resourceSet.getAll(): works also for non-admins.

package.json

@@ -99,6 +99,7 @@
     "lodash.pick": "^4.1.0",
     "lodash.pickby": "^4.2.0",
     "lodash.remove": "^4.0.1",
+    "lodash.some": "^4.2.0",
     "lodash.sortby": "^4.2.0",
     "lodash.startswith": "^4.0.0",
     "lodash.trim": "^4.2.0",

src/api/resource-set.js

@@ -1,3 +1,15 @@
+import filter from 'lodash.filter'
+import some from 'lodash.some'
+
+import {
+  Unauthorized
+} from '../api-errors'
+import {
+  forEach
+} from '../utils'
+
+// ===================================================================
+
 export function create ({ name, subjects, objects }) {
   return this.createResourceSet(name, subjects, objects)
 }
@@ -87,11 +99,28 @@ get.params = {
 
 // -------------------------------------------------------------------
 
-export function getAll () {
+export async function getAll () {
-  return this.getAllResourceSets()
+  const { user } = this
-}
+  if (!user) {
+    throw new Unauthorized()
+  }
 
-getAll.permission = 'admin'
+  const sets = await this.getAllResourceSets()
+
+  if (user.permission === 'admin') {
+    return sets
+  }
+
+  const subjects = {
+    [user.id]: true
+  }
+  forEach(user.groups, groupId => {
+    subjects[groupId] = true
+  })
+  const predicate = id => subjects[id]
+
+  return filter(sets, set => some(set.subjects, predicate))
+}
 
 // -------------------------------------------------------------------