Documentation
¶
Overview ¶
Package service implements SFBAC permission resolution, administration and bootstrap synchronization on top of the store layer.
Index ¶
- Variables
- func AssignRole(shared store.Shared, tenant store.Tenant, sub, roleName string) error
- func Authorize(tenant store.Tenant, sub, operation string) (bool, error)
- func BootstrapMeta(stores *store.Stores, adminSub string) error
- func CreateOperation(shared store.Shared, name string) error
- func CreateResource(shared store.Shared, name string) error
- func CreateRole(tenant store.Tenant, name string) error
- func DeleteOperation(shared store.Shared, name string) error
- func DeleteResource(shared store.Shared, name string) error
- func DeleteRole(tenant store.Tenant, name string) error
- func EffectiveOperations(tenant store.Tenant, sub string) ([]model.OperationScope, error)
- func EnsureOperation(shared store.Shared, name string) error
- func EnsureRole(tenant store.Tenant, name string) error
- func EnsureUser(shared store.Shared, sub string) error
- func GetRole(tenant store.Tenant, name string) (*store.Role, error)
- func ListOperations(shared store.Shared) ([]store.Operation, error)
- func ListResources(shared store.Shared) ([]store.Resource, error)
- func ListRoles(tenant store.Tenant) ([]store.Role, error)
- func ListUsers(shared store.Shared) ([]store.User, error)
- func MetaOperations(tenant store.Tenant, sub string) ([]model.OperationScope, error)
- func RecordIDs(tenant store.Tenant, sub string, operations []string) (map[string][]string, error)
- func RemoveRolePermission(tenant store.Tenant, roleName, operation string) error
- func RemoveUserPermission(tenant store.Tenant, sub, operation string) error
- func RenameRole(tenant store.Tenant, name, newName string) error
- func RolePermissions(tenant store.Tenant, name string) ([]model.OperationScope, error)
- func SetRolePermission(shared store.Shared, tenant store.Tenant, roleName, operation string, ...) error
- func SetUserPermission(shared store.Shared, tenant store.Tenant, sub, operation string, ...) error
- func Sync(stores *store.Stores, files []BootstrapFile) error
- func UnassignRole(tenant store.Tenant, sub, roleName string) error
- func UpdateRoleRestrictedIDs(tenant store.Tenant, roleName, operation string, add, remove []string) error
- func UpdateUserRestrictedIDs(tenant store.Tenant, sub, operation string, add, remove []string) error
- func UserRoles(tenant store.Tenant, sub string) ([]string, error)
- type BootstrapFile
- type PermissionSpec
- type TenantBootstrap
- type UserBootstrap
Constants ¶
This section is empty.
Variables ¶
var ( ErrNotFound = store.ErrNotFound ErrConflict = store.ErrConflict ErrValidation = errors.New("validation error") )
Sentinel errors mapped to HTTP status codes by the API layer. ErrNotFound and ErrConflict alias the store's sentinels so errors.Is works across layers.
Functions ¶
func AssignRole ¶
AssignRole assigns a role to a user (idempotent) and lazily provisions the user in the shared store.
func Authorize ¶
Authorize reports whether the user holds the operation with FULL scope. Sforza's administrative APIs operate on whole collections, so meta permissions are only honored at FULL scope; RESTRICTED and EMPTY deny.
func BootstrapMeta ¶
BootstrapMeta registers Sforza's own meta resources and operations in the shared database, then ensures the administrator role exists in every tenant with FULL scope on every meta operation and assigns it to adminSub.
func CreateOperation ¶
CreateOperation registers an operation named "resource:action", creating the parent resource when missing.
func CreateResource ¶
CreateResource registers a resource; creating an existing one is an error.
func CreateRole ¶
CreateRole creates a role in the tenant.
func DeleteOperation ¶
DeleteOperation removes an operation.
func DeleteResource ¶
DeleteResource removes a resource together with its operations.
func DeleteRole ¶
DeleteRole removes a role with all its permissions, restricted IDs and user assignments.
func EffectiveOperations ¶
EffectiveOperations returns every operation available to the user with its effective scope, sorted by operation name. Restricted IDs are never included here.
func EnsureOperation ¶
EnsureOperation registers an operation if missing (idempotent variant used by bootstrap synchronization).
func EnsureRole ¶
EnsureRole creates a role if missing.
func EnsureUser ¶
EnsureUser lazily provisions a user in the shared store.
func ListOperations ¶
ListOperations returns all registered operations.
func ListResources ¶
ListResources returns all registered resources.
func MetaOperations ¶
MetaOperations returns the subset of effective operations that belong to Sforza's own meta authorization model.
func RecordIDs ¶
RecordIDs returns, for each requested operation whose effective scope is RESTRICTED, the sorted set of accessible record IDs. Operations with FULL, EMPTY or no assignment are omitted from the result.
func RemoveRolePermission ¶
RemoveRolePermission deletes (operation, scope) from a role together with the operation's restricted IDs.
func RemoveUserPermission ¶
RemoveUserPermission deletes a user-level override together with the operation's restricted IDs.
func RenameRole ¶
RenameRole changes a role's name.
func RolePermissions ¶
RolePermissions returns the (operation, scope) pairs assigned to a role.
func SetRolePermission ¶
func SetRolePermission(shared store.Shared, tenant store.Tenant, roleName, operation string, scope model.Scope) error
SetRolePermission upserts (operation, scope) on a role. The operation must be registered in the shared store.
func SetUserPermission ¶
func SetUserPermission(shared store.Shared, tenant store.Tenant, sub, operation string, scope model.Scope) error
SetUserPermission upserts a user-level (operation, scope) override and lazily provisions the user.
func Sync ¶
func Sync(stores *store.Stores, files []BootstrapFile) error
Sync applies bootstrap files to the databases. It is additive and idempotent: declared entities are created or updated to match, while entities not mentioned are left untouched (other services may own them).
func UnassignRole ¶
UnassignRole removes a role from a user.
func UpdateRoleRestrictedIDs ¶
func UpdateRoleRestrictedIDs(tenant store.Tenant, roleName, operation string, add, remove []string) error
UpdateRoleRestrictedIDs adds and removes record IDs for a role's permission on an operation. The permission must already be assigned.
Types ¶
type BootstrapFile ¶
type BootstrapFile struct {
Resources []string `yaml:"resources"`
Operations []string `yaml:"operations"`
Tenants map[string]TenantBootstrap `yaml:"tenants"`
}
BootstrapFile is the YAML document a microservice contributes to register its resources, operations and tenant configuration.
resources:
- product
operations:
- product:read
- product:write
tenants:
tenant-a:
roles:
manager:
product:read: FULL
product:write:
scope: RESTRICTED
ids: [10, 15]
users:
john:
roles: [manager]
permissions:
product:read: FULL
func LoadBootstrapFiles ¶
func LoadBootstrapFiles(patterns []string) ([]BootstrapFile, error)
LoadBootstrapFiles reads every file matched by the given glob patterns and parses it as a BootstrapFile.
type PermissionSpec ¶
PermissionSpec is either a bare scope ("FULL") or a mapping with a scope and optional restricted IDs.
func (*PermissionSpec) UnmarshalYAML ¶
func (p *PermissionSpec) UnmarshalYAML(node *yaml.Node) error
UnmarshalYAML accepts both the scalar and the mapping form.
type TenantBootstrap ¶
type TenantBootstrap struct {
Roles map[string]map[string]PermissionSpec `yaml:"roles"`
Users map[string]UserBootstrap `yaml:"users"`
}
TenantBootstrap declares roles and users for one tenant.
type UserBootstrap ¶
type UserBootstrap struct {
Roles []string `yaml:"roles"`
Permissions map[string]PermissionSpec `yaml:"permissions"`
}
UserBootstrap declares role assignments and permission overrides for a user.
Source Files