pol

Documentation

Overview

Package pol offers a role based permission system with a rules based implementation.

Index

• type Action
• type Op
  • func (o Op) String() string
• type Perm
  • func (p Perm) MarshalText() ([]byte, error)
  • func (p Perm) Op() Op
  • func (p Perm) String() string
  • func (p *Perm) UnmarshalText(b []byte) error
• type Policy
• type Rule
  • func ReadRules(r io.Reader) (res []Rule, err error)
  • func (r Rule) MarshalText() ([]byte, error)
  • func (r Rule) String() string
  • func (r *Rule) UnmarshalText(b []byte) error
• type RulePolicy
  • func ReadRulePolicy(r io.Reader) (*RulePolicy, error)
  • func (p *RulePolicy) Add(rs ...Rule) error
  • func (p *RulePolicy) Police(role string, acts ...Action) error

Types

type Action

type Action struct {
	Op
	// Top is the topic and most commonly a model name. Special events should use custom topics.
	// Topic names must not contain white space or '*' characters.
	Top string
}

Action is described by an operation and a topic.

type Op

type Op uint

Op describes an operation as a bitset with bits for read, write, execute and delete. These operations map to qry reads and event commands new, mod, del for dom model topics. Custom topics are free to have another interpretation but usually only use the X op.

const (
	// X op is used for creating new model objects or executing custom actions.
	X Op = 1 << iota
	// W op is for writing/modifying model objects.
	W
	// R op is for reading/querying model objects.
	R
	// D op is for deleting model objects.
	D
	All = D | R | W | X
)

func (Op) String

func (o Op) String() string

type Perm

type Perm int

Perm represents either a role association or a permitted or denied operation. Role associations have the value 0, denied op is -op and permitted op is itself.

func (Perm) MarshalText

func (p Perm) MarshalText() ([]byte, error)

func (Perm) Op

func (p Perm) Op() Op

func (Perm) String

func (p Perm) String() string

func (*Perm) UnmarshalText

func (p *Perm) UnmarshalText(b []byte) error

type Policy

type Policy interface {
	// Police permits role to execute the given actions or returns an error.
	// Role names must not contain white space or '*' characters.
	Police(role string, acts ...Action) error
}

Policy is an interface for a simple permissions checker.

type Rule

type Rule struct {
	Perm
	Top  string
	Role string
}

Rule is a simple source structure to build up a policy.

func ReadRules

func ReadRules(r io.Reader) (res []Rule, err error)

ReadRules returns a list of rules read from r or an error.

func (Rule) MarshalText

func (r Rule) MarshalText() ([]byte, error)

func (Rule) String

func (r Rule) String() string

func (*Rule) UnmarshalText

func (r *Rule) UnmarshalText(b []byte) error

type RulePolicy

type RulePolicy struct {
	// contains filtered or unexported fields
}

RulePolicy is a Policy based on a set of rules and supports group roles and wildcards. The implementation is not thread safe for writes. Either lock access or build anew and swap out.

func ReadRulePolicy

func ReadRulePolicy(r io.Reader) (*RulePolicy, error)

ReadRulePolicy reads rules from r and creates and returns a new policy or an error.

func (*RulePolicy) Add

func (p *RulePolicy) Add(rs ...Rule) error

Add adds rules to the policy or returns an error.

func (*RulePolicy) Police

func (p *RulePolicy) Police(role string, acts ...Action) error

Police permits role to execute the given actions or returns an error.