8662724573

Committed 12 Apr 2024 01:18PM UTC coverage: 76.596% (-0.8%) from 77.425%

Build # 8662724573

Build Type

Pull #322

github

Committed by

Arun-KumarH

Commit Message

fix: fix subject with HR scope matching on Policy target

Pull Request Pull Request #322: Acs make scope optional

Run Details

496 of 663 branches covered (74.81%)

Branch coverage included in aggregate %.

126 of 127 new or added lines in 2 files covered. (99.21%)

11 existing lines in 1 file now uncovered.

2623 of 3409 relevant lines covered (76.94%)

56.17 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

83.7

/src/core/hierarchicalScope.ts

import _ from 'lodash-es';
import traverse from 'traverse';
import { Logger } from 'winston';
import { AccessController } from '.';
import { Request } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/access_control.js';
import { Target } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/rule.js';
import { Attribute } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/attribute.js';
import { Resource, ContextWithSubResolved } from './interfaces.js';

export const checkHierarchicalScope = async (ruleTarget: Target,
  request: Request, urns: Map<string, string>, accessController: AccessController, logger?: Logger): Promise<boolean> => {
  // 1) create a Map of resourceID with Owners for resource IDs which have the rule entity matching
  // 2) In HR scope match validate the Owner indicatory entity with vale from matching users Rule's role for
  //    matching role scoping enitty with instance
  let resourceIdOwnersMap = new Map<string, Attribute[]>();
  if (ruleTarget?.subjects?.length === 0) {
    logger.debug('Rule subject not configured, hence hierarchical scope check not needed');
    return true; // no scoping entities specified in rule, request ignored
  }
  let hierarchicalRoleScopeCheck = 'true'; // default is to check for HR scope for all resources
  let ruleRole: string;
  const roleURN = urns.get('role');
  let ruleRoleScopingEntity: string; // target scoping entity to match from owners and role associations
  ruleTarget?.subjects?.forEach((subjectObject) => {
    if (subjectObject?.id === roleURN) {
      ruleRole = subjectObject?.value;
    } else if (subjectObject?.id === urns.get('hierarchicalRoleScoping')) {
      hierarchicalRoleScopeCheck = subjectObject.value;
    } else if (subjectObject?.id === urns.get('roleScopingEntity')) {
      ruleRoleScopingEntity = subjectObject.value;
    }
  });

  if (!ruleRoleScopingEntity) {
    logger.debug('Scoping entity not found in rule subject hence hierarchical scope check not needed');
    return true; // no scoping entities specified in rule, request ignored
  }

  let context = (request as any).context as ContextWithSubResolved;
  if (_.isEmpty(context)) {
    logger.debug('Empty context, evaluation fails');
    return false; // no context was provided, evaluation fails
  }

  const ctxResources = context.resources || [];
  const reqTarget = request.target;
  let entityOrOperation: string;
  // iterating through all targeted resources and retrieve relevant owners instances
  for (let attribute of ruleTarget.resources || []) {
    if (attribute?.id == urns.get('entity')) { // resource type found
      logger.debug('Evaluating resource entity match');
      entityOrOperation = attribute?.value;

      let entitiesMatch = false;
      // iterating request resources to filter all resources of a given type
      for (let requestAttribute of reqTarget.resources || []) {
        if (requestAttribute?.id == attribute?.id && requestAttribute?.value == entityOrOperation) {
          entitiesMatch = true; // a resource entity that matches the request and the rule's target
        } else if (requestAttribute?.id == attribute?.id) {
          // rule entity, get ruleNS and entityRegexValue for rule
          const value = entityOrOperation;
          let pattern = value?.substring(value?.lastIndexOf(':') + 1);
          let nsEntityArray = pattern?.split('.');
          // firstElement could be either entity or namespace
          let nsOrEntity = nsEntityArray[0];
          let entityRegexValue = nsEntityArray[nsEntityArray.length - 1];
          let reqNS, ruleNS;
          if (nsOrEntity?.toUpperCase() != entityRegexValue?.toUpperCase()) {
            // rule name space is present
            ruleNS = nsOrEntity?.toUpperCase();
          }

          // request entity, get reqNS and requestEntityValue for request
          let reqValue = requestAttribute?.value;
          const reqAttributeNS = reqValue?.substring(0, reqValue?.lastIndexOf(':'));
          const ruleAttributeNS = value?.substring(0, value?.lastIndexOf(':'));
          // verify namespace before entity name
          if (reqAttributeNS != ruleAttributeNS) {
            entitiesMatch = false;
          }
          let reqPattern = reqValue?.substring(reqValue?.lastIndexOf(':') + 1);
          let reqNSEntityArray = reqPattern?.split('.');
          // firstElement could be either entity or namespace
          let reqNSOrEntity = reqNSEntityArray[0];
          let requestEntityValue = reqNSEntityArray[reqNSEntityArray.length - 1];
          if (reqNSOrEntity?.toUpperCase() != requestEntityValue?.toUpperCase()) {
            // request name space is present
            reqNS = reqNSOrEntity?.toUpperCase();
          }

          if ((reqNS && ruleNS && (reqNS === ruleNS)) || (!reqNS && !ruleNS)) {
            const reExp = new RegExp(entityRegexValue);
            if (requestEntityValue?.match(reExp)) {
              entitiesMatch = true;
            }
          }
        }
        else if (requestAttribute?.id == urns?.get('resourceID') && entitiesMatch) { // resource instance ID of a matching entity
          const instanceID = requestAttribute?.value;
          // found resource instance ID, iterating through the context to check if owners entities match the scoping entities
          let ctxResource: Resource = _.find(ctxResources ?? [], ['instance.id', instanceID]);
          if (ctxResource) {
            ctxResource = ctxResource?.instance;
          } else {
            // look up by ID
            ctxResource = _.find(ctxResources ?? [], ['id', instanceID]);
          }
          if (ctxResource) {
            const meta = ctxResource.meta;
            if (_.isEmpty(meta) || _.isEmpty(meta.owners)) {
              logger.debug(`Owners information missing for hierarchical scope matching of entity ${attribute.value}, evaluation fails`);
              return false; // no ownership was passed, evaluation fails
            }
            resourceIdOwnersMap.set(instanceID, meta.owners);
          } else {
            logger.debug('Resource of targeted entity was not provided in context');
            return false; // resource of targeted entity was not provided in context
          }
        }
      }
    } else if (attribute?.id === urns.get('operation')) {
      logger.debug('Evaluating resource operation match');
      entityOrOperation = attribute?.value;
      for (let reqAttribute of reqTarget.resources || []) {
        // match Rule resource operation URN and operation name with request resource operation URN and operation name
        if (reqAttribute?.id === attribute?.id && reqAttribute?.value === attribute?.value) {
          // find context resource based
          let ctxResource: Resource = _.find(ctxResources ?? [], ['id', entityOrOperation]);
          if (ctxResource) {
            const meta = ctxResource.meta;
            if (_.isEmpty(meta) || _.isEmpty(meta.owners)) {
              logger.debug(`Owners information missing for hierarchical scope matching of entity ${attribute.value}, evaluation fails`);
              return false; // no ownership was passed, evaluation fails
            }
            resourceIdOwnersMap.set(entityOrOperation, meta.owners);
          } else {
            logger.debug('Operation name was not provided in context');
            return false; // Operation name was not provided in context
          }
        }
      }
    }
  }

  if (!entityOrOperation) {
    logger.debug('No entity or operation name found');
  }

  const roleAssociations = context?.subject?.role_associations;
  if (_.isEmpty(roleAssociations)) {
    logger.debug('Role Associations not found');
    return false; // impossible to evaluate context
  }

  // get all user role association mapping matching the ruleRole -> (Rule Subject's Role)
  const reducedUserRoleAssocs = roleAssociations.filter((obj) => obj.role === ruleRole);

  // verify for exact match, if not then verify from HR scopes
  let deleteMapEntries = [];
  for (let [resourceId, owners] of resourceIdOwnersMap) {
    const entityScopingInstMatch = owners?.some((ownerObj) => {
      return reducedUserRoleAssocs?.some((roleObj) => {
        // check if Rule's roleScoping Entity matches the Owner's role scoping entity and RoleAssociation RoleScoping entity (ex: Organization / User / Klasse etc)
        // and check if roleScoping Instance matches with owner instance
        const match = roleObj?.attributes?.some((roleAttributeObject) => roleAttributeObject?.id === urns.get('roleScopingEntity')
          && ownerObj?.id === urns.get('ownerEntity') && ownerObj.value === ruleRoleScopingEntity && ownerObj.value === roleAttributeObject?.value
          && roleAttributeObject?.attributes?.some((roleInstObj) =>
            roleInstObj?.id === urns.get('roleScopingInstance') && ownerObj?.attributes?.find((ownerInstObj) => ownerInstObj?.value === roleInstObj?.value)));
        logger.debug('Match result for comparing owner indicatory entity and instance with role scoping entity and instance', { match });
        return match;
      });
    });
    if (entityScopingInstMatch) {
      // its not safe to remove entries while iterating, so add entries to array to delete later
      deleteMapEntries.push(resourceId);
    }
  }
  deleteMapEntries.forEach((entry) => resourceIdOwnersMap.delete(entry));

  if (resourceIdOwnersMap.size === 0) {
    logger.info('Role scoping entities and instances matched');
    return true;
  }

  // verify HR scope match
  if (resourceIdOwnersMap.size > 0 && hierarchicalRoleScopeCheck === 'true') {
    // reset deleteMapEntries
    deleteMapEntries = [];
    // check if context subject_id contains HR scope if not make request 'createHierarchicalScopes'
    if (context?.subject?.token && _.isEmpty(context.subject.hierarchical_scopes)) {
      context = await accessController.createHRScope(context);
    }
    const reducedHRScopes = context?.subject?.hierarchical_scopes?.filter((hrObj) => hrObj?.role === ruleRole);
    for (let [resourceId, owners] of resourceIdOwnersMap) {
      const ownerInstances: string[] = owners.filter(
        owner => reducedUserRoleAssocs?.some((roleObj) => {
          return roleObj?.attributes?.some(
            (roleAttributeObject) => roleAttributeObject?.id === urns.get('roleScopingEntity')
              && owner?.id === urns.get('ownerEntity')
              && owner?.value === ruleRoleScopingEntity
              && owner?.value === roleAttributeObject?.value
          );
        }
        )
      ).flatMap(
        owner => owner?.attributes?.filter(
          attr => attr?.id === urns.get('ownerInstance')
        ).map(
          attr => attr?.value
        )
      );
      // validate the ownerInstance from HR scope tree for matched scoping entity
      traverse(reducedHRScopes).forEach(
        (node: any) => { // depth-first search
          if (ownerInstances.includes(node?.id)) {
            deleteMapEntries.push(resourceId);
          }
        }
      );
    }
  }

  deleteMapEntries.forEach((entry) => resourceIdOwnersMap.delete(entry));

  if (resourceIdOwnersMap.size === 0) {
    logger.info('Role scoping entities and instances matched from HR scopes');
    return true;
  }

  if (resourceIdOwnersMap.size > 0) {
    const resourceIdOwners = Array.from(resourceIdOwnersMap).map(([resourceId, owners]) => ({ resourceId, owners }));
    logger.info('Subject not in HR Scope', resourceIdOwners);
    return false;
  }
};

1	import _ from 'lodash-es';	1✔
2	import traverse from 'traverse';	1✔
3	import { Logger } from 'winston';	1✔
4	import { AccessController } from '.';	1✔
5	import { Request } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/access_control.js';	1✔
6	import { Target } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/rule.js';	1✔
7	import { Attribute } from '@restorecommerce/rc-grpc-clients/dist/generated-server/io/restorecommerce/attribute.js';	1✔
8	import { Resource, ContextWithSubResolved } from './interfaces.js';	1✔
9		1✔
10	export const checkHierarchicalScope = async (ruleTarget: Target,	1✔
11	request: Request, urns: Map<string, string>, accessController: AccessController, logger?: Logger): Promise<boolean> => {	118✔
12	// 1) create a Map of resourceID with Owners for resource IDs which have the rule entity matching	118✔
13	// 2) In HR scope match validate the Owner indicatory entity with vale from matching users Rule's role for	118✔
14	// matching role scoping enitty with instance	118✔
15	let resourceIdOwnersMap = new Map<string, Attribute[]>();	118✔
16	if (ruleTarget?.subjects?.length === 0) {	118✔
17	logger.debug('Rule subject not configured, hence hierarchical scope check not needed');	14✔
18	return true; // no scoping entities specified in rule, request ignored	14✔
19	}	14✔
20	let hierarchicalRoleScopeCheck = 'true'; // default is to check for HR scope for all resources	104✔
21	let ruleRole: string;	104✔
22	const roleURN = urns.get('role');	104✔
23	let ruleRoleScopingEntity: string; // target scoping entity to match from owners and role associations	104✔
24	ruleTarget?.subjects?.forEach((subjectObject) => {	118✔
25	if (subjectObject?.id === roleURN) {	182✔
26	ruleRole = subjectObject?.value;	91✔
27	} else if (subjectObject?.id === urns.get('hierarchicalRoleScoping')) {	91✔
28	hierarchicalRoleScopeCheck = subjectObject.value;	2✔
29	} else if (subjectObject?.id === urns.get('roleScopingEntity')) {	91✔
30	ruleRoleScopingEntity = subjectObject.value;	78✔
31	}	78✔
32	});	118✔
33		118✔
34	if (!ruleRoleScopingEntity) {	118✔
35	logger.debug('Scoping entity not found in rule subject hence hierarchical scope check not needed');	26✔
36	return true; // no scoping entities specified in rule, request ignored	26✔
37	}	26✔
38		78✔
39	let context = (request as any).context as ContextWithSubResolved;	78✔
40	if (_.isEmpty(context)) {	118!
NEW 41	logger.debug('Empty context, evaluation fails');	×
42	return false; // no context was provided, evaluation fails	×
43	}	×
44		78✔
45	const ctxResources = context.resources \|\| [];	118!
46	const reqTarget = request.target;	118✔
47	let entityOrOperation: string;	118✔
48	// iterating through all targeted resources and retrieve relevant owners instances	118✔
49	for (let attribute of ruleTarget.resources \|\| []) {	118!
50	if (attribute?.id == urns.get('entity')) { // resource type found	112✔
51	logger.debug('Evaluating resource entity match');	73✔
52	entityOrOperation = attribute?.value;	73✔
53		73✔
54	let entitiesMatch = false;	73✔
55	// iterating request resources to filter all resources of a given type	73✔
56	for (let requestAttribute of reqTarget.resources \|\| []) {	73!
57	if (requestAttribute?.id == attribute?.id && requestAttribute?.value == entityOrOperation) {	279✔
58	entitiesMatch = true; // a resource entity that matches the request and the rule's target	73✔
59	} else if (requestAttribute?.id == attribute?.id) {	279✔
60	// rule entity, get ruleNS and entityRegexValue for rule	23✔
61	const value = entityOrOperation;	23✔
62	let pattern = value?.substring(value?.lastIndexOf(':') + 1);	23✔
63	let nsEntityArray = pattern?.split('.');	23✔
64	// firstElement could be either entity or namespace	23✔
65	let nsOrEntity = nsEntityArray[0];	23✔
66	let entityRegexValue = nsEntityArray[nsEntityArray.length - 1];	23✔
67	let reqNS, ruleNS;	23✔
68	if (nsOrEntity?.toUpperCase() != entityRegexValue?.toUpperCase()) {	23!
69	// rule name space is present	×
70	ruleNS = nsOrEntity?.toUpperCase();	×
71	}	×
72		23✔
73	// request entity, get reqNS and requestEntityValue for request	23✔
74	let reqValue = requestAttribute?.value;	23✔
75	const reqAttributeNS = reqValue?.substring(0, reqValue?.lastIndexOf(':'));	23✔
76	const ruleAttributeNS = value?.substring(0, value?.lastIndexOf(':'));	23✔
77	// verify namespace before entity name	23✔
78	if (reqAttributeNS != ruleAttributeNS) {	23!
79	entitiesMatch = false;	×
80	}	×
81	let reqPattern = reqValue?.substring(reqValue?.lastIndexOf(':') + 1);	23✔
82	let reqNSEntityArray = reqPattern?.split('.');	23✔
83	// firstElement could be either entity or namespace	23✔
84	let reqNSOrEntity = reqNSEntityArray[0];	23✔
85	let requestEntityValue = reqNSEntityArray[reqNSEntityArray.length - 1];	23✔
86	if (reqNSOrEntity?.toUpperCase() != requestEntityValue?.toUpperCase()) {	23!
87	// request name space is present	×
88	reqNS = reqNSOrEntity?.toUpperCase();	×
89	}	×
90		23✔
91	if ((reqNS && ruleNS && (reqNS === ruleNS)) \|\| (!reqNS && !ruleNS)) {	23!
92	const reExp = new RegExp(entityRegexValue);	23✔
93	if (requestEntityValue?.match(reExp)) {	23!
94	entitiesMatch = true;	×
95	}	×
96	}	23✔
97	}	23✔
98	else if (requestAttribute?.id == urns?.get('resourceID') && entitiesMatch) { // resource instance ID of a matching entity	183✔
99	const instanceID = requestAttribute?.value;	91✔
100	// found resource instance ID, iterating through the context to check if owners entities match the scoping entities	91✔
101	let ctxResource: Resource = _.find(ctxResources ?? [], ['instance.id', instanceID]);	91!
102	if (ctxResource) {	91!
103	ctxResource = ctxResource?.instance;	×
104	} else {	91✔
105	// look up by ID	91✔
106	ctxResource = _.find(ctxResources ?? [], ['id', instanceID]);	91!
107	}	91✔
108	if (ctxResource) {	91✔
109	const meta = ctxResource.meta;	91✔
110	if (_.isEmpty(meta) \|\| _.isEmpty(meta.owners)) {	91!
111	logger.debug(`Owners information missing for hierarchical scope matching of entity ${attribute.value}, evaluation fails`);	×
112	return false; // no ownership was passed, evaluation fails	×
113	}	×
114	resourceIdOwnersMap.set(instanceID, meta.owners);	91✔
115	} else {	91!
116	logger.debug('Resource of targeted entity was not provided in context');	×
117	return false; // resource of targeted entity was not provided in context	×
118	}	×
119	}	91✔
120	}	279✔
121	} else if (attribute?.id === urns.get('operation')) {	112✔
122	logger.debug('Evaluating resource operation match');	5✔
123	entityOrOperation = attribute?.value;	5✔
124	for (let reqAttribute of reqTarget.resources \|\| []) {	5!
125	// match Rule resource operation URN and operation name with request resource operation URN and operation name	9✔
126	if (reqAttribute?.id === attribute?.id && reqAttribute?.value === attribute?.value) {	9✔
127	// find context resource based	5✔
128	let ctxResource: Resource = _.find(ctxResources ?? [], ['id', entityOrOperation]);	5!
129	if (ctxResource) {	5✔
130	const meta = ctxResource.meta;	5✔
131	if (_.isEmpty(meta) \|\| _.isEmpty(meta.owners)) {	5!
132	logger.debug(`Owners information missing for hierarchical scope matching of entity ${attribute.value}, evaluation fails`);	×
133	return false; // no ownership was passed, evaluation fails	×
134	}	×
135	resourceIdOwnersMap.set(entityOrOperation, meta.owners);	5✔
136	} else {	5!
137	logger.debug('Operation name was not provided in context');	×
138	return false; // Operation name was not provided in context	×
139	}	×
140	}	5✔
141	}	9✔
142	}	5✔
143	}	112✔
144		78✔
145	if (!entityOrOperation) {	118!
146	logger.debug('No entity or operation name found');	×
147	}	×
148		78✔
149	const roleAssociations = context?.subject?.role_associations;	118✔
150	if (_.isEmpty(roleAssociations)) {	118!
151	logger.debug('Role Associations not found');	×
152	return false; // impossible to evaluate context	×
153	}	×
154		78✔
155	// get all user role association mapping matching the ruleRole -> (Rule Subject's Role)	78✔
156	const reducedUserRoleAssocs = roleAssociations.filter((obj) => obj.role === ruleRole);	78✔
157		78✔
158	// verify for exact match, if not then verify from HR scopes	78✔
159	let deleteMapEntries = [];	78✔
160	for (let [resourceId, owners] of resourceIdOwnersMap) {	118✔
161	const entityScopingInstMatch = owners?.some((ownerObj) => {	96✔
162	return reducedUserRoleAssocs?.some((roleObj) => {	113✔
163	// check if Rule's roleScoping Entity matches the Owner's role scoping entity and RoleAssociation RoleScoping entity (ex: Organization / User / Klasse etc)	113✔
164	// and check if roleScoping Instance matches with owner instance	113✔
165	const match = roleObj?.attributes?.some((roleAttributeObject) => roleAttributeObject?.id === urns.get('roleScopingEntity')	113✔
166	&& ownerObj?.id === urns.get('ownerEntity') && ownerObj.value === ruleRoleScopingEntity && ownerObj.value === roleAttributeObject?.value	113✔
167	&& roleAttributeObject?.attributes?.some((roleInstObj) =>	113✔
168	roleInstObj?.id === urns.get('roleScopingInstance') && ownerObj?.attributes?.find((ownerInstObj) => ownerInstObj?.value === roleInstObj?.value)));	113✔
169	logger.debug('Match result for comparing owner indicatory entity and instance with role scoping entity and instance', { match });	113✔
170	return match;	113✔
171	});	113✔
172	});	96✔
173	if (entityScopingInstMatch) {	96✔
174	// its not safe to remove entries while iterating, so add entries to array to delete later	59✔
175	deleteMapEntries.push(resourceId);	59✔
176	}	59✔
177	}	96✔
178	deleteMapEntries.forEach((entry) => resourceIdOwnersMap.delete(entry));	78✔
179		78✔
180	if (resourceIdOwnersMap.size === 0) {	118✔
181	logger.info('Role scoping entities and instances matched');	47✔
182	return true;	47✔
183	}	47✔
184		31✔
185	// verify HR scope match	31✔
186	if (resourceIdOwnersMap.size > 0 && hierarchicalRoleScopeCheck === 'true') {	118✔
187	// reset deleteMapEntries	30✔
188	deleteMapEntries = [];	30✔
189	// check if context subject_id contains HR scope if not make request 'createHierarchicalScopes'	30✔
190	if (context?.subject?.token && _.isEmpty(context.subject.hierarchical_scopes)) {	30✔
191	context = await accessController.createHRScope(context);	11✔
192	}	11✔
193	const reducedHRScopes = context?.subject?.hierarchical_scopes?.filter((hrObj) => hrObj?.role === ruleRole);	30✔
194	for (let [resourceId, owners] of resourceIdOwnersMap) {	30✔
195	const ownerInstances: string[] = owners.filter(	36✔
196	owner => reducedUserRoleAssocs?.some((roleObj) => {	36✔
197	return roleObj?.attributes?.some(	53✔
198	(roleAttributeObject) => roleAttributeObject?.id === urns.get('roleScopingEntity')	53✔
199	&& owner?.id === urns.get('ownerEntity')	53✔
200	&& owner?.value === ruleRoleScopingEntity	53✔
201	&& owner?.value === roleAttributeObject?.value	53✔
202	);	53✔
203	}	53✔
204	)	36✔
205	).flatMap(	36✔
206	owner => owner?.attributes?.filter(	36✔
207	attr => attr?.id === urns.get('ownerInstance')	36✔
208	).map(	36✔
209	attr => attr?.value	36✔
210	)	36✔
211	);	36✔
212	// validate the ownerInstance from HR scope tree for matched scoping entity	36✔
213	traverse(reducedHRScopes).forEach(	36✔
214	(node: any) => { // depth-first search	36✔
215	if (ownerInstances.includes(node?.id)) {	432✔
216	deleteMapEntries.push(resourceId);	28✔
217	}	28✔
218	}	432✔
219	);	36✔
220	}	36✔
221	}	30✔
222		31✔
223	deleteMapEntries.forEach((entry) => resourceIdOwnersMap.delete(entry));	31✔
224		31✔
225	if (resourceIdOwnersMap.size === 0) {	118✔
226	logger.info('Role scoping entities and instances matched from HR scopes');	22✔
227	return true;	22✔
228	}	22✔
229		9✔
230	if (resourceIdOwnersMap.size > 0) {	9✔
231	const resourceIdOwners = Array.from(resourceIdOwnersMap).map(([resourceId, owners]) => ({ resourceId, owners }));	9✔
232	logger.info('Subject not in HR Scope', resourceIdOwners);	9✔
233	return false;	9✔
234	}	9✔
235	};	118✔

restorecommerce / access-control-srv / 8662724573

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous