8660117531

Committed 12 Apr 2024 09:41AM UTC coverage: 76.527% (-0.9%) from 77.425%

Build # 8660117531

Build Type

Pull #322

github

Committed by

Arun-KumarH

Commit Message

fix: use flatmap to get ownerInstances in HR scoping

Pull Request Pull Request #322: Acs make scope optional

Run Details

492 of 659 branches covered (74.66%)

Branch coverage included in aggregate %.

117 of 118 new or added lines in 2 files covered. (99.15%)

11 existing lines in 1 file now uncovered.

2615 of 3401 relevant lines covered (76.89%)

55.12 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

83.75

/src/core/hierarchicalScope.ts

import _ from 'lodash-es';
import traverse from 'traverse';
import { Logger } from 'winston';
import { AccessController } from '.';
import { Request } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/access_control.js';
import { Target } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/rule.js';
import { Attribute } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/attribute.js';
import { Resource, ContextWithSubResolved } from './interfaces.js';

export const checkHierarchicalScope = async (ruleTarget: Target,
  request: Request, urns: Map<string, string>, accessController: AccessController, logger?: Logger): Promise<boolean> => {
  // 1) create a Map of resourceID with Owners for resource IDs which have the rule entity matching
  // 2) In HR scope match validate the Owner indicatory entity with vale from matching users Rule's role for
  //    matching role scoping enitty with instance
  let resourceIdOwnersMap = new Map<string, Attribute[]>();
  if (ruleTarget?.subjects?.length === 0) {
    logger.debug('Rule subject not configured, hence hierarchical scope check not needed');
    return true; // no scoping entities specified in rule, request ignored
  }
  let hierarchicalRoleScopeCheck = 'true'; // default is to check for HR scope for all resources
  let ruleRole: string;
  const roleURN = urns.get('role');
  let ruleRoleScopingEntity: string; // target scoping entity to match from owners and role associations
  ruleTarget?.subjects?.forEach((subjectObject) => {
    if (subjectObject?.id === roleURN) {
      ruleRole = subjectObject?.value;
    } else if (subjectObject?.id === urns.get('hierarchicalRoleScoping')) {
      hierarchicalRoleScopeCheck = subjectObject.value;
    } else if (subjectObject?.id === urns.get('roleScopingEntity')) {
      ruleRoleScopingEntity = subjectObject.value;
    }
  });

  if (!ruleRoleScopingEntity) {
    logger.debug('Scoping entity not found in rule subject hence hierarchical scope check not needed');
    return true; // no scoping entities specified in rule, request ignored
  }

  let context = (request as any).context as ContextWithSubResolved;
  if (_.isEmpty(context)) {
    logger.debug('Empty context, evaluation fails');
    return false; // no context was provided, evaluation fails
  }

  const ctxResources = context.resources || [];
  const reqTarget = request.target;
  let entityOrOperation: string;
  // iterating through all targeted resources and retrieve relevant owners instances
  for (let attribute of ruleTarget.resources || []) {
    if (attribute?.id == urns.get('entity')) { // resource type found
      logger.debug('Evaluating resource entity match');
      entityOrOperation = attribute?.value;

      let entitiesMatch = false;
      // iterating request resources to filter all resources of a given type
      for (let requestAttribute of reqTarget.resources || []) {
        if (requestAttribute?.id == attribute?.id && requestAttribute?.value == entityOrOperation) {
          entitiesMatch = true; // a resource entity that matches the request and the rule's target
        } else if (requestAttribute?.id == attribute?.id) {
          // rule entity, get ruleNS and entityRegexValue for rule
          const value = entityOrOperation;
          let pattern = value?.substring(value?.lastIndexOf(':') + 1);
          let nsEntityArray = pattern?.split('.');
          // firstElement could be either entity or namespace
          let nsOrEntity = nsEntityArray[0];
          let entityRegexValue = nsEntityArray[nsEntityArray.length - 1];
          let reqNS, ruleNS;
          if (nsOrEntity?.toUpperCase() != entityRegexValue?.toUpperCase()) {
            // rule name space is present
            ruleNS = nsOrEntity?.toUpperCase();
          }

          // request entity, get reqNS and requestEntityValue for request
          let reqValue = requestAttribute?.value;
          const reqAttributeNS = reqValue?.substring(0, reqValue?.lastIndexOf(':'));
          const ruleAttributeNS = value?.substring(0, value?.lastIndexOf(':'));
          // verify namespace before entity name
          if (reqAttributeNS != ruleAttributeNS) {
            entitiesMatch = false;
          }
          let reqPattern = reqValue?.substring(reqValue?.lastIndexOf(':') + 1);
          let reqNSEntityArray = reqPattern?.split('.');
          // firstElement could be either entity or namespace
          let reqNSOrEntity = reqNSEntityArray[0];
          let requestEntityValue = reqNSEntityArray[reqNSEntityArray.length - 1];
          if (reqNSOrEntity?.toUpperCase() != requestEntityValue?.toUpperCase()) {
            // request name space is present
            reqNS = reqNSOrEntity?.toUpperCase();
          }

          if ((reqNS && ruleNS && (reqNS === ruleNS)) || (!reqNS && !ruleNS)) {
            const reExp = new RegExp(entityRegexValue);
            if (requestEntityValue?.match(reExp)) {
              entitiesMatch = true;
            }
          }
        }
        else if (requestAttribute?.id == urns?.get('resourceID') && entitiesMatch) { // resource instance ID of a matching entity
          const instanceID = requestAttribute?.value;
          // found resource instance ID, iterating through the context to check if owners entities match the scoping entities
          let ctxResource: Resource = _.find(ctxResources ?? [], ['instance.id', instanceID]);
          if (ctxResource) {
            ctxResource = ctxResource?.instance;
          } else {
            // look up by ID
            ctxResource = _.find(ctxResources ?? [], ['id', instanceID]);
          }
          if (ctxResource) {
            const meta = ctxResource.meta;
            if (_.isEmpty(meta) || _.isEmpty(meta.owners)) {
              logger.debug(`Owners information missing for hierarchical scope matching of entity ${attribute.value}, evaluation fails`);
              return false; // no ownership was passed, evaluation fails
            }
            resourceIdOwnersMap.set(instanceID, meta.owners);
          } else {
            logger.debug('Resource of targeted entity was not provided in context');
            return false; // resource of targeted entity was not provided in context
          }
        }
      }
    } else if (attribute?.id === urns.get('operation')) {
      logger.debug('Evaluating resource operation match');
      entityOrOperation = attribute?.value;
      for (let reqAttribute of reqTarget.resources || []) {
        // match Rule resource operation URN and operation name with request resource operation URN and operation name
        if (reqAttribute?.id === attribute?.id && reqAttribute?.value === attribute?.value) {
          // find context resource based
          let ctxResource: Resource = _.find(ctxResources ?? [], ['id', entityOrOperation]);
          if (ctxResource) {
            const meta = ctxResource.meta;
            if (_.isEmpty(meta) || _.isEmpty(meta.owners)) {
              logger.debug(`Owners information missing for hierarchical scope matching of entity ${attribute.value}, evaluation fails`);
              return false; // no ownership was passed, evaluation fails
            }
            resourceIdOwnersMap.set(entityOrOperation, meta.owners);
          } else {
            logger.debug('Operation name was not provided in context');
            return false; // Operation name was not provided in context
          }
        }
      }
    }
  }

  if (!entityOrOperation) {
    logger.debug('No entity or operation name found');
  }

  const roleAssociations = context?.subject?.role_associations;
  if (_.isEmpty(roleAssociations)) {
    logger.debug('Role Associations not found');
    return false; // impossible to evaluate context
  }

  // get all user role association mapping matching the ruleRole -> (Rule Subject's Role)
  const reducedUserRoleAssocs = roleAssociations.filter((obj) => obj.role === ruleRole);

  // verify for exact match, if not then verify from HR scopes
  let deleteMapEntries = [];
  for (let [resourceId, owners] of resourceIdOwnersMap) {
    const entityScopingInstMatch = owners?.some((ownerObj) => {
      return reducedUserRoleAssocs?.some((roleObj) => {
        // check if Rule's roleScoping Entity matches the Owner's role scoping entity and RoleAssociation RoleScoping entity (ex: Organization / User / Klasse etc)
        // and check if roleScoping Instance matches with owner instance
        const match = roleObj?.attributes?.some((roleAttributeObject) => roleAttributeObject?.id === urns.get('roleScopingEntity')
          && ownerObj?.id === urns.get('ownerEntity') && ownerObj.value === ruleRoleScopingEntity && ownerObj.value === roleAttributeObject?.value
          && roleAttributeObject?.attributes?.some((roleInstObj) =>
            roleInstObj?.id === urns.get('roleScopingInstance') && ownerObj?.attributes?.find((ownerInstObj) => ownerInstObj?.value === roleInstObj?.value)));
        logger.debug('Match result for comparing owner indicatory entity and instance with role scoping entity and instance', { match });
        return match;
      });
    });
    if (entityScopingInstMatch) {
      // its not safe to remove entries while iterating, so add entries to array to delete later
      deleteMapEntries.push(resourceId);
    }
  }
  deleteMapEntries.forEach((entry) => resourceIdOwnersMap.delete(entry));

  if (resourceIdOwnersMap.size === 0) {
    logger.info('Role scoping entities and instances matched');
    return true;
  }

  // verify HR scope match
  if (resourceIdOwnersMap.size > 0 && hierarchicalRoleScopeCheck === 'true') {
    // reset deleteMapEntries
    deleteMapEntries = [];
    // check if context subject_id contains HR scope if not make request 'createHierarchicalScopes'
    if (context?.subject?.token && _.isEmpty(context.subject.hierarchical_scopes)) {
      context = await accessController.createHRScope(context);
    }
    const reducedHRScopes = context?.subject?.hierarchical_scopes?.filter((hrObj) => hrObj?.role === ruleRole);
    for (let [resourceId, owners] of resourceIdOwnersMap) {
      const ownerInstances: string[] = owners.filter(
        owner => reducedUserRoleAssocs?.some((roleObj) => {
          return roleObj?.attributes?.some(
            (roleAttributeObject) => roleAttributeObject?.id === urns.get('roleScopingEntity')
              && owner?.id === urns.get('ownerEntity')
              && owner?.value === ruleRoleScopingEntity
              && owner?.value === roleAttributeObject?.value
          );
        }
        )
      ).flatMap(
        owner => owner?.attributes?.filter(
          attr => attr?.id === urns.get('ownerInstance')
        ).map(
          attr => attr?.value
        )
      );
      // validate the ownerInstance from HR scope tree for matched scoping entity
      traverse(reducedHRScopes).forEach(
        (node: any) => { // depth-first search
          if (ownerInstances.includes(node?.id)) {
            deleteMapEntries.push(resourceId);
          }
        }
      );
    }
  }

  deleteMapEntries.forEach((entry) => resourceIdOwnersMap.delete(entry));

  if (resourceIdOwnersMap.size === 0) {
    logger.info('Role scoping entities and instances matched from HR scopes');
    return true;
  }

  if (resourceIdOwnersMap.size > 0) {
    const resourceIdOwners = Array.from(resourceIdOwnersMap).map(([resourceId, owners]) => ({ resourceId, owners }));
    logger.info('Subject not in HR Scope', resourceIdOwners);
    return false;
  }
};

1	import _ from 'lodash-es';	1✔
2	import traverse from 'traverse';	1✔
3	import { Logger } from 'winston';	1✔
4	import { AccessController } from '.';	1✔
5	import { Request } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/access_control.js';	1✔
6	import { Target } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/rule.js';	1✔
7	import { Attribute } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/attribute.js';	1✔
8	import { Resource, ContextWithSubResolved } from './interfaces.js';	1✔
9		1✔
10	export const checkHierarchicalScope = async (ruleTarget: Target,	1✔
11	request: Request, urns: Map<string, string>, accessController: AccessController, logger?: Logger): Promise<boolean> => {	109✔
12	// 1) create a Map of resourceID with Owners for resource IDs which have the rule entity matching	109✔
13	// 2) In HR scope match validate the Owner indicatory entity with vale from matching users Rule's role for	109✔
14	// matching role scoping enitty with instance	109✔
15	let resourceIdOwnersMap = new Map<string, Attribute[]>();	109✔
16	if (ruleTarget?.subjects?.length === 0) {	109✔
17	logger.debug('Rule subject not configured, hence hierarchical scope check not needed');	12✔
18	return true; // no scoping entities specified in rule, request ignored	12✔
19	}	12✔
20	let hierarchicalRoleScopeCheck = 'true'; // default is to check for HR scope for all resources	97✔
21	let ruleRole: string;	97✔
22	const roleURN = urns.get('role');	97✔
23	let ruleRoleScopingEntity: string; // target scoping entity to match from owners and role associations	97✔
24	ruleTarget?.subjects?.forEach((subjectObject) => {	109✔
25	if (subjectObject?.id === roleURN) {	173✔
26	ruleRole = subjectObject?.value;	85✔
27	} else if (subjectObject?.id === urns.get('hierarchicalRoleScoping')) {	173✔
28	hierarchicalRoleScopeCheck = subjectObject.value;	2✔
29	} else if (subjectObject?.id === urns.get('roleScopingEntity')) {	88✔
30	ruleRoleScopingEntity = subjectObject.value;	76✔
31	}	76✔
32	});	109✔
33		109✔
34	if (!ruleRoleScopingEntity) {	109✔
35	logger.debug('Scoping entity not found in rule subject hence hierarchical scope check not needed');	21✔
36	return true; // no scoping entities specified in rule, request ignored	21✔
37	}	21✔
38		76✔
39	let context = (request as any).context as ContextWithSubResolved;	76✔
40	if (_.isEmpty(context)) {	109!
NEW 41	logger.debug('Empty context, evaluation fails');	×
42	return false; // no context was provided, evaluation fails	×
43	}	×
44		76✔
45	const ctxResources = context.resources \|\| [];	109!
46	const reqTarget = request.target;	109✔
47	let entityOrOperation: string;	109✔
48	// iterating through all targeted resources and retrieve relevant owners instances	109✔
49	for (let attribute of ruleTarget.resources \|\| []) {	109!
50	if (attribute?.id == urns.get('entity')) { // resource type found	110✔
51	logger.debug('Evaluating resource entity match');	71✔
52	entityOrOperation = attribute?.value;	71✔
53		71✔
54	let entitiesMatch = false;	71✔
55	// iterating request resources to filter all resources of a given type	71✔
56	for (let requestAttribute of reqTarget.resources \|\| []) {	71!
57	if (requestAttribute?.id == attribute?.id && requestAttribute?.value == entityOrOperation) {	275✔
58	entitiesMatch = true; // a resource entity that matches the request and the rule's target	71✔
59	} else if (requestAttribute?.id == attribute?.id) {	275✔
60	// rule entity, get ruleNS and entityRegexValue for rule	23✔
61	const value = entityOrOperation;	23✔
62	let pattern = value?.substring(value?.lastIndexOf(':') + 1);	23✔
63	let nsEntityArray = pattern?.split('.');	23✔
64	// firstElement could be either entity or namespace	23✔
65	let nsOrEntity = nsEntityArray[0];	23✔
66	let entityRegexValue = nsEntityArray[nsEntityArray.length - 1];	23✔
67	let reqNS, ruleNS;	23✔
68	if (nsOrEntity?.toUpperCase() != entityRegexValue?.toUpperCase()) {	23!
69	// rule name space is present	×
70	ruleNS = nsOrEntity?.toUpperCase();	×
71	}	×
72		23✔
73	// request entity, get reqNS and requestEntityValue for request	23✔
74	let reqValue = requestAttribute?.value;	23✔
75	const reqAttributeNS = reqValue?.substring(0, reqValue?.lastIndexOf(':'));	23✔
76	const ruleAttributeNS = value?.substring(0, value?.lastIndexOf(':'));	23✔
77	// verify namespace before entity name	23✔
78	if (reqAttributeNS != ruleAttributeNS) {	23!
79	entitiesMatch = false;	×
80	}	×
81	let reqPattern = reqValue?.substring(reqValue?.lastIndexOf(':') + 1);	23✔
82	let reqNSEntityArray = reqPattern?.split('.');	23✔
83	// firstElement could be either entity or namespace	23✔
84	let reqNSOrEntity = reqNSEntityArray[0];	23✔
85	let requestEntityValue = reqNSEntityArray[reqNSEntityArray.length - 1];	23✔
86	if (reqNSOrEntity?.toUpperCase() != requestEntityValue?.toUpperCase()) {	23!
87	// request name space is present	×
88	reqNS = reqNSOrEntity?.toUpperCase();	×
89	}	×
90		23✔
91	if ((reqNS && ruleNS && (reqNS === ruleNS)) \|\| (!reqNS && !ruleNS)) {	23!
92	const reExp = new RegExp(entityRegexValue);	23✔
93	if (requestEntityValue?.match(reExp)) {	23!
94	entitiesMatch = true;	×
95	}	×
96	}	23✔
97	}	23✔
98	else if (requestAttribute?.id == urns?.get('resourceID') && entitiesMatch) { // resource instance ID of a matching entity	181✔
99	const instanceID = requestAttribute?.value;	89✔
100	// found resource instance ID, iterating through the context to check if owners entities match the scoping entities	89✔
101	let ctxResource: Resource = _.find(ctxResources ?? [], ['instance.id', instanceID]);	89!
102	if (ctxResource) {	89!
103	ctxResource = ctxResource?.instance;	×
104	} else {	89✔
105	// look up by ID	89✔
106	ctxResource = _.find(ctxResources ?? [], ['id', instanceID]);	89!
107	}	89✔
108	if (ctxResource) {	89✔
109	const meta = ctxResource.meta;	89✔
110	if (_.isEmpty(meta) \|\| _.isEmpty(meta.owners)) {	89!
111	logger.debug(`Owners information missing for hierarchical scope matching of entity ${attribute.value}, evaluation fails`);	×
112	return false; // no ownership was passed, evaluation fails	×
113	}	×
114	resourceIdOwnersMap.set(instanceID, meta.owners);	89✔
115	} else {	89!
116	logger.debug('Resource of targeted entity was not provided in context');	×
117	return false; // resource of targeted entity was not provided in context	×
118	}	×
119	}	89✔
120	}	275✔
121	} else if (attribute?.id === urns.get('operation')) {	110✔
122	logger.debug('Evaluating resource operation match');	5✔
123	entityOrOperation = attribute?.value;	5✔
124	for (let reqAttribute of reqTarget.resources \|\| []) {	5!
125	// match Rule resource operation URN and operation name with request resource operation URN and operation name	9✔
126	if (reqAttribute?.id === attribute?.id && reqAttribute?.value === attribute?.value) {	9✔
127	// find context resource based	5✔
128	let ctxResource: Resource = _.find(ctxResources ?? [], ['id', entityOrOperation]);	5!
129	if (ctxResource) {	5✔
130	const meta = ctxResource.meta;	5✔
131	if (_.isEmpty(meta) \|\| _.isEmpty(meta.owners)) {	5!
132	logger.debug(`Owners information missing for hierarchical scope matching of entity ${attribute.value}, evaluation fails`);	×
133	return false; // no ownership was passed, evaluation fails	×
134	}	×
135	resourceIdOwnersMap.set(entityOrOperation, meta.owners);	5✔
136	} else {	5!
137	logger.debug('Operation name was not provided in context');	×
138	return false; // Operation name was not provided in context	×
139	}	×
140	}	5✔
141	}	9✔
142	}	5✔
143	}	110✔
144		76✔
145	if (!entityOrOperation) {	109!
146	logger.debug('No entity or operation name found');	×
147	}	×
148		76✔
149	const roleAssociations = context?.subject?.role_associations;	109✔
150	if (_.isEmpty(roleAssociations)) {	109!
151	logger.debug('Role Associations not found');	×
152	return false; // impossible to evaluate context	×
153	}	×
154		76✔
155	// get all user role association mapping matching the ruleRole -> (Rule Subject's Role)	76✔
156	const reducedUserRoleAssocs = roleAssociations.filter((obj) => obj.role === ruleRole);	76✔
157		76✔
158	// verify for exact match, if not then verify from HR scopes	76✔
159	let deleteMapEntries = [];	76✔
160	for (let [resourceId, owners] of resourceIdOwnersMap) {	109✔
161	const entityScopingInstMatch = owners?.some((ownerObj) => {	94✔
162	return reducedUserRoleAssocs?.some((roleObj) => {	111✔
163	// check if Rule's roleScoping Entity matches the Owner's role scoping entity and RoleAssociation RoleScoping entity (ex: Organization / User / Klasse etc)	111✔
164	// and check if roleScoping Instance matches with owner instance	111✔
165	const match = roleObj?.attributes?.some((roleAttributeObject) => roleAttributeObject?.id === urns.get('roleScopingEntity')	111✔
166	&& ownerObj?.id === urns.get('ownerEntity') && ownerObj.value === ruleRoleScopingEntity && ownerObj.value === roleAttributeObject?.value	111✔
167	&& roleAttributeObject?.attributes?.some((roleInstObj) =>	111✔
168	roleInstObj?.id === urns.get('roleScopingInstance') && ownerObj?.attributes?.find((ownerInstObj) => ownerInstObj?.value === roleInstObj?.value)));	111✔
169	logger.debug('Match result for comparing owner indicatory entity and instance with role scoping entity and instance', { match });	111✔
170	return match;	111✔
171	});	111✔
172	});	94✔
173	if (entityScopingInstMatch) {	94✔
174	// its not safe to remove entries while iterating, so add entries to array to delete later	59✔
175	deleteMapEntries.push(resourceId);	59✔
176	}	59✔
177	}	94✔
178	deleteMapEntries.forEach((entry) => resourceIdOwnersMap.delete(entry));	76✔
179		76✔
180	if (resourceIdOwnersMap.size === 0) {	109✔
181	logger.info('Role scoping entities and instances matched');	47✔
182	return true;	47✔
183	}	47✔
184		29✔
185	// verify HR scope match	29✔
186	if (resourceIdOwnersMap.size > 0 && hierarchicalRoleScopeCheck === 'true') {	109✔
187	// reset deleteMapEntries	28✔
188	deleteMapEntries = [];	28✔
189	// check if context subject_id contains HR scope if not make request 'createHierarchicalScopes'	28✔
190	if (context?.subject?.token && _.isEmpty(context.subject.hierarchical_scopes)) {	28✔
191	context = await accessController.createHRScope(context);	11✔
192	}	11✔
193	const reducedHRScopes = context?.subject?.hierarchical_scopes?.filter((hrObj) => hrObj?.role === ruleRole);	28✔
194	for (let [resourceId, owners] of resourceIdOwnersMap) {	28✔
195	const ownerInstances: string[] = owners.filter(	34✔
196	owner => reducedUserRoleAssocs?.some((roleObj) => {	34✔
197	return roleObj?.attributes?.some(	51✔
198	(roleAttributeObject) => roleAttributeObject?.id === urns.get('roleScopingEntity')	51✔
199	&& owner?.id === urns.get('ownerEntity')	51✔
200	&& owner?.value === ruleRoleScopingEntity	51✔
201	&& owner?.value === roleAttributeObject?.value	51✔
202	);	51✔
203	}	51✔
204	)	34✔
205	).flatMap(	34✔
206	owner => owner?.attributes?.filter(	34✔
207	attr => attr?.id === urns.get('ownerInstance')	34✔
208	).map(	34✔
209	attr => attr?.value	34✔
210	)	34✔
211	);	34✔
212	// validate the ownerInstance from HR scope tree for matched scoping entity	34✔
213	traverse(reducedHRScopes).forEach(	34✔
214	(node: any) => { // depth-first search	34✔
215	if (ownerInstances.includes(node?.id)) {	406✔
216	deleteMapEntries.push(resourceId);	27✔
217	}	27✔
218	}	406✔
219	);	34✔
220	}	34✔
221	}	28✔
222		29✔
223	deleteMapEntries.forEach((entry) => resourceIdOwnersMap.delete(entry));	29✔
224		29✔
225	if (resourceIdOwnersMap.size === 0) {	109✔
226	logger.info('Role scoping entities and instances matched from HR scopes');	21✔
227	return true;	21✔
228	}	21✔
229		8✔
230	if (resourceIdOwnersMap.size > 0) {	8✔
231	const resourceIdOwners = Array.from(resourceIdOwnersMap).map(([resourceId, owners]) => ({ resourceId, owners }));	8✔
232	logger.info('Subject not in HR Scope', resourceIdOwners);	8✔
233	return false;	8✔
234	}	8✔
235	};	109✔

restorecommerce / access-control-srv / 8660117531

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous