security

Documentation

Index

• type MatrixBasedOperationControl
  • func CreateMatrixBasedOperationControl(dataProvider *managers.DataContext, logger *logging.AppLogger) *MatrixBasedOperationControl
  • func (m *MatrixBasedOperationControl) IsOperationAllowed(realmId string, objectId string, objectType data.ObjectType, ...) (bool, error)
• type OperationControl
  • func CreateOperationControlService(dataProvider *managers.DataContext, logger *logging.AppLogger) OperationControl
• type OperationType

Types

type MatrixBasedOperationControl

type MatrixBasedOperationControl struct {
	DataProvider *managers.DataContext
	// contains filtered or unexported fields
}

func CreateMatrixBasedOperationControl

func CreateMatrixBasedOperationControl(dataProvider *managers.DataContext,
	logger *logging.AppLogger) *MatrixBasedOperationControl

CreateMatrixBasedOperationControl a function that creates MatrixBasedOperationControl for check allowed operations

This function creates Operation checker based on matrix rules, in current version
* are using only default rules that could be overwritten in future even for separate realms
* Parameters:
*   - dataProvider - struct implementing access to persistent objects via managers.DataContext interface
*   - logger - logger
* Returns: a pointer to struct MatrixBasedOperationControl

todo(UMV): allow to override matrix types, now we are using default

func (*MatrixBasedOperationControl) IsOperationAllowed

func (m *MatrixBasedOperationControl) IsOperationAllowed(realmId string, objectId string,
	objectType data.ObjectType, operation OperationType, userId uuid.UUID) (bool, error)

IsOperationAllowed checks whether operation could be performed by user or not

This function uses matrix based rules to control what operation could be performed by user
* System Admin (settings.Admin) user that does not belong to realm could perform any operation
* because this is a whole system admin

type OperationControl

type OperationControl interface {
	// IsOperationAllowed function that checks whether userId could be used for performing operation
	// on specified objectType identifying by objectId
	IsOperationAllowed(realmId string, objectId string, objectType data.ObjectType,
		operation OperationType, userId uuid.UUID) (bool, error)
}

func CreateOperationControlService

func CreateOperationControlService(dataProvider *managers.DataContext,
	logger *logging.AppLogger) OperationControl

type OperationType

type OperationType string

const (
	READ   OperationType = "read"
	DELETE OperationType = "delete"
	CREATE OperationType = "create"
	UPDATE OperationType = "update"
	// BLOCK - operation for the blocking access
	BLOCK OperationType = "block"
	// UNBLOCK - operation for the unblocking access
	UNBLOCK OperationType = "unblock"
	// ACTIVATE - operation for the making some object working, i.e. recently created user
	ACTIVATE OperationType = "activate"
	// DEACTIVATE - operation for the making some object non-working, i.e. whole realm, client without delete
	DEACTIVATE OperationType = "deactivate"
)