Support updating a resource's group masks

server/access.rkt

@@ -30,7 +30,7 @@
                      (lambda (f)
                        (set-dataset-desc! dset (f (dataset-desc dset))))))
   (define view (cons 'view
-                     (lambda () (dataset-desc dset))))
+                     (lambda () "this is some description alright")))
   (define no-access (cons 'no-access
                           (lambda () 'no-access)))
   (cons name (list no-access view edit)))

server/privileges.rkt

@@ -3,7 +3,8 @@
 (provide privilege-line
          minimum-access-mask
          maximum-access-mask
-         mask-join)
+         mask-join
+         is-mask-for?)
 
 ; A `privilege-line` is a set of privileges that have a monotonically
 ; increasing structure, e.g. no access <- can read <- can read & write
@@ -41,7 +42,6 @@
    plines))
 
 
-
 ; Given a plines poset and a list of masks, return a mask with the
 ; highest access level per pline that was found in the masks.
 (define (mask-join plines . masks)

server/resource.rkt

@@ -5,6 +5,9 @@
 
 (provide (struct-out resource)
          user-canonical-mask
+         user-masks
+         resource-set-mask
+         get-actions
          pl-edit-view)
 
 (struct resource (name owner content plines group-masks))
@@ -65,8 +68,18 @@
                               (eq? (dict-ref mask k) (car x)))
                             (reverse v)))))))
 
-;; (define (resource-set-mask res gid mask)
-;;   (
+;; Given a resource, a group ID, and a mask that fits the resource,
+;; returns a new resource with the corresponding group's mask updated
+;; to the given mask. Returns #f if the mask doesn't fit.
+(define (resource-set-mask res gid mask)
+  (if (is-mask-for? (resource-plines res) mask)
+      (struct-copy resource
+                   res
+                   [group-masks (dict-set
+                                 (resource-group-masks res)
+                                 gid
+                                 mask)])
+      #f))
 
 
 ;; Constructor for a pline with actions for no access, getting, and