bright-wire-30388
10/04/2022, 8:00 PMedit
to also have something_else_editor_can_do
.
this.permits is disallowed (logs make that very obvious), but is there some other syntax to evaluate a different permit on self? (this.permit.install_draft
accomplished the same thing using code reuse, but that will only scale so far)
class GuideTemplate implements Namespace {
related: {
editors: SubjectSet<Group, "members">[]
viewers: SubjectSet<Group, "members">[]
}
permits = {
// either related group has view access
view: (ctx: Context): boolean =>
this.related.viewers.includes(ctx.subject) ||
this.related.editors.includes(ctx.subject),
// the related editors group can write
edit: (ctx: Context): boolean => this.related.editors.includes(ctx.subject),
// anyone who can view can install
install: (ctx: Context): boolean =>
this.related.viewers.includes(ctx.subject) ||
this.related.editors.includes(ctx.subject),
// editors can install regardless of publish state
install_draft: (ctx: Context): boolean => this.related.editors.includes(ctx.subject),
something_else_editor_can_do: (ctx: Context): boolean => this.permits.edit(ctx)
}
}
bright-wire-30388
10/04/2022, 8:24 PMrelated.self: GuideTemplate[]
now i’m allowed to use <http://permits.XXX|permits.XXX>: (ctx: Context): boolean => this.related.self.traverse(p => p.permits.edit(ctx))
that policy passes with these tuples:
GuideTemplate:001#viewers@(Group:consumers#members)
GuideTemplate:001#editors@(Group:cartographers#members)
// hacky self-reference
GuideTemplate:001#self@(GuideTemplate:001)
steep-lamp-91158
narrow-van-43826
10/05/2022, 12:48 PM