go-libs/pkg/authn/jwt/scopes.go

package jwt

import (
	"fmt"
	"net/http"
	"strings"

	"github.com/hanzo-fi/go-libs/v5/pkg/authn/oidc"
	collectionutils "github.com/hanzo-fi/go-libs/v5/pkg/types/collections"
)

func checkScopes(service string, method string, scopes oidc.SpaceDelimitedArray) (bool, error) {
	allowed := true //nolint:ineffassign
	switch method {
	case http.MethodOptions, http.MethodGet, http.MethodHead, http.MethodTrace:
		allowed = collectionutils.Contains(scopes, service+":read") ||
			collectionutils.Contains(scopes, service+":write")
	default:
		allowed = collectionutils.Contains(scopes, service+":write")
	}

	if !allowed {
		return false, fmt.Errorf("missing access, found scopes: '%s' need %s:read|write", strings.Join(scopes, ", "), service)
	}
	return true, nil
}