authorize user for each group specified in policy return [STATUS_CODE, MESSAGE, BODY]
def authorize_case(user, user_group, membership_assert, action_assert)
status_code, message, body = 500, "internal error", []
if membership_assert.call(user, user_group, self)
@group_policy = @policy["cases"][user_group]
required_actions = @group_policy["actions"]
if required_actions.size >= 1
required_actions.each { |action|
body << action if !action_assert.call(user, action, self)
}
end
if body.empty?
status_code, message = 200, "authorized as member of #{user_group}"
else
status_code = 300
message = "actions required"
end
else
status_code = 400
message = "no membership found"
end
[status_code, message, body]
end