Method renderPermissions

site/site.go:555–580

renderPermissions checks all the site-wide permissions for the given actor and returns an HTML-escaped JSON string suitable for embedding in a meta tag.

(ctx context.Context, actor rbac.Subject)

// given actor and returns an HTML-escaped JSON string suitable for
// embedding in a meta tag.
func (h *Handler) renderPermissions(ctx context.Context, actor rbac.Subject) string {
	response := make(codersdk.AuthorizationResponse)
	for k, v := range permissionChecks {
		// Resolve the "me" sentinel so permission checks
		// run against the actual actor, matching the
		// API-side handling in coderd/authorize.go.
		ownerID := v.Object.OwnerID
		if ownerID == codersdk.Me {
			ownerID = actor.ID
		}
		obj := rbac.Object{
			ID:          v.Object.ResourceID,
			Owner:       ownerID,
			OrgID:       v.Object.OrganizationID,
			AnyOrgOwner: v.Object.AnyOrgOwner,
			Type:        string(v.Object.ResourceType),
		}
		err := h.opts.Authorizer.Authorize(ctx, actor, policy.Action(v.Action), obj)
		response[k] = err == nil
	}
	data, err := json.Marshal(response)
	if err != nil {
		return ""
	}
	return html.EscapeString(string(data))
}

// noopResponseWriter is a response writer that does nothing.
type noopResponseWriter struct{}