Line data    Source code

       1              : use utils::auth::{AuthError, Claims, Scope};
       2              : use utils::id::TenantId;
       3              : 
       4          190 : pub fn check_permission(claims: &Claims, tenant_id: Option<TenantId>) -> Result<(), AuthError> {
       5          190 :     match (&claims.scope, tenant_id) {
       6            0 :         (Scope::Tenant, None) => Err(AuthError(
       7            0 :             "Attempt to access management api with tenant scope. Permission denied".into(),
       8            0 :         )),
       9          149 :         (Scope::Tenant, Some(tenant_id)) => {
      10          149 :             if claims.tenant_id.unwrap() != tenant_id {
      11            5 :                 return Err(AuthError("Tenant id mismatch. Permission denied".into()));
      12          144 :             }
      13          144 :             Ok(())
      14              :         }
      15            1 :         (Scope::PageServerApi, _) => Err(AuthError(
      16            1 :             "PageServerApi scope makes no sense for Safekeeper".into(),
      17            1 :         )),
      18           40 :         (Scope::SafekeeperData, _) => Ok(()),
      19              :     }
      20          190 : }