diff options
Diffstat (limited to 'src/api')
| -rw-r--r-- | src/api/login.rs | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/src/api/login.rs b/src/api/login.rs index 0dc74e5..694ad0a 100644 --- a/src/api/login.rs +++ b/src/api/login.rs @@ -715,6 +715,18 @@ pub(crate) async fn whoami( let swarm = state.swarm_id().await; let replica = state.doc.read().await; let entry = registry::user(&replica.doc, &user.0); + // What the request may do: the user's capabilities, and with a token saying less, + // what both give (`Capability::meet`), as `api::access::authorize` decides. + let may = entry.as_ref().map(|entry| { + match token.as_ref().and_then(|token| token.claims.limit.as_ref()) { + None => entry.caps.values().cloned().collect::<Vec<_>>(), + Some(limit) => entry + .caps + .values() + .flat_map(|cap| limit.iter().filter_map(|outer| cap.meet(outer))) + .collect(), + } + }); let token = token.map(|Extension(token)| { json!({ "issuer": token.claims.issuer, @@ -732,6 +744,7 @@ pub(crate) async fn whoami( "via": via.0, "registry": registry::exists(&replica.doc), "caps": entry.as_ref().map(|entry| &entry.caps), + "may": may, "disabled": entry.as_ref().map(|entry| entry.disabled), "token": token, })) |