access

Documentation

Overview

package: access / policy type: checker job: decide whether a system account may exercise a CRUD right on a branch limits: pure policy from config; no ports, no ctx; core loops it for delete (-> config, core)

Access is this deployment's policy: accounts holding CRUD grants over branch globs, declared in config, never in the graph. The checker answers one (principal, right, branch) question, and verifiability never consults it at all.

The rights are CRUD. What was once a fifth, A for admin, is C on $branches: the branch table is itself a claim, so creating a branch contributes to it. $branches carries no glob, being one server-wide surface, and writing claims into a branch is the separate C on that branch. A caveat is a grant of opposite polarity, and the effective permission is their intersection.

Index

• Constants
• type Checker
  • func New(accounts map[string][]string) (*Checker, error)
  • func (c *Checker) Allow(p Principal, right Right, branch string) bool
• type Grant
  • func ParseGrant(spec string) (Grant, error)
  • func (g Grant) Allows(right Right, branch string) bool
• type Principal
• type Right

Constants

const (
	Universe  = "$universe"
	Archive   = "$archive"
	Sequencer = "$sequencer"
	Branches  = "$branches"
)

The reserved branches a grant may target. '$' is illegal in an ordinary name, so no glob confers one by accident.

Types

type Checker

type Checker struct {
	// contains filtered or unexported fields
}

Checker answers access requests against a fixed set of accounts and grants.

func New

func New(accounts map[string][]string) (*Checker, error)

New builds a checker from the configured accounts, each mapping to compact grant specs. It validates every grant offline and fails on the first malformed one.

func (*Checker) Allow

func (c *Checker) Allow(p Principal, right Right, branch string) bool

Allow reports whether the principal may exercise right on branch: the account's grants and any caveats must both allow it. Unknown or ungranted is denied.

Caveats are successive attenuation steps, each a predicate the request must still satisfy — not alternatives, or a second narrowing would fail to narrow. A bearer can always attenuate further before passing a token on, so a flat []Grant can only represent one grant per step: to carry more than one right in a single step, list them on one Grant ("RIGHTS glob"), never as siblings.

type Grant

type Grant struct {
	// contains filtered or unexported fields
}

Grant confers rights over the branches matching a glob — the unit of both an account grant and a token caveat, the Checker applying the polarity.

func ParseGrant

func ParseGrant(spec string) (Grant, error)

ParseGrant parses one "RIGHTS glob" spec ("CR foo-*", "R $universe"), rejecting unknown letters, malformed globs, and non-R rights on $universe. Caveats reuse it.

func (Grant) Allows

func (g Grant) Allows(right Right, branch string) bool

Allows reports whether this grant carries right and its glob matches branch.

type Principal

type Principal struct {
	Account string
	Caveats []Grant
}

Principal is the identity a request acts as: the account the credential resolved to, plus any caveats attenuating its grants (empty = none).

type Right

type Right byte

Right is one CRUD access right.

const (
	Contribute Right = 'C' // contribute claims to the branch (creating it if new)
	Read       Right = 'R' // read the branch
	Update     Right = 'U' // overlay an existing claim with a newer version
	Delete     Right = 'D' // delete claims (needs D on every branch that holds the claim)
)