Class: CommandTower::Services::Admin::Users::RoleAssignmentPolicy

Inherits:
CommandTower::Services::ApplicationService show all
Defined in:
app/services/command_tower/services/admin/users.rb

Constant Summary

Constants inherited from CommandTower::ServiceBase

CommandTower::ServiceBase::ON_ARGUMENT_VALIDATION

Instance Method Summary collapse

Methods inherited from CommandTower::Services::ApplicationService

call, inherited

Methods included from Transactional

#fail_transaction!, #transaction

Methods inherited from CommandTower::ServiceBase

#command_tower_lifecycle, inherited, #internal_validate, #service_lifecycle_error_codes, #service_lifecycle_log_level, #validate!

Methods included from Logging::LifecycleDeclaration

included

Methods included from Execution::ContextAccess

#audit, #execution_context, #log_debug, #log_error, #log_info, #log_warn, #publish_event

Methods included from ArgumentValidation

included

Methods included from CommandTower::ServiceLogging

included

Instance Method Details

#call ⇒ Object 



273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
 
# File 'app/services/command_tower/services/admin/users.rb', line 273

def call
  desired = desired_roles.map(&:to_s)
  assignable = CommandTower::Authorization::AssignableRoles.names

  if desired.any? { |name| protected_role?(name) }
    return context.fail!(application_error: CommandTower::Errors::ForbiddenError.new)
  end

  unknown = desired.reject { |name| assignable.include?(name) }
  if unknown.any?
    return context.fail!(
      application_error: CommandTower::Errors::ValidationError.new(
        details: { roles: "unknown_or_unassignable" }
      )
    )
  end

  current = Array(target.roles).map(&:to_s)
  current_assignable = current.select { |name| assignable.include?(name) }
  newly_assigned = desired - current_assignable
  actor_grants = CommandTower::Authorization::EffectiveEntityGrants.for_user(actor)

  newly_assigned.each do |role_name|
    candidate_grants = CommandTower::Authorization::EffectiveEntityGrants.for_role(role_name)
    next if CommandTower::Authorization::EffectiveEntityGrants.subset?(candidate_grants, actor_grants)

    return context.fail!(application_error: CommandTower::Errors::ForbiddenError.new)
  end

  preserved = current.reject { |name| assignable.include?(name) }
  proposed = preserved + desired.uniq

  if target.id == actor.id && self_lockout?(actor_grants, proposed)
    return context.fail!(application_error: CommandTower::Errors::ForbiddenError.new)
  end

  context.desired_roles = desired.uniq
end