<commit_before>require 'sirius_api/base_authorizer'

module SiriusApi
  class EventsAuthorizer < BaseAuthorizer

    TEACHER_ROLE = Config.umapi_teacher_role

    scope Scopes::READ_PERSONAL, Scopes::READ_LIMITED, Scopes::READ_ALL do
      permit :get, '/events'
      permit :get, '/events/personal'
      permit :get, '/events/:id'
      permit :get, '/rooms/:kos_id/events'
      permit :get, '/courses/:course_id/events'
    end

    scope Scopes::READ_PERSONAL do
      permit :get, '/people/:username/events', only: ->(opts) { opts[:current_user] == opts[:target_user] }
    end

    scope Scopes::READ_LIMITED do
      permit :get, '/people/:username/events', only: ->(opts) { authorize_by_role(opts) }
    end

    scope Scopes::READ_ALL do
      permit :get, '/people/:username/events'
    end

    def initialize(current_user)
      super
    end

    def authorize_by_role(opts)
      current_user_id = opts[:current_user]
      target_user_id = opts[:target_user]
      unless current_user_id
        raise SiriusApi::Errors::Authorization, "Access not permitted for Client Credentials Grant Flow on #{opts[:http_method]} #{opts[:url]} with #{current_user}. (Username is required.)"
      end

      return true if current_user.has_role?(TEACHER_ROLE)
      return true if User.new(target_user_id).has_role?(TEACHER_ROLE)
      raise SiriusApi::Errors::Authorization, "Access not permitted on #{opts[:http_method]} #{opts[:url]} with #{current_user}. (#{TEACHER_ROLE} role is required for current user, URL and scope.)"
    end<commit_msg>Allow access to personal events for limited-by-idm scope<commit_after>require 'sirius_api/base_authorizer'

module SiriusApi
  class EventsAuthorizer < BaseAuthorizer

    TEACHER_ROLE = Config.umapi_teacher_role

    scope Scopes::READ_PERSONAL, Scopes::READ_LIMITED, Scopes::READ_ALL do
      permit :get, '/events'
      permit :get, '/events/personal'
      permit :get, '/events/:id'
      permit :get, '/rooms/:kos_id/events'
      permit :get, '/courses/:course_id/events'
    end

    scope Scopes::READ_PERSONAL do
      permit :get, '/people/:username/events', only: ->(opts) { opts[:current_user] == opts[:target_user] }
    end

    scope Scopes::READ_LIMITED do
      permit :get, '/people/:username/events', only: ->(opts) { authorize_by_role(opts) }
    end

    scope Scopes::READ_ALL do
      permit :get, '/people/:username/events'
    end

    def initialize(current_user)
      super
    end

    def authorize_by_role(opts)
      current_user_id = opts[:current_user]
      target_user_id = opts[:target_user]
      unless current_user_id
        raise SiriusApi::Errors::Authorization, "Access not permitted for Client Credentials Grant Flow on #{opts[:http_method]} #{opts[:url]} with #{current_user}. (Username is required.)"
      end

      # User has always acces to personal calendar
      return true if current_user_id == target_user_id

      return true if current_user.has_role?(TEACHER_ROLE)
      return true if User.new(target_user_id).has_role?(TEACHER_ROLE)
      raise SiriusApi::Errors::Authorization, "Access not permitted on #{opts[:http_method]} #{opts[:url]} with #{current_user}. (#{TEACHER_ROLE} role is required for current user, URL and scope.)"
    end
{'fraction_non_alphanumeric': 0.11592865928659286, 'fraction_numerical': 0.0, 'mean_word_length': 3.7489051094890513, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '911558', 'n_tokens_mistral': 1025, 'n_tokens_neox': 1037, 'n_words': 254}