guard

Documentation

Index

• func Can(user Identity, resource any, action string) error
• type CompiledPolicy
  • func (p *CompiledPolicy) Evaluate(user Identity, resourceVal reflect.Value, action string) error
• type DynamicRule
• type Guard
  • func NewGuard() *Guard
  • func (g *Guard) Can(user Identity, resource any, action string) error
  • func (g *Guard) GetRoles(user Identity, resource any) ([]string, error)
• type Identity

Functions

func Can

func Can(user Identity, resource any, action string) error

Can checks if the identity is allowed to perform the action on the resource. Deprecated: use Guard.Can instead.

Types

type CompiledPolicy

type CompiledPolicy struct {
	StaticRules  map[string]map[string]bool
	DynamicRules []DynamicRule
	// contains filtered or unexported fields
}

CompiledPolicy holds pre-compiled authorization rules for a resource type.

func (*CompiledPolicy) Evaluate

func (p *CompiledPolicy) Evaluate(user Identity, resourceVal reflect.Value, action string) error

type DynamicRule

type DynamicRule struct {
	FieldIndex int
	Actions    []string
	FieldType  reflect.Type
	FieldKind  reflect.Kind
}

DynamicRule maps a dynamic role field to the actions it governs.

type Guard

type Guard struct{}

Guard provides the authorization engine.

func NewGuard

func NewGuard() *Guard

NewGuard creates a new guard engine.

func (*Guard) Can

func (g *Guard) Can(user Identity, resource any, action string) error

Can checks if the identity is allowed to perform the action on the resource.

func (*Guard) GetRoles

func (g *Guard) GetRoles(user Identity, resource any) ([]string, error)

GetRoles returns all roles resolved for the identity on the resource.

type Identity

type Identity interface {
	GetID() string
	GetRoles() []string
}

Identity represents the actor trying to access a resource.