def not_minimal

near-v-framework@0.4.0.0 · domain/architecture/system/deployment/azure/ops.bend:137

import Base
import near-v-framework@0.4.0.0/domain/architecture/system/deployment/azure/type.bend as Az
import near-v-framework@0.4.0.0/domain/architecture/environment/agreement/type.bend as G
import near-v-framework@0.4.0.0/domain/architecture/environment/agreement/ops.bend as GO

137# The resource groups where `person` has other than exactly what the agreement grants there (nothing
138# granted means no access at all).
139def not_minimal(groups: List<&2, String>, +a: G.Agreement, +person: String, +actual: List<&2, Az.Permission>) -> List<&2, String>:
140  match groups:
141    case []:
142      []
143    case +g <> rest:
144      keep_if(Bool.not(exact(g, GO.granted(a, person, g), actual)), g, not_minimal(rest, a, person, actual))