23 lines
884 B
Go
23 lines
884 B
Go
package domain
|
|
|
|
import (
|
|
"errors"
|
|
|
|
"git.cin.su/m/Assistant/contracts/authority"
|
|
"git.cin.su/m/Assistant/contracts/identity"
|
|
)
|
|
|
|
var ErrInvalidCreatorGrant = errors.New("creator grant must be active, global, and revisioned")
|
|
|
|
// ValidateCreatorGrant validates the narrow bootstrap authority used by
|
|
// Domovoy. Execution paths must still perform their own target/revision checks.
|
|
func ValidateCreatorGrant(binding identity.PrincipalBinding, scope authority.Scope, grant authority.AuthorityGrant) error {
|
|
if binding.ActorID == "" || binding.PrincipalID == "" || !binding.Active ||
|
|
!scope.Global || scope.ID == "" ||
|
|
grant.ID == "" || grant.Class != authority.GrantClassCreator || !grant.Active || grant.Revision == 0 ||
|
|
grant.ActorID != binding.ActorID || grant.PrincipalID != binding.PrincipalID || grant.ScopeID != scope.ID {
|
|
return ErrInvalidCreatorGrant
|
|
}
|
|
return nil
|
|
}
|