@@ -250,24 +250,34 @@ def _intersection(*sets):
250250
251251 def get_access_denying_partitions (self , user_groups ):
252252 """
253- Arguments:
254- dict[int: Group]: Given a user, a mapping from user
255- partition IDs to the group to which the user belongs in
256- each partition.
253+ Get the partitions that are denying access to the user.
254+
255+ Args:
256+ dict[int: Union[Group, list[Group]]]: Given a user, a mapping from
257+ user partition IDs to either a single Group or a list of Groups
258+ to which the user belongs in each partition.
257259
258260 Returns:
259261 list of ints: Which partition is denying access
260262 """
261263 denied_access = []
262264 for partition_id , allowed_group_ids in self .get_allowed_groups ().items ():
263- # If the user is not assigned to a group for this partition,
265+ # If the user is not assigned to any group for this partition,
264266 # return partition as one that would deny access.
265267 if partition_id not in user_groups :
266268 denied_access .append (partition_id )
269+ continue
270+
271+ user_partition_groups = user_groups [partition_id ]
272+ # Convert single group to list for consistent handling
273+ if not isinstance (user_partition_groups , list ):
274+ user_partition_groups = [user_partition_groups ]
275+
276+ # Check if any of the user's groups in this partition are allowed
277+ has_allowed_group = any (group .id in allowed_group_ids for group in user_partition_groups )
267278
268- # If the user does not belong to one of the allowed groups for this
269- # partition, then return this partition as one that would deny access
270- elif user_groups [partition_id ].id not in allowed_group_ids :
279+ # If none of the user's groups are allowed, deny access
280+ if not has_allowed_group :
271281 denied_access .append (partition_id )
272282
273283 return denied_access
0 commit comments