feat: rewrite permission logic to no permissions having lowest priority #86
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Instead of giving
NO_PERMISSIONS
a higher priority than all the other priorities, which allows for weird blocking of access if you have both MANAGE PERMISSIONS as well as NO_PERMISSIONS, this PR will modify the permission logic to be giving you the access of the highest allowed permissions based on the default permission, your user permissions, as well as each of your groups permissions.In order to check what the type is that gave you access, we start with type fallback, then if the user permission prioerity is strictly higher than the fallback one, we change the type to user and if after that any of the group permissions have a strictly higher priority, we consider the group to be the type that granted this access.
For example, if the default permission is READ and your user also has explicit READ permissions, we consider the type to still be fallback (the fact that the user has read access does not grant anything additional above the defaults).
By using this logic and assigning NO_PERMISSIONS the lowest priority, you automatically solve the problem that if you are a member of two groups and one group gives you MANAGE access and the other one NO PERMISSIONS, you end up with no permissions in the current state (in the state with this pr, you would end up with MANAGE).
Because of the changes in this PR, this also Implements #80
This also might address #83, though without the use of an extra config variable