func vetDeregisterWithACL(acl acl.ACL, subj *structs.DeregisterRequest,
	ns *structs.NodeService, nc *structs.HealthCheck) error {
	// Fast path if ACLs are not enabled.
	if acl == nil {
		return nil
	}

	// This order must match the code in applyRegister() in fsm.go since it
	// also evaluates things in this order, and will ignore fields based on
	// this precedence. This lets us also ignore them from an ACL perspective.
	if subj.ServiceID != "" {
		if ns == nil {
			return fmt.Errorf("Unknown service '%s'", subj.ServiceID)
		}
		if !acl.ServiceWrite(ns.Service) {
			return errPermissionDenied
		}
	} else if subj.CheckID != "" {
		if nc == nil {
			return fmt.Errorf("Unknown check '%s'", subj.CheckID)
		}
		if nc.ServiceID != "" {
			if !acl.ServiceWrite(nc.ServiceName) {
				return errPermissionDenied
			}
		} else {
			if !acl.NodeWrite(subj.Node) {
				return errPermissionDenied
			}
		}
	} else {
		if !acl.NodeWrite(subj.Node) {
			return errPermissionDenied
		}
	}

	return nil
}
// vetDeregisterWithACL applies the given ACL's policy to the catalog update and
// determines if it is allowed. Since the catalog deregister request is so
// dynamic, this is a pretty complex algorithm and was worth breaking out of the
// endpoint. The NodeService for the referenced service must be supplied, and can
// be nil; similar for the HealthCheck for the referenced health check.
vetDeregisterWithACL applies the given ACL's policy to the catalog update and
determines if it is allowed. Since the catalog deregister request is so
dynamic, this is a pretty complex algorithm and was worth breaking out of the
endpoint. The NodeService for the referenced service must be supplied, and can
be nil; similar for the HealthCheck for the referenced health check.
// vetDeregisterWithACL applies the given ACL ' s policy to the catalog update and // determines if it is allowed . Since the catalog deregister request is so // dynamic this is a pretty complex algorithm and was worth breaking out of the // endpoint . The NodeService for the referenced service must be supplied and can // be nil ; similar for the HealthCheck for the referenced health check .
func vetDeregisterWithACL(acl acl.ACL, subj *structs.DeregisterRequest,
	ns *structs.NodeService, nc *structs.HealthCheck) error {
	if acl == nil {
		return nil
	}
	if subj.ServiceID != "" {
		if ns == nil {
			return fmt.Errorf("Unknown service '%s'", subj.ServiceID)
		}
		if !acl.ServiceWrite(ns.Service) {
			return errPermissionDenied
		}
	} else if subj.CheckID != "" {
		if nc == nil {
			return fmt.Errorf("Unknown check '%s'", subj.CheckID)
		}
		if nc.ServiceID != "" {
			if !acl.ServiceWrite(nc.ServiceName) {
				return errPermissionDenied
			}
		} else {
			if !acl.NodeWrite(subj.Node) {
				return errPermissionDenied
			}
		}
	} else {
		if !acl.NodeWrite(subj.Node) {
			return errPermissionDenied
		}
	}
	return nil
}
func vetDeregisterWithACL ( acl acl . ACL , subj * structs . DeregisterRequest , ns * structs . NodeService , nc * structs . HealthCheck ) error { if acl == nil { return nil } if subj . ServiceID != " " { if ns == nil { return fmt . Errorf ( " " , subj . ServiceID ) } if ! acl . ServiceWrite ( ns . Service ) { return errPermissionDenied } } else if subj . CheckID != " " { if nc == nil { return fmt . Errorf ( " " , subj . CheckID ) } if nc . ServiceID != " " { if ! acl . ServiceWrite ( nc . ServiceName ) { return errPermissionDenied } } else { if ! acl . NodeWrite ( subj . Node ) { return errPermissionDenied } } } else { if ! acl . NodeWrite ( subj . Node ) { return errPermissionDenied } } return nil }
vetDeregisterWithACL applies the given ACL's policy to the catalog update and
determines if it is allowed.
vetDeregisterWithACL applies the given ACL ' s policy to the catalog update and determines if it is allowed .
// Fast path if ACLs are not enabled. // This order must match the code in applyRegister() in fsm.go since it // also evaluates things in this order, and will ignore fields based on // this precedence. This lets us also ignore them from an ACL perspective.