acl

Documentation

Index

• Constants
• Variables
• func BasicAuthCredential(req *http.Request) (string, string, error)
• func BasicAuthCredentialFromAuthorization(auth string) (string, string, error)
• func BasicAuthCredentialFromAuthorizationData(auth string) (string, string, error)
• func MarshalPolicy(p Policy) (uuid.UUID, string, []byte, error)
• type Action
• type ActionSet
  • func (s ActionSet) Contains(a Action) bool
  • func (s ActionSet) String() string
• type Authorization
• type Effect
  • func ParseEffect(s string) (Effect, error)
  • func (e Effect) Inverse() Effect
  • func (e Effect) MarshalJSON() ([]byte, error)
  • func (e *Effect) Scan(src interface{}) error
  • func (e Effect) String() string
  • func (e *Effect) UnmarshalJSON(data []byte) error
  • func (e Effect) Value() (driver.Value, error)
• type Path
  • func Pathf(f string, a ...interface{}) Path
  • func (q Path) Matches(z Path) bool
  • func (q Path) MatchesString(a string) bool
  • func (q Path) MatchesStringWithOptions(a string, options int) bool
  • func (q Path) MatchesWithOptions(z Path, options int) bool
• type PathSet
  • func (s PathSet) Matches(z Path) bool
  • func (s PathSet) MatchesString(a string) bool
  • func (s PathSet) MatchesStringWithOptions(a string, options int) bool
  • func (s PathSet) MatchesWithOptions(z Path, options int) bool
  • func (s PathSet) String() string
• type PersistentPolicy
• type Policy
  • func UnmarshalPolicy(id uuid.UUID, t string, d json.RawMessage) (Policy, error)
• type ResourcePolicy
  • func AllowResource(a Action, p Path) ResourcePolicy
  • func DenyResource(a Action, p Path) ResourcePolicy
  • func (p ResourcePolicy) Eval(req *http.Request) (Effect, error)
  • func (p ResourcePolicy) Id() uuid.UUID
  • func (p ResourcePolicy) String() string
  • func (p ResourcePolicy) WithId(id uuid.UUID) Policy

Constants

const (
	Read   = Action("read")
	Write  = Action("write")
	Delete = Action("delete")
	Every  = Action("*")
)

const (
	MatchOptionNone      = 0
	MatchOptionEncompass = 1 << 0
)

Matching options

Variables

var (
	ErrNoAuthorization   = fmt.Errorf("No authorization")
	ErrMalformedRequest  = fmt.Errorf("Authorization is malformed")
	ErrUnsupportedMethod = fmt.Errorf("Authorization method is not supported")
)

var (
	ErrMethodNotSupported = fmt.Errorf("Method not supported")
)

var ErrUnsupportedPolicyType = fmt.Errorf("Unsupported policy type")

Functions

func BasicAuthCredential

func BasicAuthCredential(req *http.Request) (string, string, error)

Obtain the basic auth credential for the specified request

func BasicAuthCredentialFromAuthorization

func BasicAuthCredentialFromAuthorization(auth string) (string, string, error)

Obtain the basic auth credential for the specified authorization header

func BasicAuthCredentialFromAuthorizationData

func BasicAuthCredentialFromAuthorizationData(auth string) (string, string, error)

Obtain the basic auth credential for the specified authorization header data

func MarshalPolicy

func MarshalPolicy(p Policy) (uuid.UUID, string, []byte, error)

Types

type Action

type Action string

type ActionSet

type ActionSet []Action

func (ActionSet) Contains

func (s ActionSet) Contains(a Action) bool

func (ActionSet) String

func (s ActionSet) String() string

type Authorization

type Authorization struct {
	Id          uuid.UUID `json:"id" db:"id,pk"`
	Key         string    `json:"api_key" db:"key"`
	Secret      string    `json:"api_secret" db:"secret"`
	Description string    `json:"description,omitempty" db:"description"`
	Policies    []Policy  `json:"policies"`
	Active      bool      `json:"active" db:"active"`
	Created     time.Time `json:"created_at" db:"created_at"`
}

type Effect

type Effect int

const (
	InvalidEffect Effect = iota
	Allow
	Deny
	Pass
)

func ParseEffect

func ParseEffect(s string) (Effect, error)

func (Effect) Inverse

func (e Effect) Inverse() Effect

func (Effect) MarshalJSON

func (e Effect) MarshalJSON() ([]byte, error)

func (*Effect) Scan

func (e *Effect) Scan(src interface{}) error

func (Effect) String

func (e Effect) String() string

func (*Effect) UnmarshalJSON

func (e *Effect) UnmarshalJSON(data []byte) error

func (Effect) Value

func (e Effect) Value() (driver.Value, error)

type Path

type Path string

A resource path

func Pathf

func Pathf(f string, a ...interface{}) Path

Format a resource

func (Path) Matches

func (q Path) Matches(z Path) bool

This is the equivalent of MatchesWithOptions(z, MatchOptionNone)

func (Path) MatchesString

func (q Path) MatchesString(a string) bool

Determine if a string matches this Path

func (Path) MatchesStringWithOptions

func (q Path) MatchesStringWithOptions(a string, options int) bool

Determine if a string matches this Path

func (Path) MatchesWithOptions

func (q Path) MatchesWithOptions(z Path, options int) bool

Determine if this name matches the provided name. A name matches another if all the components of both names are identical (ignoring case), or if all the concrete names in the right (parameter) name match those in the left (this) name accounting for wildcards, or if the left name is the name "*", which matches any other name.

If encompassing is permitted, a left name which ends in a wildcard component will match any number of subsequent components in the right name (e.g., "a.*" matches "a.b", "a.b.c", "a.b.c.d", and so fourth).

For example, the concrete name "a.b" matches: "a.b"

The name "a.*.c" matches: "a.b.c", "a.z.c", "a.*.c" ("*" is interpreted literally in the right name). However, the name "a.*.c" does not match: "*.b.c" or "a.c"

When encompassing, the name "a.b.*" matches "a.b.c", "a.b.c.d", and so fourth However it does not match: "a" or "a.b"

The name "*" matches any name, including an emtpy name or the name "*". An empty name matches nothing.

type PathSet

type PathSet []Path

func (PathSet) Matches

func (s PathSet) Matches(z Path) bool

Return true if any Path in the set matches

func (PathSet) MatchesString

func (s PathSet) MatchesString(a string) bool

Return true if any Path in the set matches

func (PathSet) MatchesStringWithOptions

func (s PathSet) MatchesStringWithOptions(a string, options int) bool

Return true if any Path in the set matches

func (PathSet) MatchesWithOptions

func (s PathSet) MatchesWithOptions(z Path, options int) bool

Return true if any Path in the set matches

func (PathSet) String

func (s PathSet) String() string

type PersistentPolicy

type PersistentPolicy struct {
	Id      uuid.UUID       `json:"id" db:"id,pk"`
	Type    string          `json:"type" db:"type"`
	Data    json.RawMessage `json:"data" db:"data"`
	Created time.Time       `json:"created_at" db:"created_at"`
}

An ACL policy persistent representation

type Policy

type Policy interface {
	Id() uuid.UUID
	WithId(uuid.UUID) Policy
	Eval(*http.Request) (Effect, error)
}

Implemented by ACL policies

func UnmarshalPolicy

func UnmarshalPolicy(id uuid.UUID, t string, d json.RawMessage) (Policy, error)

type ResourcePolicy

type ResourcePolicy struct {
	Actions ActionSet `json:"actions"`
	Paths   PathSet   `json:"paths"`
	Effect  Effect    `json:"effect"`
	// contains filtered or unexported fields
}

func AllowResource

func AllowResource(a Action, p Path) ResourcePolicy

func DenyResource

func DenyResource(a Action, p Path) ResourcePolicy

func (ResourcePolicy) Eval

func (p ResourcePolicy) Eval(req *http.Request) (Effect, error)

func (ResourcePolicy) Id

func (p ResourcePolicy) Id() uuid.UUID

func (ResourcePolicy) String

func (p ResourcePolicy) String() string

func (ResourcePolicy) WithId

func (p ResourcePolicy) WithId(id uuid.UUID) Policy