func (ac *AccessController) can(username, action, repository string) bool {
	can := false
	pg, ok := ac.Config.Repositories[repository]
	if ok {
		can = isPermitted(username, action, pg)
	}
	if !can {
		if ac.isAdmin(username) && contains(ac.Config.AdminPolicy.Actions, action) {
			can = true
		}
	}
	return can
}
can verifies if a user can do action on repository.
package api
import (
	"context"
	"encoding/base64"
	"net/http"
	"strings"
	"time"
	"github.com/anuvu/zot/pkg/api/config"
	"github.com/anuvu/zot/pkg/log"
	"github.com/gorilla/mux"
)
type contextKey int
const (
	CREATE = "create"
	READ   = "read"
	UPDATE = "update"
	DELETE = "delete"
	authzCtxKey contextKey = 0
)
type AccessController struct {
	Config *config.AccessControlConfig
	Log    log.Logger
}
type AccessControlContext struct {
	userAllowedRepos []string
	isAdmin          bool
}
func NewAccessController(config *config.Config) *AccessController {
	return &AccessController{
		Config: config.AccessControl,
		Log:    log.NewLogger(config.Log.Level, config.Log.Output),
	}
}
func (ac *AccessController) getReadRepos(username string) []string {
	var repos []string
	for r, pg := range ac.Config.Repositories {
		for _, p := range pg.Policies {
			if (contains(p.Users, username) && contains(p.Actions, READ)) ||
				contains(pg.DefaultPolicy, READ) {
				repos = append(repos, r)
			}
		}
	}
	return repos
}