Evaluate Role-Based Access with Deny Precedence

Implement is_access_allowed(user_roles: list[str], role_permissions: list[list[str]], property_name: str) -> bool.

Each permission is [role, property, effect], where effect is either "allow" or "deny". Consider only permissions whose role appears in user_roles and whose property equals property_name.

Return false if any applicable permission is deny, even when another applicable permission is allow. Otherwise return true if at least one applicable permission is allow. Return false when there is no applicable permission.

Valid Input Domain

• Role and property names are case-sensitive nonempty strings.
• Every permission has exactly three strings and a valid effect.
• Duplicate permissions do not change the result.

Constraints

• 0 <= user_roles.length <= 100,000
• 0 <= role_permissions.length <= 300,000

Public Examples

Example 1

Input: user_roles = ["reader", "auditor"], role_permissions = [["reader", "report", "allow"], ["auditor", "report", "deny"]], property_name = "report"

Output: false

Example 2

Input: user_roles = ["reader"], role_permissions = [["reader", "report", "allow"]], property_name = "report"

Output: true

Hint: Short-circuit by precedence

The two possible effects do not have equal weight, and the absence of both has an explicit outcome.