authz

Documentation

Overview

Package authz supplies the permission check that togo's auth plugin does not.

Verified against togo-framework/auth at auth.go:89:

func (i Identity) Can(perm string) bool { return contains(i.Permissions, perm) }

That is an exact string match. Consequently a user holding permissions=["*"] is denied every check — the wildcard everyone reaches for silently means "may do exactly the thing literally named *". Any admin seeded with "*" would appear correct in the database and be powerless in the app.

Rather than block on an upstream fix, builder does its own checking and treats auth.Identity purely as a claims carrier. Upstreaming a HasWildcard is worth doing; depending on it is not.

Index

• Constants
• func AllPermissions() []string
• func Can(granted []string, want string) bool
• func CanAll(granted []string, want ...string) bool
• func CanAny(granted []string, want ...string) bool
• func Expand(role string) []string

Constants

const (
	RoleAdmin      = "admin"
	RoleMaintainer = "maintainer"
	RoleReporter   = "reporter"
)

Roles recognised by the blueprint.

const Separator = "."

Separator between a permission's namespace and its verb: "issues.write".

const Wildcard = "*"

Wildcard grants every permission.

Functions

func AllPermissions

func AllPermissions() []string

AllPermissions returns every known permission key, for the admin UI and for tests that assert the vocabulary has not drifted from the routes.

func Can

func Can(granted []string, want string) bool

Can reports whether the granted set satisfies want.

Three forms are honoured, most specific first:

"issues.write"  exact grant
"issues.*"      namespace grant — covers issues.write, issues.read.deep, …
"*"             root grant

A namespace wildcard covers arbitrary depth: "a.*" satisfies "a.b.c". An empty want is never satisfied, so a caller that forgets to name a permission fails closed rather than passing.

func CanAll

func CanAll(granted []string, want ...string) bool

CanAll reports whether every wanted permission is satisfied. An empty want list is vacuously true — the caller asked for nothing.

func CanAny

func CanAny(granted []string, want ...string) bool

CanAny reports whether at least one wanted permission is satisfied. An empty want list is false: "any of nothing" is not a grant.

func Expand

func Expand(role string) []string

Expand returns the concrete permission set implied by a role.

Seeding writes these enumerated strings into the users.permissions CSV rather than a bare "*". Two reasons: the column stays readable by a human auditing who can do what, and a row remains correct even when read by code that has not adopted the wildcard-aware Can above.