policy

Documentation

Index

• Constants
• Variables
• func InMapConditionFactory[K comparable, V any]() restrict.Condition
• func SubmitterEqualConditionFactory() restrict.Condition
• type CallInIncidentCondition
  • func (c *CallInIncidentCondition) Check(r *restrict.AccessRequest) error
  • func (*CallInIncidentCondition) Type() string
• type InMapCondition
  • func (c *InMapCondition[K, V]) Check(r *restrict.AccessRequest) error
  • func (s *InMapCondition[K, V]) Type() string
• type SubmitterEqualCondition
  • func (c *SubmitterEqualCondition) Check(r *restrict.AccessRequest) error
  • func (s *SubmitterEqualCondition) Type() string
• type TGInIncidentCondition
  • func (c *TGInIncidentCondition) Check(r *restrict.AccessRequest) error
  • func (*TGInIncidentCondition) Type() string

Constants

const (
	SubmitterEqualConditionType = "SUBMITTER_EQUAL"
	InMapConditionType          = "IN_MAP"
	CallInIncidentConditionType = "CALL_IN_INCIDENT"
	TGInIncidentConditionType   = "TG_IN_INCIDENT"
	SelfOrAdminConditionType    = "SELF_OR_ADMIN"
)

const (
	PresetCreateOwn       = "createOwn"
	PresetReadOwn         = "readOwn"
	PresetUpdateOwn       = "updateOwn"
	PresetDeleteOwn       = "deleteOwn"
	PresetReadShared      = "readShared"
	PresetReadSharedInMap = "readSharedInMap"
	PresetShareOwn        = "shareOwn"

	PresetUpdateSubmitter      = "updateSubmitter"
	PresetDeleteSubmitter      = "deleteSubmitter"
	PresetShareSubmitter       = "shareSubmitter"
	PresetReadInSharedIncident = "readInSharedIncident"
	PresetReadPrivilegedSelf   = "readPrivileged"
	PresetUpdateSelf           = "updateSelf"
	PresetTranscribeSubmitter  = "transcribeSubmitter"
)

Variables

var Policy = &restrict.PolicyDefinition{
	Roles: restrict.Roles{
		entities.RoleUser: {
			Description: "An authenticated user",
			Grants: restrict.GrantsMap{
				entities.ResourceIncident: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Preset: PresetUpdateOwn},
					&restrict.Permission{Preset: PresetDeleteOwn},
					&restrict.Permission{Preset: PresetShareOwn},
				},
				entities.ResourceCall: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Preset: PresetUpdateSubmitter},
					&restrict.Permission{Preset: PresetDeleteSubmitter},
					&restrict.Permission{Action: entities.ActionShare},
					&restrict.Permission{Preset: PresetTranscribeSubmitter},
				},
				entities.ResourceTalkgroup: {
					&restrict.Permission{Action: entities.ActionRead},
				},
				entities.ResourceShare: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Preset: PresetUpdateOwn},
					&restrict.Permission{Preset: PresetDeleteOwn},
				},
				entities.ResourceCallStats: {
					&restrict.Permission{Action: entities.ActionRead},
				},
				entities.ResourceSetting: {
					&restrict.Permission{Action: entities.ActionRead},
				},
				entities.ResourceUser: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Preset: PresetReadPrivilegedSelf},
					&restrict.Permission{Preset: PresetUpdateSelf},
				},
				entities.ResourceAPIKey: {
					&restrict.Permission{Preset: PresetCreateOwn},
					&restrict.Permission{Preset: PresetDeleteOwn},
					&restrict.Permission{Preset: PresetReadOwn},
				},
				entities.ResourceAlert: {
					&restrict.Permission{Action: entities.ActionRead},
				},
				entities.ResourceNexus: {
					&restrict.Permission{Action: entities.ActionConnect},
				},
				entities.ResourcePushSub: {
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionDelete},
				},
				entities.ResourceWebPushSub: {
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Action: entities.ActionDelete},
				},
			},
		},
		entities.RoleSubmitter: {
			Description: "A role that can submit calls",
			Grants: restrict.GrantsMap{
				entities.ResourceCall: {
					&restrict.Permission{Action: entities.ActionCreate},
				},
				entities.ResourceTalkgroup: {

					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Action: entities.ActionUpdate},
				},
				entities.ResourceNexus: {
					&restrict.Permission{Action: entities.ActionConnect},
				},
			},
		},
		entities.RoleSharer: {
			Description: "Someone who is allowed to share",
			Grants: restrict.GrantsMap{
				entities.ResourceShare: {
					&restrict.Permission{Action: entities.ActionCreate},
				},
			},
		},
		entities.RoleShareGuest: {
			Description: "Someone who has a valid share link",
			Grants: restrict.GrantsMap{
				entities.ResourceCall: {
					&restrict.Permission{Preset: PresetReadShared},
					&restrict.Permission{Preset: PresetReadInSharedIncident},
				},
				entities.ResourceIncident: {
					&restrict.Permission{Preset: PresetReadShared},
				},
				entities.ResourceTalkgroup: {
					&restrict.Permission{Action: entities.ActionRead},
				},
			},
		},
		entities.RoleAdmin: {
			Description: "A superuser",
			Parents:     []string{entities.RoleUser},
			Grants: restrict.GrantsMap{
				entities.ResourceIncident: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionUpdate},
					&restrict.Permission{Action: entities.ActionDelete},
					&restrict.Permission{Action: entities.ActionShare},
				},
				entities.ResourceCall: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionUpdate},
					&restrict.Permission{Action: entities.ActionDelete},
					&restrict.Permission{Action: entities.ActionShare},
					&restrict.Permission{Action: entities.ActionTranscribe},
					&restrict.Permission{Action: entities.ActionMoveCallAudio},
				},
				entities.ResourceTalkgroup: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionUpdate},
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Action: entities.ActionDelete},
				},
				entities.ResourceShare: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionUpdate},
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Action: entities.ActionDelete},
				},
				entities.ResourceSetting: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Action: entities.ActionUpdate},
					&restrict.Permission{Action: entities.ActionDelete},
				},
				entities.ResourceUser: {
					&restrict.Permission{Action: entities.ActionReadPrivileged},
					&restrict.Permission{Action: entities.ActionUpdatePrivileged},
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Action: entities.ActionUpdate},
					&restrict.Permission{Action: entities.ActionDelete},
				},
				entities.ResourceAlert: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Action: entities.ActionDelete},
					&restrict.Permission{Action: entities.ActionSimulate},
					&restrict.Permission{Action: entities.ActionTestNotify},
				},
				entities.ResourceAPIKey: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Action: entities.ActionUpdate},
					&restrict.Permission{Action: entities.ActionDelete},
				},
				entities.ResourceSystem: {
					&restrict.Permission{Action: entities.ActionRead},
					&restrict.Permission{Action: entities.ActionCreate},
					&restrict.Permission{Action: entities.ActionUpdate},
					&restrict.Permission{Action: entities.ActionDelete},
				},
				entities.ResourcePushSub: {
					&restrict.Permission{Action: entities.ActionDelete},
					&restrict.Permission{Action: entities.ActionRead},
				},
			},
		},
		entities.RoleSystem: {
			Description: "A system service",
			Parents:     []string{entities.RoleAdmin},
		},
		entities.RolePublic: {
			Description: "Everybody else",
			Grants: restrict.GrantsMap{
				entities.ResourceShare: {
					&restrict.Permission{Action: entities.ActionRead},
				},
			},
		},
		entities.RoleTranscriber: {
			Description: "Call transcription service",
			Grants: restrict.GrantsMap{
				entities.ResourceCall: {
					&restrict.Permission{Action: entities.ActionTranscribe},
				},
			},
		},
	},
	PermissionPresets: restrict.PermissionPresets{
		PresetUpdateOwn: &restrict.Permission{
			Action: entities.ActionUpdate,
			Conditions: restrict.Conditions{
				&restrict.EqualCondition{
					ID: "isOwner",
					Left: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "OwnerID",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
				},
			},
		},
		PresetDeleteOwn: &restrict.Permission{
			Action: entities.ActionDelete,
			Conditions: restrict.Conditions{
				&restrict.EqualCondition{
					ID: "isOwner",
					Left: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "OwnerID",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
				},
			},
		},
		PresetCreateOwn: &restrict.Permission{
			Action: entities.ActionCreate,
			Conditions: restrict.Conditions{
				&restrict.EqualCondition{
					ID: "isOwner",
					Left: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "OwnerID",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
				},
			},
		},
		PresetReadOwn: &restrict.Permission{
			Action: entities.ActionRead,
			Conditions: restrict.Conditions{
				&restrict.EqualCondition{
					ID: "isOwner",
					Left: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "OwnerID",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
				},
			},
		},
		PresetShareOwn: &restrict.Permission{
			Action: entities.ActionShare,
			Conditions: restrict.Conditions{
				&restrict.EqualCondition{
					ID: "isOwner",
					Left: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "OwnerID",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
				},
			},
		},
		PresetUpdateSubmitter: &restrict.Permission{
			Action: entities.ActionUpdate,
			Conditions: restrict.Conditions{
				&SubmitterEqualCondition{
					ID: "isSubmitter",
					Left: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "Submitter",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
				},
			},
		},
		PresetDeleteSubmitter: &restrict.Permission{
			Action: entities.ActionDelete,
			Conditions: restrict.Conditions{
				&SubmitterEqualCondition{
					ID: "isSubmitter",
					Left: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "Submitter",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
				},
			},
		},
		PresetShareSubmitter: &restrict.Permission{
			Action: entities.ActionShare,
			Conditions: restrict.Conditions{
				&SubmitterEqualCondition{
					ID: "isSubmitter",
					Left: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "Submitter",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
				},
			},
		},
		PresetReadShared: &restrict.Permission{
			Action: entities.ActionRead,
			Conditions: restrict.Conditions{
				&restrict.EqualCondition{
					ID: "isOwner",
					Left: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "ID",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "EntityID",
					},
				},
			},
		},
		PresetReadInSharedIncident: &restrict.Permission{
			Action: entities.ActionRead,
			Conditions: restrict.Conditions{
				&CallInIncidentCondition{
					ID: "callInIncident",
					Call: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "ID",
					},
					Incident: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "EntityID",
					},
				},
			},
		},
		PresetReadPrivilegedSelf: &restrict.Permission{
			Action: entities.ActionReadPrivileged,
			Conditions: restrict.Conditions{
				&restrict.EqualCondition{
					ID: "userSelf",
					Left: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "ID",
					},
				},
			},
		},
		PresetUpdateSelf: &restrict.Permission{
			Action: entities.ActionUpdate,
			Conditions: restrict.Conditions{
				&restrict.EqualCondition{
					ID: "userSelf",
					Left: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "ID",
					},
				},
			},
		},
		PresetTranscribeSubmitter: &restrict.Permission{
			Action: entities.ActionTranscribe,
			Conditions: restrict.Conditions{
				&SubmitterEqualCondition{
					ID: "isSubmitter",
					Left: &restrict.ValueDescriptor{
						Source: restrict.ResourceField,
						Field:  "Submitter",
					},
					Right: &restrict.ValueDescriptor{
						Source: restrict.SubjectField,
						Field:  "ID",
					},
				},
			},
		},
	},
}

Functions

func InMapConditionFactory

func InMapConditionFactory[K comparable, V any]() restrict.Condition

func SubmitterEqualConditionFactory

func SubmitterEqualConditionFactory() restrict.Condition

Types

type CallInIncidentCondition

type CallInIncidentCondition struct {
	ID       string                    `json:"name,omitempty" yaml:"name,omitempty"`
	Call     *restrict.ValueDescriptor `json:"call" yaml:"call"`
	Incident *restrict.ValueDescriptor `json:"incident" yaml:"incident"`
}

func (*CallInIncidentCondition) Check

func (c *CallInIncidentCondition) Check(r *restrict.AccessRequest) error

func (*CallInIncidentCondition) Type

func (*CallInIncidentCondition) Type() string

type InMapCondition

type InMapCondition[K comparable, V any] struct {
	ID  string                    `json:"name,omitempty" yaml:"name,omitempty"`
	Key *restrict.ValueDescriptor `json:"key" yaml:"key"`
	Map *restrict.ValueDescriptor `json:"map" yaml:"map"`
}

func (*InMapCondition[K, V]) Check

func (c *InMapCondition[K, V]) Check(r *restrict.AccessRequest) error

func (*InMapCondition[K, V]) Type

func (s *InMapCondition[K, V]) Type() string

type SubmitterEqualCondition

type SubmitterEqualCondition struct {
	ID    string                    `json:"name,omitempty" yaml:"name,omitempty"`
	Left  *restrict.ValueDescriptor `json:"left" yaml:"left"`
	Right *restrict.ValueDescriptor `json:"right" yaml:"right"`
}

func (*SubmitterEqualCondition) Check

func (c *SubmitterEqualCondition) Check(r *restrict.AccessRequest) error

func (*SubmitterEqualCondition) Type

func (s *SubmitterEqualCondition) Type() string

type TGInIncidentCondition

type TGInIncidentCondition struct {
	ID       string                    `json:"name,omitempty" yaml:"name,omitempty"`
	TG       *restrict.ValueDescriptor `json:"tg" yaml:"tg"`
	Incident *restrict.ValueDescriptor `json:"incident" yaml:"incident"`
}

func (*TGInIncidentCondition) Check

func (c *TGInIncidentCondition) Check(r *restrict.AccessRequest) error

func (*TGInIncidentCondition) Type

func (*TGInIncidentCondition) Type() string