resourcelevel

func Apply ¶

func Apply(claims *resource.Claims, pr *persona.Registry, method string) (*resource.Claims, error)

Apply narrows a caller's resource claims to their persona's portal resources level (#2225): none refuses every resources route, shared reads the caller's own folder, their persona's folder and Global and writes nothing, own drops the persona folders and keeps the caller's own (which an administrator still sees), and persona leaves the claims as they were. An administrator is held to none of it.

A person of an external persona reads only their own folder, never Global or their persona's (#2257, #2290), and writes to it only when the persona lets its people upload (#2258). What is shared with them they read through their shares.