bitraf / p2k16

Bitraf's self-server system for doors, memberships and tools.
https://bitraf.no
MIT License
10 stars 12 forks source link

More correct door authz handling #112

Closed omega closed 3 years ago

omega commented 3 years ago

We simplify a bit by checking payment and employee status first. Employee have access to all doors, non-paying members have access to no doors, so we can get that out of the way first.

Once we have done that, we check better that the account is a member of at least one of the circles on a door, if there is no overlap of circles, the whole request is denied.