def assert_request_user_has_rule_trigger_and_action_permission(request, rule_api):
 if (not cfg.CONF.rbac.enable):
  return True
 trigger = rule_api.trigger
 action = rule_api.action
 trigger_type = trigger['type']
 action_ref = action['ref']
 user_db = get_user_db_from_request(request=request)
 has_trigger_permission = request_user_has_rule_trigger_permission(request=request, trigger=trigger)
 if (not has_trigger_permission):
  msg = ('User "%s" doesn\'t have required permission (%s) to use trigger %s' % (user_db.name, PermissionType.WEBHOOK_CREATE, trigger_type))
  raise AccessDeniedError(message=msg, user_db=user_db)
 has_action_permission = request_user_has_rule_action_permission(request=request, action_ref=action_ref)
 if (not has_action_permission):
  msg = ('User "%s" doesn\'t have required (%s) permission to use action %s' % (user_db.name, PermissionType.ACTION_EXECUTE, action_ref))
  raise AccessDeniedError(message=msg, user_db=user_db)
 return True

def assert_request_user_has_rule_trigger_and_action_permission ( request , rule_api ) : if ( not cfg . CONF . rbac . enable ) : return True trigger = rule_api . trigger action = rule_api . action trigger_type = trigger [ 'type' ] action_ref = action [ 'ref' ] user_db = get_user_db_from_request ( request = request ) has_trigger_permission = request_user_has_rule_trigger_permission ( request = request , trigger = trigger ) if ( not has_trigger_permission ) : msg = ( 'User "%s" doesn\'t have required permission (%s) to use trigger %s' % ( user_db . name , PermissionType . WEBHOOK_CREATE , trigger_type ) ) raise AccessDeniedError ( message = msg , user_db = user_db ) has_action_permission = request_user_has_rule_action_permission ( request = request , action_ref = action_ref ) if ( not has_action_permission ) : msg = ( 'User "%s" doesn\'t have required (%s) permission to use action %s' % ( user_db . name , PermissionType . ACTION_EXECUTE , action_ref ) ) raise AccessDeniedError ( message = msg , user_db = user_db ) return True
check that the currently logged-in has necessary permissions on trhe trigger and action used / referenced inside the rule .