authz

Documentation

Index

• Constants
• func RegisterScopeShape(shape string) error
• func Require(a *Authorizer, perm Permission) func(http.HandlerFunc) http.HandlerFunc
• func RequireOwn(a *Authorizer, base Permission, ...) func(http.HandlerFunc) http.HandlerFunc
• type Authorizer
  • func New(catalog *Catalog, builtin *RoleSet, opts ...Option) *Authorizer
  • func (a *Authorizer) BuiltinPerms(role string) []Permission
  • func (a *Authorizer) Can(p *webx.Principal, perm Permission) bool
  • func (a *Authorizer) CanIn(ctx context.Context, p *webx.Principal, perm Permission) bool
  • func (a *Authorizer) CanOwn(p *webx.Principal, base Permission, isOwn bool) bool
  • func (a *Authorizer) CanOwnIn(ctx context.Context, p *webx.Principal, base Permission, isOwn bool) bool
  • func (a *Authorizer) Catalog() *Catalog
  • func (a *Authorizer) InvalidateCache(workspaceID string)
• type Catalog
  • func DefaultCatalog() *Catalog
  • func NewCatalog(perms ...Permission) *Catalog
  • func (c *Catalog) Has(p Permission) bool
  • func (c *Catalog) List() []Permission
  • func (c *Catalog) Register(perms ...Permission)
  • func (c *Catalog) RegisterWithDesc(p Permission, desc string)
• type Option
  • func WithCacheTTL(d time.Duration) Option
  • func WithLogger(log *slog.Logger) Option
  • func WithProvider(p Provider) Option
• type Permission
  • func DefaultPerms() []Permission
• type Provider
• type RoleKey
• type RoleSet
  • func DefaultRoles() *RoleSet
  • func NewRoleSet() *RoleSet
  • func (r *RoleSet) Clone() *RoleSet
  • func (r *RoleSet) Grant(role string, perms ...Permission) *RoleSet
  • func (r *RoleSet) Perms(role string) []Permission
  • func (r *RoleSet) Revoke(role string, perms ...Permission) *RoleSet
  • func (r *RoleSet) Set(role string, perms ...Permission) *RoleSet
• type ScopePath
  • func ParseScopePath(path string) (ScopePath, bool)

Constants

const (
	RoleOwner  = "owner"
	RoleAdmin  = "admin"
	RoleMember = "member"
)

Functions

func RegisterScopeShape

func RegisterScopeShape(shape string) error

func Require

func Require(a *Authorizer, perm Permission) func(http.HandlerFunc) http.HandlerFunc

func RequireOwn

func RequireOwn(a *Authorizer, base Permission, isOwn func(r *http.Request, p *webx.Principal) bool) func(http.HandlerFunc) http.HandlerFunc

Types

type Authorizer

type Authorizer struct {
	// contains filtered or unexported fields
}

func New

func New(catalog *Catalog, builtin *RoleSet, opts ...Option) *Authorizer

func (*Authorizer) BuiltinPerms

func (a *Authorizer) BuiltinPerms(role string) []Permission

BuiltinPerms returns the built-in (non-overridden) permission set of a role, sorted — used by role-config management to show defaults.

func (*Authorizer) Can

func (a *Authorizer) Can(p *webx.Principal, perm Permission) bool

func (*Authorizer) CanIn

func (a *Authorizer) CanIn(ctx context.Context, p *webx.Principal, perm Permission) bool

func (*Authorizer) CanOwn

func (a *Authorizer) CanOwn(p *webx.Principal, base Permission, isOwn bool) bool

func (*Authorizer) CanOwnIn

func (a *Authorizer) CanOwnIn(ctx context.Context, p *webx.Principal, base Permission, isOwn bool) bool

func (*Authorizer) Catalog

func (a *Authorizer) Catalog() *Catalog

func (*Authorizer) InvalidateCache

func (a *Authorizer) InvalidateCache(workspaceID string)

type Catalog

type Catalog struct {
	// contains filtered or unexported fields
}

func DefaultCatalog

func DefaultCatalog() *Catalog

func NewCatalog

func NewCatalog(perms ...Permission) *Catalog

func (*Catalog) Has

func (c *Catalog) Has(p Permission) bool

func (*Catalog) List

func (c *Catalog) List() []Permission

List returns every registered permission, sorted lexically.

func (*Catalog) Register

func (c *Catalog) Register(perms ...Permission)

func (*Catalog) RegisterWithDesc

func (c *Catalog) RegisterWithDesc(p Permission, desc string)

type Option

type Option func(*Authorizer)

func WithCacheTTL

func WithCacheTTL(d time.Duration) Option

func WithLogger

func WithLogger(log *slog.Logger) Option

func WithProvider

func WithProvider(p Provider) Option

type Permission

type Permission string

func DefaultPerms

func DefaultPerms() []Permission

type Provider

type Provider interface {
	PermsFor(ctx context.Context, key RoleKey) ([]Permission, error)
}

type RoleKey

type RoleKey struct {
	WorkspaceID string
	ProjectID   string
	Role        string
}

type RoleSet

type RoleSet struct {
	// contains filtered or unexported fields
}

func DefaultRoles

func DefaultRoles() *RoleSet

func NewRoleSet

func NewRoleSet() *RoleSet

func (*RoleSet) Clone

func (r *RoleSet) Clone() *RoleSet

func (*RoleSet) Grant

func (r *RoleSet) Grant(role string, perms ...Permission) *RoleSet

func (*RoleSet) Perms

func (r *RoleSet) Perms(role string) []Permission

Perms returns the role's permission set sorted lexically (nil for an unknown role). The read side of role-config management UIs.

func (*RoleSet) Revoke

func (r *RoleSet) Revoke(role string, perms ...Permission) *RoleSet

func (*RoleSet) Set

func (r *RoleSet) Set(role string, perms ...Permission) *RoleSet

type ScopePath

type ScopePath struct {
	WorkspaceID string

	ProjectID string
}

func ParseScopePath

func ParseScopePath(path string) (ScopePath, bool)