authz

Documentation

Overview

Package authz provides authorization primitives for generated applications. It defines the Policy interface, a DefaultPolicy with role-based and ownership-based access control, and a global policy registry.

Index

• Constants
• func Can(user User, action string, resourceType string, resource any) bool
• func IsAdmin(user User) bool
• func Register(resourceType string, p Policy)
• func RequireRole(getUserRole func(r *http.Request) string, roles ...string) func(http.Handler) http.Handler
• func ServeForbidden(w http.ResponseWriter, r *http.Request)
• type CookieAuthenticator
  • func NewCookieAuthenticator(cookieName string, ...) *CookieAuthenticator
  • func (a *CookieAuthenticator) GetSessionGroup(r *http.Request, userID string) (string, error)
  • func (a *CookieAuthenticator) Identify(r *http.Request) (string, error)
• type DefaultPolicy
  • func (p *DefaultPolicy) Can(user User, action string, resource any) bool
• type Ownable
  • func OwnedBy(createdBy string) Ownable
• type Policy
• type User
  • func UserFrom(id, role string) User

Constants

const (
	ActionCreate = "create"
	ActionRead   = "read"
	ActionUpdate = "update"
	ActionDelete = "delete"
	ActionList   = "list"
)

Standard actions for CRUD operations.

const (
	RoleAdmin = "admin"
	RoleUser  = "user"
)

Standard roles.

Functions

func Can

func Can(user User, action string, resourceType string, resource any) bool

Can checks if a user can perform an action on a resource. It looks up the policy by resourceType; falls back to DefaultPolicy.

func IsAdmin

func IsAdmin(user User) bool

IsAdmin returns true if the user has the admin role.

func Register

func Register(resourceType string, p Policy)

Register registers a policy for a resource type name. If no policy is registered for a type, DefaultPolicy is used.

func RequireRole

func RequireRole(getUserRole func(r *http.Request) string, roles ...string) func(http.Handler) http.Handler

RequireRole returns middleware that checks if the authenticated user has one of the allowed roles. The getUserRole function extracts the user's role from the request (typically reading from context set by auth.RequireAuth middleware).

Returns 403 Forbidden if the user's role is not in the allowed list. Must be used after authentication middleware (user must be identified).

func ServeForbidden

func ServeForbidden(w http.ResponseWriter, r *http.Request)

ServeForbidden writes a 403 Forbidden response. Returns JSON for API requests (Accept: application/json), HTML for browser requests.

Types

type CookieAuthenticator

type CookieAuthenticator struct {
	// contains filtered or unexported fields
}

CookieAuthenticator implements livetemplate.Authenticator by reading the auth session cookie to identify the user during WebSocket setup. This enables ctx.UserID() to return the real authenticated user ID in LiveTemplate controller actions.

func NewCookieAuthenticator

func NewCookieAuthenticator(cookieName string, lookupFn func(ctx context.Context, token string) (string, error)) *CookieAuthenticator

NewCookieAuthenticator creates an authenticator that reads the auth session cookie and looks up the user ID. The lookupFn should query the tokens table to resolve a session token to a user ID.

Example:

authz.NewCookieAuthenticator("users_token", func(ctx context.Context, token string) (string, error) {
    row, err := queries.GetUserToken(ctx, models.GetUserTokenParams{Token: token, Now: time.Now()})
    if err != nil { return "", err }
    return row.UserID, nil
})

func (*CookieAuthenticator) GetSessionGroup

func (a *CookieAuthenticator) GetSessionGroup(r *http.Request, userID string) (string, error)

GetSessionGroup returns the user ID as the session group so that all tabs for the same authenticated user share LiveTemplate state. Falls back to a browser-based cookie for unauthenticated users.

func (*CookieAuthenticator) Identify

func (a *CookieAuthenticator) Identify(r *http.Request) (string, error)

Identify returns the user ID from the auth session cookie. Returns "" for unauthenticated requests (no cookie or invalid token).

type DefaultPolicy

type DefaultPolicy struct{}

DefaultPolicy implements reasonable defaults:

• Admin can do everything
• Any authenticated user can create and list
• Owner can read, update, delete their own resources
• Non-owner can read but not update/delete

func (*DefaultPolicy) Can

func (p *DefaultPolicy) Can(user User, action string, resource any) bool

type Ownable

type Ownable interface {
	GetCreatedBy() string
}

Ownable is implemented by resources that track ownership via a created_by column.

func OwnedBy

func OwnedBy(createdBy string) Ownable

OwnedBy returns an Ownable resource for a given creator ID. Use when the sqlc model struct can't implement Ownable directly:

authz.Can(user, authz.ActionUpdate, "posts", authz.OwnedBy(post.CreatedBy))

type Policy

type Policy interface {
	Can(user User, action string, resource any) bool
}

Policy defines authorization rules for a resource type.

type User

type User interface {
	GetID() string
	GetRole() string
}

User is the minimal interface for authorization checks. The generated sqlc models.User struct can be adapted via UserFrom().

func UserFrom

func UserFrom(id, role string) User

UserFrom creates a User from an ID and role string. Useful for adapting sqlc-generated models: authz.UserFrom(user.ID, user.Role)