Documentation
¶
Index ¶
- Variables
- type HTTPHandler
- type Observer
- type Repository
- func (r *Repository) DeleteUserData(ctx context.Context, userID ids.UserID) error
- func (r *Repository) EnsureUserSettings(ctx context.Context, userID ids.UserID) error
- func (r *Repository) GetAllUserHostGrants(ctx context.Context) ([]UserHostGrant, error)
- func (r *Repository) GetAllUserHostSettings(ctx context.Context) ([]UserHostSetting, error)
- func (r *Repository) GetOwnerRefs(ctx context.Context) ([]httpapi.OwnerRef, error)
- func (r *Repository) SetUserAccess(ctx context.Context, userID ids.UserID, bypassHostCheck bool, ...) error
- func (r *Repository) SubjectRows(ctx context.Context, userID *ids.UserID) ([]SubjectRow, error)
- type Service
- func (s *Service) AddObserver(o Observer)
- func (s *Service) GetAllUserHostAccess(ctx context.Context) ([]policy.UserHostAccess, error)
- func (s *Service) OnUserEvent(ctx context.Context, event auth.UserEvent)
- func (s *Service) SetUserAccess(ctx context.Context, userID ids.UserID, bypassHostCheck bool, ...) error
- type SubjectRow
- type UserHostGrant
- type UserHostSetting
Constants ¶
This section is empty.
Variables ¶
var (
ErrReferenceNotFound = errors.New("referenced entity not found")
)
Functions ¶
This section is empty.
Types ¶
type HTTPHandler ¶
type HTTPHandler struct {
// contains filtered or unexported fields
}
func NewHTTPHandler ¶
func NewHTTPHandler(service *Service, repo *Repository, logger *slog.Logger) *HTTPHandler
func (*HTTPHandler) ListOwnerRefs ¶ added in v0.6.0
func (h *HTTPHandler) ListOwnerRefs( ctx context.Context, _ httpapi.ListOwnerRefsRequestObject, ) (httpapi.ListOwnerRefsResponseObject, error)
func (*HTTPHandler) SetUserAccess ¶
func (h *HTTPHandler) SetUserAccess( ctx context.Context, req httpapi.SetUserAccessRequestObject, ) (httpapi.SetUserAccessResponseObject, error)
type Observer ¶
Observer is implemented by any component that must react when user host-access grants change (e.g. policy.Service refreshing its cache).
type Repository ¶
type Repository struct {
// contains filtered or unexported fields
}
func NewRepository ¶
func NewRepository(db *database.DB) *Repository
func (*Repository) DeleteUserData ¶
func (*Repository) EnsureUserSettings ¶
func (*Repository) GetAllUserHostGrants ¶
func (r *Repository) GetAllUserHostGrants(ctx context.Context) ([]UserHostGrant, error)
GetAllUserHostGrants resolves every (user, fqdn) pair reachable through user_allowed_host_groups → host_group_members → hosts.
NOTE: this query intentionally crosses into the hosts domain tables (hosts, host_group_members), which violates the cross-domain-queries pattern (docs/patterns/backend/cross-domain-queries.md). It is kept here because this data is tightly coupled to the policy cache lifecycle. If this query grows or is reused outside of cache population, move it to internal/queries/.
func (*Repository) GetAllUserHostSettings ¶
func (r *Repository) GetAllUserHostSettings(ctx context.Context) ([]UserHostSetting, error)
func (*Repository) GetOwnerRefs ¶ added in v0.6.0
GetOwnerRefs returns every non-deleted user as a minimal {id, display_name} reference for owner pickers, sorted the way they render.
func (*Repository) SetUserAccess ¶
func (r *Repository) SetUserAccess(ctx context.Context, userID ids.UserID, bypassHostCheck bool, groupIDs []ids.HostGroupID) error
func (*Repository) SubjectRows ¶ added in v0.6.0
func (r *Repository) SubjectRows(ctx context.Context, userID *ids.UserID) ([]SubjectRow, error)
SubjectRows returns every non-deleted user as an access subject, optionally narrowed to one. It carries no device aggregates: a caller composing a fleet already holds the device rows those counts derive from.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func NewService ¶
func (*Service) AddObserver ¶
func (*Service) GetAllUserHostAccess ¶
GetAllUserHostAccess implements the policy.HostAccessProvider interface.
func (*Service) OnUserEvent ¶
type SubjectRow ¶ added in v0.6.0
type SubjectRow struct {
ID ids.UserID
DisplayName string
Role httpapi.UserRole
BypassHostCheck bool
HostGroups []httpapi.GroupSummary
}
SubjectRow is one access subject's display identity: the role and bypass-host-check badge and the host groups granted to them. Role and bypass are rendered, never interpreted — the deciding domains are auth and the policy engine.
type UserHostGrant ¶
UserHostGrant is a resolved (user, fqdn) access grant.
type UserHostSetting ¶
type UserHostSetting struct {
UserID ids.UserID `db:"user_id"`
BypassHostCheck bool `db:"bypass_host_check"`
}
UserHostSetting is the per-user bypass flag from user_host_settings.
Source Files