public static Map<ResourceDescriptor, Set<ResourceAccessType>> getAppResourceAccess(
            Set<ResourceDescriptor> resources, ProxyContext context, String deployment) {

        String appPath = BucketBuilder.APPDATA_PATTERN.formatted(deployment);
        Map<ResourceDescriptor, Set<ResourceAccessType>> result = new HashMap<>();
        String location = BucketBuilder.buildAppDataBucket(context);
        for (ResourceDescriptor resource : resources) {
            if (!resource.getBucketLocation().equals(location)) {
                continue;
            }

            String parentPath = resource.getParentPath();
            String filePath = parentPath == null
                    ? resource.getName()
                    : parentPath + ResourceDescriptor.PATH_SEPARATOR + resource.getName();

            if (filePath != null && filePath.startsWith(appPath)) {
                result.put(resource, ResourceAccessType.ALL);
            }
        }

        return result;
    }
Checks if the context represents an application rather than a user.
Applications should have access to their own published system resources.

@param context The proxy context
@return true if this appears to be an application context, false for user contexts
server/src/main/java/com/epam/aidial/core/server/security/AccessService.java