Lines 278-286
sub validate_query_parameters {
Link Here
|
278 |
|
278 |
|
279 |
=head3 allow_owner |
279 |
=head3 allow_owner |
280 |
|
280 |
|
281 |
Allows access to object for its owner. |
281 |
Allows access to resource for its owner. |
282 |
|
282 |
|
283 |
There are endpoints that should allow access for the object owner even if they |
283 |
There are endpoints that should allow access for the resource owner even if they |
284 |
do not have the required permission, e.g. access an own reserve. This can be |
284 |
do not have the required permission, e.g. access an own reserve. This can be |
285 |
achieved by defining the operation as follows: |
285 |
achieved by defining the operation as follows: |
286 |
|
286 |
|
Lines 303-314
sub allow_owner {
Link Here
|
303 |
|
303 |
|
304 |
return unless $authorization->{'allow-owner'}; |
304 |
return unless $authorization->{'allow-owner'}; |
305 |
|
305 |
|
306 |
return check_object_ownership($c, $user) if $user and $c; |
306 |
return check_resource_ownership($c, $user) if $user and $c; |
307 |
} |
307 |
} |
308 |
|
308 |
|
309 |
=head3 allow_guarantor |
309 |
=head3 allow_guarantor |
310 |
|
310 |
|
311 |
Same as "allow_owner", but checks if the object is owned by one of C<$user>'s |
311 |
Same as "allow_owner", but checks if the resource is owned by one of C<$user>'s |
312 |
guarantees. |
312 |
guarantees. |
313 |
|
313 |
|
314 |
=cut |
314 |
=cut |
Lines 322-328
sub allow_guarantor {
Link Here
|
322 |
|
322 |
|
323 |
my $guarantees = $user->guarantee_relationships->guarantees->as_list; |
323 |
my $guarantees = $user->guarantee_relationships->guarantees->as_list; |
324 |
foreach my $guarantee (@{$guarantees}) { |
324 |
foreach my $guarantee (@{$guarantees}) { |
325 |
return 1 if check_object_ownership($c, $guarantee); |
325 |
return 1 if check_resource_ownership($c, $guarantee); |
326 |
} |
326 |
} |
327 |
} |
327 |
} |
328 |
|
328 |
|
329 |
- |
|
|