accesspolicy

README

accesspolicy

This initiative employs a declarative and explicit strategy for handling access control in Go projects. It is consolidated in a single location and presented in a manner that is comprehensible to individuals with lesser technical expertise. If you have experience with other declarative access frameworks, like AWS' IAM, you will find the syntax to be familiar.

Example:

package main

const rootUserID = 1

func isRoot(ctx context.Context, user User, action Action) bool {
	return user.GetID() == rootUserID
}

func main() {
	// Define a policy
	policy := Policy{
		Statements: []Statement{
			{
				Actions:   Actions{ActionAll},
				Principal: PrincipalAuthenticated,
				Conditions: Conditions{
					isRoot,
				},
				Effect: EffectAllow,
			},
			{
				Actions:   Actions{ActionAnySafe},
				Principal: PrincipalAuthenticated,
				Effect:    EffectAllow,
			},
		},
	}

	// Define a user and an action
	ctx := context.Background()
	usr := &user{id: rootUserID}
	action := HTTPMethodAction(http.MethodGet)

	// Enforce the policy
	if policy.HasPermission(ctx, usr, action) {
		// Allow
	} else {
		// Deny
	}
}

type user struct{ id uint }
func (u *user) GetID() uint              { return u.id }
func (u *user) IsAnonymous() bool        { return u.id == 0 }

Documentation

Index

• Variables
• type Action
  • func HTTPMethodAction(method string) Action
• type Actions
  • func (l Actions) Match(action Action) bool
• type Condition
• type Conditions
  • func (l Conditions) Match(ctx context.Context, user User, action Action) bool
• type Effect
• type Policy
  • func (p *Policy) HasPermission(ctx context.Context, user User, action Action) bool
• type Principal
  • func GroupPrincipal(group ...string) Principal
  • func PermissionPrincipal(permission ...string) Principal
  • func UserPrincipal(userID ...string) Principal
  • func (p Principal) Match(user User) bool
• type Statement
• type User

Variables

var (
	ActionAll     = Action{"*", false}
	ActionAnySafe = Action{"any_safe", true}
)

Types

type Action

type Action struct {
	Name   string
	IsSafe bool
}

func HTTPMethodAction

func HTTPMethodAction(method string) Action

type Actions

type Actions []Action

func (Actions) Match

func (l Actions) Match(action Action) bool

type Condition

type Condition func(ctx context.Context, user User, action Action) bool

type Conditions

type Conditions []Condition

func (Conditions) Match

func (l Conditions) Match(ctx context.Context, user User, action Action) bool

type Effect

type Effect string

const (
	EffectAllow Effect = "allow"
	EffectDeny  Effect = "deny"
)

type Policy

type Policy struct {
	Statements []Statement
}

func (*Policy) HasPermission

func (p *Policy) HasPermission(ctx context.Context, user User, action Action) bool

type Principal

type Principal string

const (
	PrincipalAll           Principal = "*"
	PrincipalAuthenticated Principal = "authenticated"
	PrincipalAnonymous     Principal = "anonymous"
)

func GroupPrincipal

func GroupPrincipal(group ...string) Principal

GroupPrincipal will match any user that is in any of the groups

func PermissionPrincipal

func PermissionPrincipal(permission ...string) Principal

PermissionPrincipal will match any user that has all the permissions TODO: support OR ?

func UserPrincipal

func UserPrincipal(userID ...string) Principal

UserPrincipal will match any user whose ID is in the list

func (Principal) Match

func (p Principal) Match(user User) bool

type Statement

type Statement struct {
	Actions    Actions
	Principal  Principal
	Conditions Conditions
	Effect     Effect
}

type User

type User interface {
	IsAnonymous() bool
}