reach method

Set<String> reach(Access access)

The roles an access requirement admits.

Implementation

Set<String> reach(Access access) {
  switch (access.kind) {
    case 'public':
      return roles.toSet();
    case 'authenticated':
      return roles.toSet()..remove('operations');
    case 'role':
      return access.roles.toSet();
    case 'entitlement':
      // A key covers every key below it (a rule such as FR-26): for example
      // a role holding `orders` reaches an operation that requires
      // `orders.read`.
      bool covers(String held, String required) =>
          required == held || required.startsWith('$held.');
      return {
        for (final r in roles)
          if (access.keys.any((k) => roleKeys[r]!.any((h) => covers(h, k))))
            r,
      };
    case 'custom':
      return handlerRoles[access.handler] ?? <String>{};
  }
  return <String>{};
}