func (is *IdentityServer) OrganizationRights(ctx context.Context, orgIDs ttnpb.OrganizationIdentifiers) (*ttnpb.Rights, error) {
	entity, universal, err := is.getRights(ctx, orgIDs.GetEntityIdentifiers())
	if err != nil {
		return nil, err
	}
	err = is.withDatabase(ctx, func(db *gorm.DB) error {
		_, err := store.GetOrganizationStore(db).GetOrganization(ctx, &orgIDs, &pbtypes.FieldMask{Paths: []string{"ids"}})
		return err
	})
	if errors.IsNotFound(err) {
		if is.IsAdmin(ctx) {
			return nil, err
		}
		return &ttnpb.Rights{}, nil
	} else if err != nil {
		return nil, err
	}
	return entity.Union(universal), nil
}
OrganizationRights returns the rights the caller has on the given organization.
package identityserver
import (
	"context"
	pbtypes "github.com/gogo/protobuf/types"
	"github.com/jinzhu/gorm"
	"go.thethings.network/lorawan-stack/v3/pkg/errors"
	"go.thethings.network/lorawan-stack/v3/pkg/identityserver/store"
	"go.thethings.network/lorawan-stack/v3/pkg/ttnpb"
)
func allPotentialRights(eIDs *ttnpb.EntityIdentifiers, rights *ttnpb.Rights) *ttnpb.Rights {
	switch eIDs.GetIds().(type) {
	case *ttnpb.EntityIdentifiers_ApplicationIds:
		return ttnpb.AllApplicationRights.Intersect(rights)
	case *ttnpb.EntityIdentifiers_ClientIds:
		return ttnpb.AllClientRights.Intersect(rights)
	case *ttnpb.EntityIdentifiers_GatewayIds:
		return ttnpb.AllGatewayRights.Intersect(rights)
	case *ttnpb.EntityIdentifiers_OrganizationIds:
		return ttnpb.AllEntityRights.Union(ttnpb.AllOrganizationRights).Intersect(rights)
	case *ttnpb.EntityIdentifiers_UserIds:
		return ttnpb.AllEntityRights.Union(ttnpb.AllOrganizationRights, ttnpb.AllUserRights).Intersect(rights)
	}
	return nil
}
func (is *IdentityServer) getRights(ctx context.Context, entityID *ttnpb.EntityIdentifiers) (entityRights, universalRights *ttnpb.Rights, err error) {
	authInfo, err := is.authInfo(ctx)
	if err != nil {
		return nil, nil, err
	}
	authInfoRights := ttnpb.RightsFrom(authInfo.GetRights()...)
	universalRights = allPotentialRights(entityID, authInfo.GetUniversalRights())
	if len(universalRights.GetRights()) == 0 {
		universalRights = nil
	}
	allPotentialRights := allPotentialRights(entityID, authInfoRights)
	if len(allPotentialRights.GetRights()) == 0 {
		return nil, universalRights, nil
	}
	authenticatedAs := authInfo.GetEntityIdentifiers()
	if entityID.EntityType() == authenticatedAs.EntityType() &&
		entityID.IDString() == authenticatedAs.IDString() {
		return authInfoRights, universalRights, nil
	}
	ouID := authInfo.GetOrganizationOrUserIdentifiers()
	if ouID == nil {
		return nil, universalRights, nil
	}
	if entityID.GetUserIds() != nil {
		return nil, universalRights, nil
	}
	err = is.withDatabase(ctx, func(db *gorm.DB) error {
		membershipChains, err := is.getMembershipStore(ctx, db).FindAccountMembershipChains(ctx, ouID, entityID.EntityType(), entityID.IDString())
		if err != nil {
			return err
		}
		for _, chain := range membershipChains {
			entityRights = entityRights.Union(chain.GetRights())
		}
		return nil
	})
	if err != nil {
		return nil, nil, err
	}
	entityRights = entityRights.Intersect(authInfoRights)
	return entityRights, universalRights, err
}
func (is *IdentityServer) ApplicationRights(ctx context.Context, appIDs ttnpb.ApplicationIdentifiers) (*ttnpb.Rights, error) {
	entity, universal, err := is.getRights(ctx, appIDs.GetEntityIdentifiers())
	if err != nil {
		return nil, err
	}
	err = is.withDatabase(ctx, func(db *gorm.DB) error {
		_, err := store.GetApplicationStore(db).GetApplication(ctx, &appIDs, &pbtypes.FieldMask{Paths: []string{"ids"}})
		return err
	})
	if errors.IsNotFound(err) {
		if is.IsAdmin(ctx) {
			return nil, err
		}
		return &ttnpb.Rights{}, nil
	} else if err != nil {
		return nil, err
	}
	return entity.Union(universal), nil
}
func (is *IdentityServer) ClientRights(ctx context.Context, cliIDs ttnpb.ClientIdentifiers) (*ttnpb.Rights, error) {
	entity, universal, err := is.getRights(ctx, cliIDs.GetEntityIdentifiers())
	if err != nil {
		return nil, err
	}
	err = is.withDatabase(ctx, func(db *gorm.DB) error {
		_, err := store.GetClientStore(db).GetClient(ctx, &cliIDs, &pbtypes.FieldMask{Paths: []string{"ids"}})
		return err
	})
	if errors.IsNotFound(err) {
		if is.IsAdmin(ctx) {
			return nil, err
		}
		return &ttnpb.Rights{}, nil
	} else if err != nil {
		return nil, err
	}
	return entity.Union(universal), nil
}
func (is *IdentityServer) GatewayRights(ctx context.Context, gtwIDs ttnpb.GatewayIdentifiers) (*ttnpb.Rights, error) {
	gtwIDs.Eui = nil
	entity, universal, err := is.getRights(ctx, gtwIDs.GetEntityIdentifiers())
	if err != nil {
		return nil, err
	}
	err = is.withDatabase(ctx, func(db *gorm.DB) (err error) {
		gtw, err := store.GetGatewayStore(db).GetGateway(ctx, &gtwIDs, &pbtypes.FieldMask{Paths: []string{
			"ids", "status_public", "location_public",
		}})
		if err != nil {
			return err
		}
		if gtw.StatusPublic {
			entity = entity.Union(ttnpb.RightsFrom(ttnpb.RIGHT_GATEWAY_STATUS_READ))
		}
		if gtw.LocationPublic {
			entity = entity.Union(ttnpb.RightsFrom(ttnpb.RIGHT_GATEWAY_LOCATION_READ))
		}
		return nil
	})
	if errors.IsNotFound(err) {
		if is.IsAdmin(ctx) {
			return nil, err
		}
		return &ttnpb.Rights{}, nil
	} else if err != nil {
		return nil, err
	}
	return entity.Union(universal), nil
}