823 | // Org roles only apply to the org they are assigned to. |
| 824 | continue |
| 825 | } |
| 826 | |
| 827 | allowedAssignList, ok := assignRoles[myRole.Name] |
| 828 | if !ok { |
| 829 | continue |
| 830 | } |
| 831 | |
| 832 | if allowedAssignList[assignedRole.Name] { |
| 833 | return true |
| 834 | } |
| 835 | } |
| 836 | return false |
| 837 | } |
| 838 | |
| 839 | // RoleByName returns the permissions associated with a given role name. |
| 840 | // This allows just the role names to be stored and expanded when required. |
no test coverage detected