Line data    Source code

       1              : use anyhow::{bail, Result};
       2              : use utils::auth::{Claims, Scope};
       3              : use utils::id::TenantId;
       4              : 
       5              : pub fn check_permission(claims: &Claims, tenant_id: Option<TenantId>) -> Result<()> {
       6          174 :     match (&claims.scope, tenant_id) {
       7              :         (Scope::Tenant, None) => {
       8            0 :             bail!("Attempt to access management api with tenant scope. Permission denied")
       9              :         }
      10          129 :         (Scope::Tenant, Some(tenant_id)) => {
      11          129 :             if claims.tenant_id.unwrap() != tenant_id {
      12            5 :                 bail!("Tenant id mismatch. Permission denied")
      13          124 :             }
      14          124 :             Ok(())
      15              :         }
      16            1 :         (Scope::PageServerApi, _) => bail!("PageServerApi scope makes no sense for Safekeeper"),
      17           44 :         (Scope::SafekeeperData, _) => Ok(()),
      18              :     }
      19          174 : }