authorize

Documentation

Index

• func EmailDomain(email string) string
• func ValidateOptions(o config.Options) error
• type Authorize
  • func New(opts config.Options) (*Authorize, error)
  • func (a *Authorize) Authorize(ctx context.Context, in *pb.Identity) (*pb.AuthorizeReply, error)
  • func (a *Authorize) IsAdmin(ctx context.Context, in *pb.Identity) (*pb.IsAdminReply, error)
  • func (a *Authorize) UpdateOptions(o config.Options) error
  • func (a *Authorize) ValidIdentity(route string, identity *Identity) bool
• type Identity
  • func (i *Identity) IsImpersonating() bool
• type IdentityValidator
  • func NewIdentityWhitelist(policies []config.Policy, admins []string) IdentityValidator
• type MockIdentityValidator
  • func (mv *MockIdentityValidator) IsAdmin(i *Identity) bool
  • func (mv *MockIdentityValidator) Valid(u string, i *Identity) bool

Functions

func EmailDomain

func EmailDomain(email string) string

EmailDomain returns the domain portion of an email.

func ValidateOptions

func ValidateOptions(o config.Options) error

ValidateOptions checks to see if configuration values are valid for the authorize service. Returns first error, if found.

Types

type Authorize

type Authorize struct {
	SharedKey string
	// contains filtered or unexported fields
}

Authorize struct holds

func New

func New(opts config.Options) (*Authorize, error)

New validates and creates a new Authorize service from a set of Options

func (*Authorize) Authorize

func (a *Authorize) Authorize(ctx context.Context, in *pb.Identity) (*pb.AuthorizeReply, error)

Authorize validates the user identity, device, and context of a request for a given route. Currently only checks identity.

func (*Authorize) IsAdmin

func (a *Authorize) IsAdmin(ctx context.Context, in *pb.Identity) (*pb.IsAdminReply, error)

IsAdmin validates the user is an administrative user.

func (*Authorize) UpdateOptions

func (a *Authorize) UpdateOptions(o config.Options) error

UpdateOptions updates internal structures based on config.Options

func (*Authorize) ValidIdentity

func (a *Authorize) ValidIdentity(route string, identity *Identity) bool

ValidIdentity returns if an identity is authorized to access a route resource.

type Identity

type Identity struct {
	User   string
	Email  string
	Groups []string
	// Impersonation
	ImpersonateEmail  string
	ImpersonateGroups []string
}

Identity contains a user's identity information.

func (*Identity) IsImpersonating

func (i *Identity) IsImpersonating() bool

IsImpersonating returns whether the user is trying to impersonate another user email or group.

type IdentityValidator

type IdentityValidator interface {
	Valid(string, *Identity) bool
	IsAdmin(*Identity) bool
}

IdentityValidator provides an interface to check whether a user has access to a given route.

func NewIdentityWhitelist

func NewIdentityWhitelist(policies []config.Policy, admins []string) IdentityValidator

NewIdentityWhitelist returns an indentity validator. todo(bdd) : a radix-tree implementation is probably more efficient

type MockIdentityValidator

type MockIdentityValidator struct {
	ValidResponse   bool
	IsAdminResponse bool
}

MockIdentityValidator is a mock implementation of IdentityValidator

func (*MockIdentityValidator) IsAdmin

func (mv *MockIdentityValidator) IsAdmin(i *Identity) bool

IsAdmin is a mock implementation IdentityValidator's IsAdmin method

func (*MockIdentityValidator) Valid

func (mv *MockIdentityValidator) Valid(u string, i *Identity) bool

Valid is a mock implementation IdentityValidator's Valid method