` prefix; the * legacy 1.7 `admin.` prefix maps 1:1, so migrated accounts keep * their existing grants. Holding `.` under any listed prefix * authorizes the action. Directories without that map fall back to the flex * authorize rule. * * Super-admin short-circuiting is intentionally left to callers, since each * context resolves super-admin scope differently. */ final class DirectoryPermission { public static function isAuthorized( FlexDirectory $directory, string $action, UserInterface $user, PermissionResolver $resolver ): bool { $permissions = $directory->getConfig('admin.permissions'); if ($permissions) { foreach (array_keys($permissions) as $prefix) { if ($resolver->resolve($user, $prefix . '.' . $action)) { return true; } } return false; } $rule = $directory->getAuthorizeRule('admin', $action); return (bool) $resolver->resolve($user, $rule); } }