iam

package
v0.7.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 13, 2026 License: BSD-2-Clause Imports: 5 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (

	// ApiInitiator represents API gateway service for external requests.
	ApiInitiator cqrsiam.Initiator = "api"
	// AgentBacktest represents the standalone backtest agent service that processes task files.
	AgentBacktest cqrsiam.Initiator = "agent-backtest"
	// CoreBacktestAgentJob represents the job execution service for backtest processing.
	CoreBacktestAgentJob cqrsiam.Initiator = "core-backtest-agent-job"
	// CoreBacktestAgentOptimize represents the optimization service for parameter tuning.
	CoreBacktestAgentOptimize cqrsiam.Initiator = "core-backtest-agent-optimize"
	// CoreBacktestAgentQueue represents the queue service that triggers backtests automatically.
	CoreBacktestAgentQueue cqrsiam.Initiator = "core-backtest-agent-queue"
	// CoreBacktestAgentRun represents the execution service that runs individual backtests.
	CoreBacktestAgentRun cqrsiam.Initiator = "core-backtest-agent-run"
	// CoreBacktestController represents the main backtest controller service.
	CoreBacktestController cqrsiam.Initiator = "core-backtest-controller"
	// CoreBacktestDummyUser represents a test user for backtest operations.
	CoreBacktestDummyUser cqrsiam.Initiator = "core-backtest-dummyuser"
	// CoreBacktestCron represents the automated strategy queuing service.
	CoreBacktestCron cqrsiam.Initiator = "core-backtest-cron"
	// CoreReview represents the review management service.
	CoreReview cqrsiam.Initiator = "core-review"
	// CoreStrategy represents the strategy management service.
	CoreStrategy cqrsiam.Initiator = "core-strategy"
	// CoreStrategyPublishStrategies represents the strategy publishing command service.
	CoreStrategyPublishStrategies cqrsiam.Initiator = "core-strategy-publish-strategies"
	// CoreStrategyWatchStrategies represents the strategy watching command service.
	CoreStrategyWatchStrategies cqrsiam.Initiator = "core-strategy-watch-strategies"
	// CoreReportCronjob represents the automated report scheduling service.
	CoreReportCronjob cqrsiam.Initiator = "core-report-cron"
	// CoreMailControllerRefreshTokenCronjob represents the daily OAuth2 token refresh CronJob.
	CoreMailControllerRefreshTokenCronjob cqrsiam.Initiator = "core-mail-controller-refresh-token-cronjob" // #nosec G101 -- false positive: this is a service identifier, not a credential
	// Mt5TradeExecutor represents the MT5 broker integration service that handles order/position callbacks.
	Mt5TradeExecutor cqrsiam.Initiator = "mt5-trade-executor"
	// CapitalcomTradeExecutor represents the Capital.com broker integration service that handles order/position callbacks.
	CapitalcomTradeExecutor cqrsiam.Initiator = "capitalcom-trade-executor"

	// CoreNotificationController sends discord messages for alerts and notifications.
	CoreNotificationController cqrsiam.Initiator = "core-notification-controller"
	// CoreActualTradeController represents the actual trade controller service that manages trade execution.
	CoreActualTradeController cqrsiam.Initiator = "core-actualtrade-controller"
	// Mt5AccountConverter represents the MT5 account converter service that processes raw MT5 account data.
	Mt5AccountConverter cqrsiam.Initiator = "mt5-account-converter"
	// Mt5AccountController represents the MT5 account controller service that manages MT5 account lifecycle.
	Mt5AccountController cqrsiam.Initiator = "mt5-account-controller"

	// UserBenBusiness represents the business account for trading operations.
	UserBenBusiness cqrsiam.Initiator = "borbe.capital@gmail.com"
	// UserBenPrivate represents the personal administrative account.
	UserBenPrivate cqrsiam.Initiator = "benjamin.borbe@gmail.com"
	// UserBenSeibert represents the corporate development account.
	UserBenSeibert cqrsiam.Initiator = "benjamin.borbe@seibert.group"
	// UserStefan represents an additional authorized user.
	UserStefan cqrsiam.Initiator = "stefan.nicolin@googlemail.com"

	// BossOpenClaw represents the Boss AI assistant with readonly monitoring access.
	BossOpenClaw cqrsiam.Initiator = "boss-openclaw"
	// TradingOpenClaw represents the Trading AI assistant with readonly access (may expand later).
	TradingOpenClaw cqrsiam.Initiator = "trading-openclaw"

	// CapitalcomMarketDetailConverter converts market details from CapitalCom into trading symbols.
	CapitalcomMarketDetailConverter cqrsiam.Initiator = "capitalcom-marketdetail-converter"
	// AcgSymbolConverter converts symbols from ACG broker into trading symbols.
	AcgSymbolConverter cqrsiam.Initiator = "acg-symbol-converter"
	// DwxSymbolConverter converts symbols from DWX broker into trading symbols.
	DwxSymbolConverter cqrsiam.Initiator = "dwx-symbol-converter"
	// FtmoSymbolConverter converts symbols from FTMO broker into trading symbols.
	FtmoSymbolConverter cqrsiam.Initiator = "ftmo-symbol-converter"
	// CapitalcomAccountConverter converts account data from CapitalCom broker into trading accounts.
	CapitalcomAccountConverter cqrsiam.Initiator = "capitalcom-account-converter"

	// ForexfactoryDetailConverter converts forex factory details into news entries.
	ForexfactoryDetailConverter cqrsiam.Initiator = "forexfactory-detail-converter"
	// FtmoEconomicCalendarConverter converts FTMO economic calendar events into news.
	FtmoEconomicCalendarConverter cqrsiam.Initiator = "ftmo-economiccalendar-converter"
	// TagesschauConverter converts Tagesschau news articles into trading news.
	TagesschauConverter cqrsiam.Initiator = "tagesschau-converter"
	// FinancialjuiceEventConverter converts FinancialJuice events into trading news.
	FinancialjuiceEventConverter cqrsiam.Initiator = "financialjuice-event-converter"
)
View Source 
var (
	// Backtest cqrsiam.Permissions
	CoreBacktestActiveStrategiesPermission cqrsiam.Permission = "backtest.active-strategies"
	CoreBacktestAdminPermission            cqrsiam.Permission = "backtest.admin"
	CoreBacktestCreatePermission           cqrsiam.Permission = "backtest.create"
	CoreBacktestDeleteGroupPermission      cqrsiam.Permission = "backtest.delete-group"
	CoreBacktestDeletePermission           cqrsiam.Permission = "backtest.delete"
	CoreBacktestQueuePermission            cqrsiam.Permission = "backtest.queue"
	CoreBacktestRecreateJobPermission      cqrsiam.Permission = "backtest.recreate-job"
	CoreBacktestRerunFailedPermission      cqrsiam.Permission = "backtest.rerun-failed"
	CoreBacktestFailRunningPermission      cqrsiam.Permission = "backtest.fail-running"
	CoreBacktestUpdatePermission           cqrsiam.Permission = "backtest.update"

	// Review cqrsiam.Permissions
	CoreReviewAdminPermission  cqrsiam.Permission = "review.admin"
	CoreReviewCreatePermission cqrsiam.Permission = "review.create"
	CoreReviewDeletePermission cqrsiam.Permission = "review.delete"
	CoreReviewReviewPermission cqrsiam.Permission = "review.review"

	// Strategy cqrsiam.Permissions
	CoreStrategyCreatePermission  cqrsiam.Permission = "strategy.create"
	CoreStrategyUpdatePermission  cqrsiam.Permission = "strategy.update"
	CoreStrategyDeletePermission  cqrsiam.Permission = "strategy.delete"
	CoreStrategyDisablePermission cqrsiam.Permission = "strategy.disable"
	CoreStrategyAdminPermission   cqrsiam.Permission = "strategy.admin"

	// Report cqrsiam.Permissions
	CoreReportSendPermission  cqrsiam.Permission = "report.send"
	CoreReportAdminPermission cqrsiam.Permission = "report.admin"

	// Mail cqrsiam.Permissions
	CoreMailSendPermission         cqrsiam.Permission = "mail.send"
	CoreMailRefreshTokenPermission cqrsiam.Permission = "mail.refresh-token"
	CoreMailAdminPermission        cqrsiam.Permission = "mail.admin"

	// Symbol cqrsiam.Permissions
	CoreSymbolFetchPermission  cqrsiam.Permission = "symbol.fetch"
	CoreSymbolAdminPermission  cqrsiam.Permission = "symbol.admin"
	CoreSymbolCreatePermission cqrsiam.Permission = "symbol.create"
	CoreSymbolUpdatePermission cqrsiam.Permission = "symbol.update"
	CoreSymbolDeletePermission cqrsiam.Permission = "symbol.delete"

	// MT5Account cqrsiam.Permissions
	Mt5AccountCreatePermission       cqrsiam.Permission = "mt5account.create"
	Mt5AccountUpdatePermission       cqrsiam.Permission = "mt5account.update"
	Mt5AccountDeletePermission       cqrsiam.Permission = "mt5account.delete"
	Mt5AccountAdminPermission        cqrsiam.Permission = "mt5account.admin"
	Mt5AccountSyncAccountsPermission cqrsiam.Permission = "mt5account.sync-accounts"

	// MT5Tick cqrsiam.Permissions
	Mt5TickSelectSymbolsPermission cqrsiam.Permission = "mt5tick.select-symbols"

	// ExpectedTrade cqrsiam.Permissions
	CoreExpectedTradeApprovePermission cqrsiam.Permission = "expectedtrade.approve"
	CoreExpectedTradeRejectPermission  cqrsiam.Permission = "expectedtrade.reject"
	CoreExpectedTradeClosePermission   cqrsiam.Permission = "expectedtrade.close"
	CoreExpectedTradeHedgePermission   cqrsiam.Permission = "expectedtrade.hedge"
	CoreExpectedTradeAdminPermission   cqrsiam.Permission = "expectedtrade.admin"

	// Account cqrsiam.Permissions
	CoreAccountAdminPermission  cqrsiam.Permission = "account.admin"
	CoreAccountCreatePermission cqrsiam.Permission = "account.create"
	CoreAccountUpdatePermission cqrsiam.Permission = "account.update"
	CoreAccountDeletePermission cqrsiam.Permission = "account.delete"

	// Closing cqrsiam.Permissions
	CoreClosingAdminPermission  cqrsiam.Permission = "closing.admin"
	CoreClosingCreatePermission cqrsiam.Permission = "closing.create"
	CoreClosingUpdatePermission cqrsiam.Permission = "closing.update"
	CoreClosingDeletePermission cqrsiam.Permission = "closing.delete"

	// Discord cqrsiam.Permissions
	CoreDiscordSendPermission  cqrsiam.Permission = "discord.send"
	CoreDiscordAdminPermission cqrsiam.Permission = "discord.admin"

	// Telegram cqrsiam.Permissions
	CoreTelegramSendPermission  cqrsiam.Permission = "telegram.send"
	CoreTelegramAdminPermission cqrsiam.Permission = "telegram.admin"

	// News cqrsiam.Permissions
	CoreNewsUpdatePermission cqrsiam.Permission = "news.update"
	CoreNewsRatePermission   cqrsiam.Permission = "news.rate"
	CoreNewsAdminPermission  cqrsiam.Permission = "news.admin"

	// Signal cqrsiam.Permissions
	CoreSignalCreatePermission    cqrsiam.Permission = "signal.create"
	CoreSignalModifyPermission    cqrsiam.Permission = "signal.modify"
	CoreSignalClosePermission     cqrsiam.Permission = "signal.close"
	CoreSignalBreakEvenPermission cqrsiam.Permission = "signal.breakeven"
	CoreSignalAdminPermission     cqrsiam.Permission = "signal.admin"

	// ActualTrade cqrsiam.Permissions
	CoreActualTradeRetryPermission          cqrsiam.Permission = "actualtrade.retry"
	CoreActualTradeBrokerCallbackPermission cqrsiam.Permission = "actualtrade.broker-callback"
	CoreActualTradeAdminPermission          cqrsiam.Permission = "actualtrade.admin"

	// Frontend cqrsiam.Permissions
	FrontendGatewayAdminPermission cqrsiam.Permission = "frontend.gateway.admin"
)
View Source 
var (
	// BacktestAdmin provides full administrative access to backtest operations.
	// Intended for: Core administrators and the backtest controller service.
	// cqrsiam.Permissions: All backtest operations including admin-level functions.
	BacktestAdmin = cqrsiam.NewRole("BacktestAdmin",
		CoreBacktestActiveStrategiesPermission,
		CoreBacktestAdminPermission,
		CoreBacktestCreatePermission,
		CoreBacktestDeletePermission,
		CoreBacktestDeleteGroupPermission,
		CoreBacktestQueuePermission,
		CoreBacktestRecreateJobPermission,
		CoreBacktestRerunFailedPermission,
		CoreBacktestFailRunningPermission,
		CoreBacktestUpdatePermission,
	)
	// BacktestCron provides minimal permissions for scheduled backtest operations.
	// Intended for: Cron jobs and automated strategy queuing services.
	// cqrsiam.Permissions: Only access to active strategies for automated queuing.
	BacktestCron = cqrsiam.NewRole("BacktestUser",
		CoreBacktestActiveStrategiesPermission,
	)
	// BacktestUser provides standard backtest operations for regular users and services.
	// Intended for: API users, business users, and backtest agent services.
	// cqrsiam.Permissions: Create, delete, update, and queue backtests (excludes admin functions).
	BacktestUser = cqrsiam.NewRole("BacktestUser",
		CoreBacktestCreatePermission,
		CoreBacktestDeletePermission,
		CoreBacktestDeleteGroupPermission,
		CoreBacktestQueuePermission,
		CoreBacktestUpdatePermission,
	)
	// BacktestViewer provides read-only access to backtest data.
	// Intended for: Users who need to view but not modify backtest results.
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	BacktestViewer = cqrsiam.NewRole("BacktestViewer")
	// BacktestCreator provides minimal permissions for services that only create backtests.
	// Intended for: Automated services like core-backtest-agent-queue that trigger backtests.
	// cqrsiam.Permissions: Only backtest creation (follows principle of least privilege).
	BacktestCreator = cqrsiam.NewRole("BacktestCreator",
		CoreBacktestCreatePermission,
	)
	// ReviewAdmin provides full administrative access to review operations.
	// Intended for: Core administrators and the review service.
	// cqrsiam.Permissions: All review operations including admin functions.
	ReviewAdmin = cqrsiam.NewRole("ReviewAdmin",
		CoreReviewAdminPermission,
		CoreReviewCreatePermission,
		CoreReviewDeletePermission,
		CoreReviewReviewPermission,
	)
	// ReviewUser provides standard review operations for regular users.
	// Intended for: Business users who can participate in review processes.
	// cqrsiam.Permissions: Review and comment on items (excludes admin functions).
	ReviewUser = cqrsiam.NewRole("ReviewUser",
		CoreReviewReviewPermission,
	)
	// ReviewViewer provides read-only access to review data.
	// Intended for: Users who need to view but not participate in reviews.
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	ReviewViewer = cqrsiam.NewRole("ReviewViewer")

	// StrategyAdmin provides full administrative access to strategy operations.
	// Intended for: Core administrators and the strategy service.
	// cqrsiam.Permissions: All strategy operations including admin-level functions.
	StrategyAdmin = cqrsiam.NewRole("StrategyAdmin",
		CoreStrategyCreatePermission,
		CoreStrategyUpdatePermission,
		CoreStrategyDeletePermission,
		CoreStrategyDisablePermission,
		CoreStrategyAdminPermission,
	)
	// StrategyUser provides standard strategy operations for regular users and services.
	// Intended for: API users and business users managing strategies.
	// cqrsiam.Permissions: Create, update, and disable strategies (excludes delete and admin functions).
	StrategyUser = cqrsiam.NewRole("StrategyUser",
		CoreStrategyCreatePermission,
		CoreStrategyUpdatePermission,
		CoreStrategyDisablePermission,
	)
	// StrategyViewer provides read-only access to strategy data.
	// Intended for: Users who need to view but not modify strategies.
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	StrategyViewer = cqrsiam.NewRole("StrategyViewer")

	// SymbolAdmin provides full administrative access to symbol operations.
	// Intended for: Core administrators and symbol services.
	// cqrsiam.Permissions: All symbol operations including admin-level functions.
	SymbolAdmin = cqrsiam.NewRole("SymbolAdmin",
		CoreSymbolFetchPermission,
		CoreSymbolAdminPermission,
		CoreSymbolCreatePermission,
		CoreSymbolUpdatePermission,
		CoreSymbolDeletePermission,
	)
	// SymbolUser provides standard symbol operations for regular users and services.
	// Intended for: API users and business users fetching market information.
	// cqrsiam.Permissions: Fetch market details (excludes admin functions).
	SymbolUser = cqrsiam.NewRole("SymbolUser",
		CoreSymbolFetchPermission,
		CoreSymbolCreatePermission,
		CoreSymbolUpdatePermission,
	)

	// ReportAdmin provides full administrative access to report operations.
	// Intended for: Core administrators who can trigger and manage reports.
	// cqrsiam.Permissions: All report operations including sending reports.
	ReportAdmin = cqrsiam.NewRole("ReportAdmin",
		CoreReportSendPermission,
		CoreReportAdminPermission,
		CoreMailSendPermission,
	)
	// ReportCron provides minimal permissions for scheduled report operations.
	// Intended for: Cron jobs that send automated trading reports.
	// cqrsiam.Permissions: Report sending and mail sending capabilities.
	ReportCron = cqrsiam.NewRole("ReportCron",
		CoreReportSendPermission,
		CoreMailSendPermission,
	)

	// MailRefresh provides permissions for OAuth2 token refresh and mail sending operations.
	// Intended for: CronJob that refreshes OAuth2 tokens and API users who can send mails.
	// cqrsiam.Permissions: OAuth2 token refresh and mail sending capabilities.
	MailRefresh = cqrsiam.NewRole("MailRefresh",
		CoreMailRefreshTokenPermission,
		CoreMailSendPermission,
	)

	// Mt5AccountAdmin provides full administrative access to MT5 account operations.
	// Intended for: Core administrators and MT5 account controller service.
	// cqrsiam.Permissions: All MT5 account operations including admin functions.
	Mt5AccountAdmin = cqrsiam.NewRole("Mt5AccountAdmin",
		Mt5AccountAdminPermission,
		Mt5AccountCreatePermission,
		Mt5AccountUpdatePermission,
		Mt5AccountDeletePermission,
	)
	// Mt5AccountUser provides standard MT5 account operations for converters and services.
	// Intended for: MT5 converters and automated services that process account data.
	// cqrsiam.Permissions: Create and update MT5 accounts (not delete - admin only).
	Mt5AccountUser = cqrsiam.NewRole("Mt5AccountUser",
		Mt5AccountCreatePermission,
		Mt5AccountUpdatePermission,
	)
	// Mt5AccountViewer provides read-only access to MT5 account data.
	// Intended for: Users who need to view but not modify MT5 accounts (e.g., monitoring services).
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	Mt5AccountViewer = cqrsiam.NewRole("Mt5AccountViewer")

	// ExpectedTradeAdmin provides full administrative access to expected trade operations.
	// Intended for: Core administrators and the expected trade controller service.
	// cqrsiam.Permissions: All expected trade operations including admin functions.
	ExpectedTradeAdmin = cqrsiam.NewRole("ExpectedTradeAdmin",
		CoreExpectedTradeAdminPermission,
		CoreExpectedTradeApprovePermission,
		CoreExpectedTradeRejectPermission,
		CoreExpectedTradeClosePermission,
		CoreExpectedTradeHedgePermission,
	)
	// ExpectedTradeUser provides standard expected trade operations for traders.
	// Intended for: Traders who can approve and reject expected trades.
	// cqrsiam.Permissions: Approve and reject expected trades.
	ExpectedTradeUser = cqrsiam.NewRole("ExpectedTradeUser",
		CoreExpectedTradeApprovePermission,
		CoreExpectedTradeRejectPermission,
		CoreExpectedTradeClosePermission,
		CoreExpectedTradeHedgePermission,
	)
	// ExpectedTradeViewer provides read-only access to expected trade data.
	// Intended for: Users who need to view but not modify expected trades (e.g., monitoring services).
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	ExpectedTradeViewer = cqrsiam.NewRole("ExpectedTradeViewer")

	// AccountAdmin provides full administrative access to account operations.
	// Intended for: Core administrators and the account controller service.
	// cqrsiam.Permissions: All account operations including admin-level functions.
	AccountAdmin = cqrsiam.NewRole("AccountAdmin",
		CoreAccountAdminPermission,
		CoreAccountCreatePermission,
		CoreAccountUpdatePermission,
		CoreAccountDeletePermission,
	)
	// AccountUser provides standard account operations for regular users and services.
	// Intended for: API users and business users managing accounts.
	// cqrsiam.Permissions: Create and update accounts (excludes delete and admin functions).
	AccountUser = cqrsiam.NewRole("AccountUser",
		CoreAccountCreatePermission,
		CoreAccountUpdatePermission,
	)

	// ClosingAdmin provides full administrative access to closing operations.
	// Intended for: Core administrators and the closing controller service.
	// cqrsiam.Permissions: All closing operations including admin-level functions.
	ClosingAdmin = cqrsiam.NewRole("ClosingAdmin",
		CoreClosingAdminPermission,
		CoreClosingCreatePermission,
		CoreClosingUpdatePermission,
		CoreClosingDeletePermission,
	)
	// ClosingUser provides standard closing operations for regular users and services.
	// Intended for: API users and business users managing closings.
	// cqrsiam.Permissions: Create and update closings (excludes delete and admin functions).
	ClosingUser = cqrsiam.NewRole("ClosingUser",
		CoreClosingCreatePermission,
		CoreClosingUpdatePermission,
	)

	// DiscordAdmin provides full administrative access to discord operations.
	// Intended for: Core administrators and the discord controller service.
	// cqrsiam.Permissions: All discord operations including admin-level functions.
	DiscordAdmin = cqrsiam.NewRole("DiscordAdmin",
		CoreDiscordAdminPermission,
		CoreDiscordSendPermission,
	)
	// DiscordUser provides standard discord operations for regular users and services.
	// Intended for: API users and services that send discord messages.
	// cqrsiam.Permissions: Send discord messages (excludes admin functions).
	DiscordUser = cqrsiam.NewRole("DiscordUser",
		CoreDiscordSendPermission,
	)

	// TelegramAdmin provides full administrative access to telegram operations.
	// Intended for: Core administrators and the telegram controller service.
	// cqrsiam.Permissions: All telegram operations including admin-level functions.
	TelegramAdmin = cqrsiam.NewRole("TelegramAdmin",
		CoreTelegramAdminPermission,
		CoreTelegramSendPermission,
	)
	// TelegramUser provides standard telegram operations for regular users and services.
	// Intended for: API users and services that send telegram messages.
	// cqrsiam.Permissions: Send telegram messages (excludes admin functions).
	TelegramUser = cqrsiam.NewRole("TelegramUser",
		CoreTelegramSendPermission,
	)

	// NewsAdmin provides full administrative access to news operations.
	// Intended for: Core administrators and the news controller service.
	// cqrsiam.Permissions: All news operations including admin functions.
	NewsAdmin = cqrsiam.NewRole("NewsAdmin",
		CoreNewsAdminPermission,
		CoreNewsUpdatePermission,
		CoreNewsRatePermission,
	)
	// NewsUser provides standard news operations for regular users and services.
	// Intended for: Services and users that create and modify news entries.
	// cqrsiam.Permissions: Update and rate news entries.
	NewsUser = cqrsiam.NewRole("NewsUser",
		CoreNewsUpdatePermission,
		CoreNewsRatePermission,
	)
	// NewsViewer provides read-only access to news data.
	// Intended for: Users who need to view but not modify news (e.g., monitoring services).
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	NewsViewer = cqrsiam.NewRole("NewsViewer")

	// SignalAdmin provides full administrative access to signal operations.
	// Intended for: Core administrators and signal services.
	// cqrsiam.Permissions: All signal operations including break-even and admin functions.
	SignalAdmin = cqrsiam.NewRole("SignalAdmin",
		CoreSignalCreatePermission,
		CoreSignalModifyPermission,
		CoreSignalClosePermission,
		CoreSignalBreakEvenPermission,
		CoreSignalAdminPermission,
	)
	// SignalUser provides standard signal operations for traders.
	// Intended for: Traders who can create, modify, and close trading signals.
	// cqrsiam.Permissions: Create, modify, and close signals (excludes break-even and admin).
	SignalUser = cqrsiam.NewRole("SignalUser",
		CoreSignalCreatePermission,
		CoreSignalModifyPermission,
		CoreSignalClosePermission,
	)
	// SignalViewer provides read-only access to signal data.
	// Intended for: Users who need to view but not modify signals (e.g., monitoring services).
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	SignalViewer = cqrsiam.NewRole("SignalViewer")

	// ActualTradeAdmin provides full administrative access to actual trade operations.
	// Intended for: Core administrators and the actual trade controller service.
	// cqrsiam.Permissions: All actual trade operations including admin functions.
	ActualTradeAdmin = cqrsiam.NewRole("ActualTradeAdmin",
		CoreActualTradeRetryPermission,
		CoreActualTradeBrokerCallbackPermission,
		CoreActualTradeAdminPermission,
	)
	// ActualTradeUser provides standard actual trade operations for traders.
	// Intended for: Traders who can retry failed trades.
	// cqrsiam.Permissions: Retry failed trades.
	ActualTradeUser = cqrsiam.NewRole("ActualTradeUser",
		CoreActualTradeRetryPermission,
	)
	// ActualTradeBrokerCallback provides broker callback permissions.
	// Intended for: Broker converter services that send order/position updates.
	// cqrsiam.Permissions: All broker callback operations.
	ActualTradeBrokerCallback = cqrsiam.NewRole("ActualTradeBrokerCallback",
		CoreActualTradeBrokerCallbackPermission,
	)
	// ActualTradeViewer provides read-only access to actual trade data.
	// Intended for: Users who need to view but not modify actual trades (e.g., monitoring services).
	// cqrsiam.Permissions: None (read-only access through other mechanisms).
	ActualTradeViewer = cqrsiam.NewRole("ActualTradeViewer")

	// Mt5SyncTrigger provides permission to trigger the two MT5 sync operations.
	// Intended for: the API gateway identity (ApiInitiator, shared with every other
	// business-tier automation via FRONTEND_GATEWAY_API_KEY in every environment, not
	// dev-scoped) and the human administrator. This deviates from the Mt5AccountAdmin
	// precedent of keeping admin-tier permissions off ApiInitiator (iam_rolebinding.go);
	// it is accepted here because both operations are idempotent refreshes (re-select
	// symbols, re-read account state) — nothing is created, deleted, or traded, and no
	// money moves. That is a materially smaller blast radius than Mt5AccountAdmin
	// (create/update/delete accounts), which is why the deviation is acceptable rather
	// than merely convenient. scripts/api-call.sh, which authenticates as this identity,
	// must be able to trigger these without a human-authenticated session.
	// cqrsiam.Permissions: MT5 symbol re-selection and MT5 account re-read triggers.
	Mt5SyncTrigger = cqrsiam.NewRole("Mt5SyncTrigger",
		Mt5TickSelectSymbolsPermission,
		Mt5AccountSyncAccountsPermission,
	)

	// SuperAdmin provides full system administrative access including gateway admin routes.
	// Intended for: System administrators who need access to all admin interfaces.
	// cqrsiam.Permissions: Gateway admin access for service management.
	SuperAdmin = cqrsiam.NewRole("SuperAdmin",
		FrontendGatewayAdminPermission,
	)
)
View Source 
var AvailableInitiators = cqrsiam.Initiators{
	AgentBacktest,
	ApiInitiator,
	UserBenSeibert,
	CoreBacktestAgentJob,
	CoreBacktestAgentOptimize,
	CoreBacktestAgentQueue,
	CoreBacktestAgentRun,
	CoreBacktestController,
	CoreBacktestDummyUser,
	CoreBacktestCron,
	CoreReview,
	CoreStrategy,
	CoreStrategyPublishStrategies,
	CoreStrategyWatchStrategies,
	CoreReportCronjob,
	CoreMailControllerRefreshTokenCronjob,
	Mt5TradeExecutor,
	CapitalcomTradeExecutor,
	CoreNotificationController,
	CoreActualTradeController,
	Mt5AccountConverter,
	Mt5AccountController,
	UserStefan,
	UserBenBusiness,
	UserBenPrivate,
	BossOpenClaw,
	TradingOpenClaw,
	CapitalcomMarketDetailConverter,
	AcgSymbolConverter,
	DwxSymbolConverter,
	FtmoSymbolConverter,
	Mt5AccountConverter,
	CapitalcomAccountConverter,
	ForexfactoryDetailConverter,
	FtmoEconomicCalendarConverter,
	TagesschauConverter,
	FinancialjuiceEventConverter,
}

AvailableInitiators contains all registered initiators (services and users) in the system.

View Source 
var AvailablePermissions = cqrsiam.Permissions{
	CoreBacktestActiveStrategiesPermission,
	CoreBacktestAdminPermission,
	CoreBacktestCreatePermission,
	CoreBacktestDeleteGroupPermission,
	CoreBacktestDeletePermission,
	CoreBacktestQueuePermission,
	CoreBacktestRecreateJobPermission,
	CoreBacktestRerunFailedPermission,
	CoreBacktestFailRunningPermission,
	CoreBacktestUpdatePermission,
	CoreReviewAdminPermission,
	CoreReviewCreatePermission,
	CoreReviewDeletePermission,
	CoreReviewReviewPermission,
	CoreStrategyCreatePermission,
	CoreStrategyUpdatePermission,
	CoreStrategyDeletePermission,
	CoreStrategyDisablePermission,
	CoreStrategyAdminPermission,
	CoreReportSendPermission,
	CoreReportAdminPermission,
	CoreMailSendPermission,
	CoreMailRefreshTokenPermission,
	CoreMailAdminPermission,
	CoreSymbolFetchPermission,
	CoreSymbolAdminPermission,
	CoreSymbolCreatePermission,
	CoreSymbolUpdatePermission,
	CoreSymbolDeletePermission,
	Mt5AccountCreatePermission,
	Mt5AccountUpdatePermission,
	Mt5AccountDeletePermission,
	Mt5AccountAdminPermission,
	Mt5AccountSyncAccountsPermission,
	Mt5TickSelectSymbolsPermission,
	CoreExpectedTradeApprovePermission,
	CoreExpectedTradeRejectPermission,
	CoreExpectedTradeClosePermission,
	CoreExpectedTradeHedgePermission,
	CoreExpectedTradeAdminPermission,
	CoreAccountAdminPermission,
	CoreAccountCreatePermission,
	CoreAccountUpdatePermission,
	CoreAccountDeletePermission,
	CoreClosingAdminPermission,
	CoreClosingCreatePermission,
	CoreClosingUpdatePermission,
	CoreClosingDeletePermission,
	CoreDiscordSendPermission,
	CoreDiscordAdminPermission,
	CoreTelegramSendPermission,
	CoreTelegramAdminPermission,
	CoreNewsUpdatePermission,
	CoreNewsRatePermission,
	CoreNewsAdminPermission,
	CoreSignalCreatePermission,
	CoreSignalModifyPermission,
	CoreSignalClosePermission,
	CoreSignalBreakEvenPermission,
	CoreSignalAdminPermission,
	CoreActualTradeRetryPermission,
	CoreActualTradeBrokerCallbackPermission,
	CoreActualTradeAdminPermission,
	FrontendGatewayAdminPermission,
}

AvailablePermissions contains all registered permissions in the IAM system.

View Source 
var AvailableRoleBindings = cqrsiam.RoleBindings{
	cqrsiam.NewRoleBinding(BacktestAdmin, UserBenPrivate, CoreBacktestController),
	cqrsiam.NewRoleBinding(BacktestCron, CoreBacktestCron),
	cqrsiam.NewRoleBinding(
		BacktestUser,
		ApiInitiator,
		UserBenBusiness,
		CoreBacktestAgentJob,
		CoreBacktestAgentOptimize,
		CoreBacktestAgentRun,
		AgentBacktest,
	),
	cqrsiam.NewRoleBinding(BacktestCreator, CoreBacktestAgentQueue),
	cqrsiam.NewRoleBinding(BacktestViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(ActualTradeAdmin, UserBenPrivate, CoreActualTradeController),
	cqrsiam.NewRoleBinding(ActualTradeBrokerCallback, Mt5TradeExecutor, CapitalcomTradeExecutor),
	cqrsiam.NewRoleBinding(ReviewAdmin, UserBenPrivate, CoreReview),
	cqrsiam.NewRoleBinding(ReviewUser, UserBenBusiness),
	cqrsiam.NewRoleBinding(ReviewViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(
		StrategyAdmin,
		UserBenPrivate,
		CoreStrategy,
		CoreStrategyPublishStrategies,
		CoreStrategyWatchStrategies,
	),
	cqrsiam.NewRoleBinding(StrategyUser, ApiInitiator, UserBenBusiness),
	cqrsiam.NewRoleBinding(StrategyViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(SymbolAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(
		SymbolUser,
		ApiInitiator,
		CapitalcomMarketDetailConverter,
		AcgSymbolConverter,
		DwxSymbolConverter,
		FtmoSymbolConverter,
	),
	cqrsiam.NewRoleBinding(ClosingAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(ClosingUser, ApiInitiator),
	cqrsiam.NewRoleBinding(Mt5AccountAdmin, UserBenPrivate, Mt5AccountController),
	cqrsiam.NewRoleBinding(Mt5AccountUser, Mt5AccountConverter, ApiInitiator),
	cqrsiam.NewRoleBinding(Mt5AccountViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(ExpectedTradeAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(ExpectedTradeUser, UserBenBusiness, ApiInitiator),
	cqrsiam.NewRoleBinding(ExpectedTradeViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(SignalAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(SignalUser, UserBenBusiness, ApiInitiator),
	cqrsiam.NewRoleBinding(SignalViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(ActualTradeUser, UserBenBusiness, ApiInitiator),
	cqrsiam.NewRoleBinding(ActualTradeViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(ReportAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(ReportCron, CoreReportCronjob),
	cqrsiam.NewRoleBinding(MailRefresh, CoreMailControllerRefreshTokenCronjob, ApiInitiator),
	cqrsiam.NewRoleBinding(AccountAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(
		AccountUser,
		ApiInitiator,
		Mt5AccountConverter,
		CapitalcomAccountConverter,
	),
	cqrsiam.NewRoleBinding(DiscordAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(DiscordUser, ApiInitiator, CoreNotificationController),
	cqrsiam.NewRoleBinding(TelegramAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(TelegramUser, ApiInitiator, CoreNotificationController),
	cqrsiam.NewRoleBinding(NewsAdmin, UserBenPrivate),
	cqrsiam.NewRoleBinding(
		NewsUser,
		UserBenBusiness,
		ApiInitiator,
		FinancialjuiceEventConverter,
		ForexfactoryDetailConverter,
		FtmoEconomicCalendarConverter,
		TagesschauConverter,
	),
	cqrsiam.NewRoleBinding(NewsViewer, BossOpenClaw, TradingOpenClaw),
	cqrsiam.NewRoleBinding(Mt5SyncTrigger, ApiInitiator, UserBenPrivate),
	cqrsiam.NewRoleBinding(SuperAdmin, UserBenPrivate),
}

AvailableRoleBindings defines the complete access control matrix for the trading system. Each binding grants specific roles to users and services.

Current role assignments:

  • BacktestAdmin: Core administrators and controller service
  • BacktestCron: Automated strategy queuing services
  • BacktestUser: API users and standard backtest agent services
  • BacktestCreator: Services that only create backtests (principle of least privilege)
  • ReviewAdmin: Core administrators and review service
  • ReviewUser: Business users for review participation
  • StrategyAdmin: Core administrators and strategy service
  • StrategyUser: API users and business users managing strategies
View Source 
var AvailableRoles = cqrsiam.Roles{
	BacktestAdmin,
	BacktestUser,
	BacktestViewer,
	BacktestCreator,
	BacktestCron,
	ReviewAdmin,
	ReviewUser,
	ReviewViewer,
	StrategyAdmin,
	StrategyUser,
	StrategyViewer,
	SymbolAdmin,
	SymbolUser,
	ReportAdmin,
	ReportCron,
	MailRefresh,
	Mt5AccountAdmin,
	Mt5AccountUser,
	Mt5AccountViewer,
	ExpectedTradeAdmin,
	ExpectedTradeUser,
	ExpectedTradeViewer,
	AccountAdmin,
	AccountUser,
	ClosingAdmin,
	ClosingUser,
	DiscordAdmin,
	DiscordUser,
	TelegramAdmin,
	TelegramUser,
	NewsAdmin,
	NewsUser,
	NewsViewer,
	SignalAdmin,
	SignalUser,
	SignalViewer,
	ActualTradeAdmin,
	ActualTradeUser,
	ActualTradeBrokerCallback,
	ActualTradeViewer,
	Mt5SyncTrigger,
	SuperAdmin,
}

AvailableRoles contains all registered roles in the IAM system.

Functions

func InitiatorPermissions 

func InitiatorPermissions(i cqrsiam.Initiator) cqrsiam.Permissions

InitiatorPermissions returns all permissions granted to this initiator through role bindings.

func NewAllPermissionCheck 

func NewAllPermissionCheck(permissions ...cqrsiam.Permission) cqrsiam.PermissionCheck

NewAllPermissionCheck creates a permission check that requires all of the provided permissions.

func NewAnyPermissionCheck 

func NewAnyPermissionCheck(permissions ...cqrsiam.Permission) cqrsiam.PermissionCheck

NewAnyPermissionCheck creates a permission check that requires at least one of the provided permissions.

func NewOnePermissionCheck 

func NewOnePermissionCheck(permission cqrsiam.Permission) cqrsiam.PermissionCheck

NewOnePermissionCheck creates a permission check that requires a single specific permission.

func ValidatePermission 

func ValidatePermission(ctx context.Context, p cqrsiam.Permission) error

ValidatePermission checks if the permission is non-empty and exists in the available permissions.

Types

This section is empty.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.