in reports-scheduler/src/main/kotlin/org/opensearch/reportsscheduler/security/UserAccessManager.kt [114:126]
fun doesUserHasAccess(user: User?, tenant: String, access: List<String>): Boolean {
if (user == null) { // Security is disabled
return true
}
if (getUserTenant(user) != tenant) {
return false
}
return if (PluginSettings.isRbacEnabled()) {
user.backendRoles.map { "$BACKEND_ROLE_TAG$it" }.any { it in access }
} else {
true
}
}