resourcelevel

func Apply ¶

func Apply(claims *resource.Claims, pr *persona.Registry, method string) (*resource.Claims, error)

Apply narrows a caller's resource claims to their persona's portal resources level (#2225): none refuses every resources route, shared reads the caller's own folder, their persona's folder and Global and writes nothing, own drops the persona folders and keeps the caller's own (which an administrator still sees), and persona leaves the claims as they were. An administrator is held to none of it.

A person of an external persona never reads Global (#2257), and writes to their own folder only when the persona lets its people upload (#2258); nothing gives them a persona folder's write, which takes persona-admin.