steid

steid/src/application/authz.rs

1.0 KBCode·Blame·Raw

11e7a39feat: create_repo use case24d	1	//! Authorization predicates shared between use cases.
	2	//!
	3	//! One answer per question, in one place. A predicate copied into a second use case
	4	//! is a predicate that will eventually disagree with itself — and an authorization
	5	//! check that disagrees with itself fails open somewhere.
	6
	7	use crate::domain::{Actor, Organization, Role, repository::MembershipRepository};
	8
	9	use super::error::Result;
	10
	11	/// Whether the actor owns this organisation.
	12	///
	13	/// Owner is strictly stronger than membership: a member may read what they can see,
	14	/// but editing the profile, creating a repository, and pushing are all owner-only.
	15	/// "Signed in" quietly becoming "allowed" is the usual way this goes wrong.
	16	pub(crate) async fn is_org_owner(
	17	org: &Organization,
	18	actor: &Actor,
	19	memberships: &impl MembershipRepository,
	20	) -> Result<bool> {
	21	let Some(user_id) = actor.user_id() else {
	22	return Ok(false);
	23	};
	24
	25	Ok(memberships
	26	.find(&org.id, user_id)
	27	.await?
	28	.is_some_and(\|membership\| membership.role == Role::Owner))
	29	}