46 lines
1.3 KiB
Go
46 lines
1.3 KiB
Go
|
package accesspolicy
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
|
||
|
|
"github.com/Tencent/WeKnora/internal/types"
|
||
|
|
)
|
||
|
|
|
||
|
|
type executionDependencyKey struct{}
|
||
|
|
|
||
|
|
type executionDependency struct {
|
||
|
|
tenant uint64
|
||
|
|
owner string
|
||
|
|
}
|
||
|
|
|
||
|
|
// WithExecutionDependency is only for server-verified bindings of an authorized
|
||
|
|
// resource. It never changes publication, list visibility, or write ownership.
|
||
|
|
func WithExecutionDependency(ctx context.Context, tenant uint64, kind, id, owner string) context.Context {
|
||
|
|
bindings := map[string]executionDependency{}
|
||
|
|
if previous, ok := ctx.Value(executionDependencyKey{}).(map[string]executionDependency); ok {
|
||
|
|
for key, binding := range previous {
|
||
|
|
bindings[key] = binding
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if tenant != 0 && id != "" && owner != "" {
|
||
|
|
bindings[kind+":"+id] = executionDependency{tenant, owner}
|
||
|
|
}
|
||
|
|
return context.WithValue(ctx, executionDependencyKey{}, bindings)
|
||
|
|
}
|
||
|
|
|
||
|
|
func CanExecuteDependency(ctx context.Context, tenant uint64, kind, id, owner string) bool {
|
||
|
|
current, ok := types.TenantIDFromContext(ctx)
|
||
|
|
if !ok || tenant == 0 || tenant != current || owner == "" || Hidden(ctx, kind, id) {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
module := kind
|
||
|
|
if module == "skills" {
|
||
|
|
module = "agents"
|
||
|
|
}
|
||
|
|
if !Allowed(ctx, module+".read") {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
bindings, _ := ctx.Value(executionDependencyKey{}).(map[string]executionDependency)
|
||
|
|
return bindings[kind+":"+id] == (executionDependency{tenant, owner})
|
||
|
|
}
|