|
Lines 278-286
sub validate_query_parameters {
Link Here
|
| 278 |
|
278 |
|
| 279 |
=head3 allow_owner |
279 |
=head3 allow_owner |
| 280 |
|
280 |
|
| 281 |
Allows access to object for its owner. |
281 |
Allows access to resource for its owner. |
| 282 |
|
282 |
|
| 283 |
There are endpoints that should allow access for the object owner even if they |
283 |
There are endpoints that should allow access for the resource owner even if they |
| 284 |
do not have the required permission, e.g. access an own reserve. This can be |
284 |
do not have the required permission, e.g. access an own reserve. This can be |
| 285 |
achieved by defining the operation as follows: |
285 |
achieved by defining the operation as follows: |
| 286 |
|
286 |
|
|
Lines 303-314
sub allow_owner {
Link Here
|
| 303 |
|
303 |
|
| 304 |
return unless $authorization->{'allow-owner'}; |
304 |
return unless $authorization->{'allow-owner'}; |
| 305 |
|
305 |
|
| 306 |
return check_object_ownership($c, $user) if $user and $c; |
306 |
return check_resource_ownership($c, $user) if $user and $c; |
| 307 |
} |
307 |
} |
| 308 |
|
308 |
|
| 309 |
=head3 allow_guarantor |
309 |
=head3 allow_guarantor |
| 310 |
|
310 |
|
| 311 |
Same as "allow_owner", but checks if the object is owned by one of C<$user>'s |
311 |
Same as "allow_owner", but checks if the resource is owned by one of C<$user>'s |
| 312 |
guarantees. |
312 |
guarantees. |
| 313 |
|
313 |
|
| 314 |
=cut |
314 |
=cut |
|
Lines 322-328
sub allow_guarantor {
Link Here
|
| 322 |
|
322 |
|
| 323 |
my $guarantees = $user->guarantee_relationships->guarantees->as_list; |
323 |
my $guarantees = $user->guarantee_relationships->guarantees->as_list; |
| 324 |
foreach my $guarantee (@{$guarantees}) { |
324 |
foreach my $guarantee (@{$guarantees}) { |
| 325 |
return 1 if check_object_ownership($c, $guarantee); |
325 |
return 1 if check_resource_ownership($c, $guarantee); |
| 326 |
} |
326 |
} |
| 327 |
} |
327 |
} |
| 328 |
|
328 |
|
| 329 |
- |
|
|