remove debug
This commit is contained in:
@@ -118,30 +118,21 @@ func CheckPermissionWithContext(operation, principal, owner, resourcePolicy, res
|
|||||||
}
|
}
|
||||||
|
|
||||||
func checkPermission(operation, principal, owner, resourcePolicy, resourceARN string, ctx *PolicyContext) bool {
|
func checkPermission(operation, principal, owner, resourcePolicy, resourceARN string, ctx *PolicyContext) bool {
|
||||||
fmt.Printf("DEBUG: checkPermission op=%s princ=%s owner=%s policyLen=%d defaultAllow=%v\n",
|
|
||||||
operation, principal, owner, len(resourcePolicy), ctx != nil && ctx.DefaultAllow)
|
|
||||||
if resourcePolicy != "" {
|
|
||||||
fmt.Printf("DEBUG: policy content: %s\n", resourcePolicy)
|
|
||||||
}
|
|
||||||
|
|
||||||
// Owner always has permission
|
// Owner always has permission
|
||||||
if principal == owner {
|
if principal == owner {
|
||||||
fmt.Printf("DEBUG: Allowed by Owner check\n")
|
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
|
|
||||||
if hasIdentityPermission(operation, ctx) {
|
if hasIdentityPermission(operation, ctx) {
|
||||||
fmt.Printf("DEBUG: Allowed by Identity check\n")
|
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
|
|
||||||
// If no policy is provided, use default allow if enabled
|
// If no policy is provided, use default allow if enabled
|
||||||
if resourcePolicy == "" {
|
if resourcePolicy == "" {
|
||||||
if ctx != nil && ctx.DefaultAllow {
|
if ctx != nil && ctx.DefaultAllow {
|
||||||
fmt.Printf("DEBUG: Allowed by DefaultAllow\n")
|
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
fmt.Printf("DEBUG: Denied by DefaultAllow=false (no policy)\n")
|
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -183,9 +174,10 @@ func checkPermission(operation, principal, owner, resourcePolicy, resourceARN st
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Statement matches - check effect
|
// Statement matches - check effect
|
||||||
if stmt.Effect == "Allow" {
|
switch stmt.Effect {
|
||||||
|
case "Allow":
|
||||||
hasAllow = true
|
hasAllow = true
|
||||||
} else if stmt.Effect == "Deny" {
|
case "Deny":
|
||||||
// Explicit deny always wins
|
// Explicit deny always wins
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user