43
}
44
46
>
47
>
var hasRole Role
48
>
switch metadata.Scope {
49
>
case api.ScopeCluster:
50
>
hasRole = claims.System
51
>
case api.ScopeNamespace:
52
>
// Note: system-level claims apply across all namespaces.
53
>
// Note: if claims.Namespace is nil or target.Namespace is not found, the lookup will return zero.
54
>
hasRole = claims.System | claims.Namespaces[target.Namespace]
55
default:
56
return resultDeny, nil
57
}
58
60
>
result := Result{Decision: DecisionAllow}
61
>
result.Principal = &commonpb.Principal{Type: claims.AuthType, Name: claims.Subject}
62
>
return result, nil
63
>
}
64
>
return resultDeny, nil
65
}
66
67
// Convert from api.Access to Role
69
>
switch access {
70
>
case api.AccessReadOnly:
71
>
return RoleReader
72
>
case api.AccessWrite:
73
>
return RoleWriter
74
>
default:
75
>
return RoleAdmin
76
}
77
}