src/server/auth/server/api_server.go
func (a *apiServer) getScope(ctx context.Context, subject string, acl *authclient.ACL) (authclient.Scope, error) {
	// Get scope based on user's direct access
	scope := acl.Entries[subject]

	// Expand scope based on group access
	groups, err := a.getGroups(ctx, subject)
	if err != nil {
		return authclient.Scope_NONE, fmt.Errorf("could not retrieve caller's "+
			"group memberships: %v", err)
	}
	for _, g := range groups {
		groupScope := acl.Entries[g]
		if scope < groupScope {
			scope = groupScope
		}
	}
	return scope, nil
}
func (a *apiServer) getScope(ctx context.Context, subject string, acl *authclient.ACL) (authclient.Scope, error) {
	// Get scope based on user's direct access
	scope := acl.Entries[subject]

	// Expand scope based on group access
	groups, err := a.getGroups(ctx, subject)
	if err != nil {
		return authclient.Scope_NONE, fmt.Errorf("could not retrieve caller's "+
			"group memberships: %v", err)
	}
	for _, g := range groups {
		groupScope := acl.Entries[g]
		if scope < groupScope {
			scope = groupScope
		}
	}
	return scope, nil
}
// getScope is a helper function for the GetScope GRPC API, as well is
// Authorized() and other authorization checks (e.g. checking if a user is an
// OWNER to determine if they can modify an ACL).