@@ -114,16 +114,16 @@ site_allow(roles) := num if {
114114# Adding a second org_members set might affect the partial evaluation.
115115# This is being left until org scopes are used.
116116org_members:= {orgID|
117- input.subject.roles[_].org [orgID]
117+ input.subject.roles[_].by_org_id [orgID]
118118}
119119
120120# 'org' is the same as 'site' except we need to iterate over each organization
121121# that the actor is a member of.
122122default org:= 0
123- org:= org_allow (input.subject.roles)
123+ org:= org_allow (input.subject.roles, " org "
124124
125125default scope_org:= 0
126- scope_org:= org_allow ([input.subject.scope])
126+ scope_org:= org_allow ([input.subject.scope], " org "
127127
128128# org_allow_set is a helper function that iterates over all orgs that the actor
129129# is a member of. For each organization it sets the numerical allow value
@@ -135,12 +135,12 @@ scope_org := org_allow([input.subject.scope])
135135# The reason we calculate this for all orgs, and not just the input.object.org_owner
136136# is that sometimes the input.object.org_owner is unknown. In those cases
137137# we have a list of org_ids that can we use in a SQL 'WHERE' clause.
138- org_allow_set (roles):= allow_set if {
138+ org_allow_set (roles, key ):= allow_set if {
139139allow_set:= {id: num|
140140id:= org_members[_]
141141set:= {is_allowed|
142142# Iterate over all org permissions in all roles
143- perm:= roles[_].org [id][_]
143+ perm:= roles[_].by_org_id [id][key ][_]
144144perm.action in [input.action," *"
145145perm.resource_type in [input.object.type," *"
146146
@@ -151,11 +151,11 @@ org_allow_set(roles) := allow_set if {
151151}
152152}
153153
154- org_allow (roles):= num if {
154+ org_allow (roles, key ):= num if {
155155# If the object has "any_org" set to true, then use the other
156156# org_allow block.
157157not input.object.any_org
158- allow:= org_allow_set (roles)
158+ allow:= org_allow_set (roles, key )
159159
160160# Return only the org value of the input's org.
161161# The reason why we do not do this up front, is that we need to make sure
@@ -171,9 +171,9 @@ org_allow(roles) := num if {
171171# This is useful for UI elements when we want to conclude, "Can the user create
172172# a new template in any organization?"
173173# It is easier than iterating over every organization the user is apart of.
174- org_allow (roles):= num if {
174+ org_allow (roles, key ):= num if {
175175input.object.any_org# if this is false, this code block is not used
176- allow:= org_allow_set (roles)
176+ allow:= org_allow_set (roles, key )
177177
178178# allow is a map of {"<org_id>": <number>}. We only care about values
179179# that are 1, and ignore the rest.