Improve logging #67
Description
...especially for the authorization logic, which is really complex:
(defn require-write-authorization
"If user is employee, check that is in correct team.
If user is service, check that it has application_write.all scope OR has application.write and is correct team"
[request team]
(require-uid request)
(let [has-auth? (auth/get-auth request team)
realm (from-token request "realm")
is-robot? (= "/services" realm)
is-human? (= "/employees" realm)
has-scope? (set (from-token request "scope"))]
(if is-human?
(when-not has-auth?
(api/throw-error 403 "Unauthorized")))
(if is-robot?
(if-not (has-scope? "application.write_all")
(when-not (and
(has-scope? "application.write")
has-auth?)
(api/throw-error 403 "Unauthorized"))
(require-special-uid request)))))