Documentation
¶
Index ¶
- Variables
- func ContextWithRole(ctx context.Context, roleName string) context.Context
- func ContextWithUserID(ctx context.Context, userID string) context.Context
- func Middleware(pe *PolicyEngine, resource Resource, action Action, ...) func(http.Handler) http.Handler
- func RoleFromContext(ctx context.Context) (string, bool)
- func UserIDFromContext(ctx context.Context) (string, bool)
- type Action
- type Permission
- type PolicyEngine
- type Resource
- type Role
- type RoleExtractor
Constants ¶
This section is empty.
Variables ¶
var ( RoleViewer = &Role{ Name: "viewer", Description: "Read-only access to all resources", Permissions: []Permission{ {Resource: ResourceWorkflows, Action: ActionRead}, {Resource: ResourceModules, Action: ActionRead}, {Resource: ResourceConfigs, Action: ActionRead}, }, } RoleEditor = &Role{ Name: "editor", Description: "Read and write access to workflows and modules", Permissions: []Permission{ {Resource: ResourceWorkflows, Action: ActionRead}, {Resource: ResourceWorkflows, Action: ActionWrite}, {Resource: ResourceModules, Action: ActionRead}, {Resource: ResourceModules, Action: ActionWrite}, {Resource: ResourceConfigs, Action: ActionRead}, {Resource: ResourceConfigs, Action: ActionWrite}, }, } RoleOperator = &Role{ Name: "operator", Description: "Full workflow and module management including deletion", Permissions: []Permission{ {Resource: ResourceWorkflows, Action: ActionRead}, {Resource: ResourceWorkflows, Action: ActionWrite}, {Resource: ResourceWorkflows, Action: ActionDelete}, {Resource: ResourceModules, Action: ActionRead}, {Resource: ResourceModules, Action: ActionWrite}, {Resource: ResourceModules, Action: ActionDelete}, {Resource: ResourceConfigs, Action: ActionRead}, {Resource: ResourceConfigs, Action: ActionWrite}, {Resource: ResourceConfigs, Action: ActionDelete}, }, } RoleAdmin = &Role{ Name: "admin", Description: "Full access to all resources", Permissions: []Permission{ {Resource: ResourceAll, Action: ActionAdmin}, }, } )
Built-in roles.
Functions ¶
func ContextWithRole ¶
ContextWithRole stores a role name in the context.
func ContextWithUserID ¶
ContextWithUserID stores a user ID in the context.
func Middleware ¶
func Middleware(pe *PolicyEngine, resource Resource, action Action, roleExtractor RoleExtractor) func(http.Handler) http.Handler
Middleware returns HTTP middleware that enforces RBAC permissions. The roleExtractor determines how the user's role is obtained from the request.
func RoleFromContext ¶
RoleFromContext extracts the role name from the context.
Types ¶
type Action ¶
type Action string
Action represents an operation that can be performed on a resource.
type Permission ¶
Permission represents permission to perform an action on a resource.
func ParsePermission ¶
func ParsePermission(s string) (Permission, error)
ParsePermission parses a "resource:action" string into a Permission.
func (Permission) String ¶
func (p Permission) String() string
String returns a human-readable representation of the permission.
type PolicyEngine ¶
type PolicyEngine struct {
// contains filtered or unexported fields
}
PolicyEngine manages roles and evaluates permissions.
func NewPolicyEngine ¶
func NewPolicyEngine() *PolicyEngine
NewPolicyEngine creates a PolicyEngine pre-loaded with built-in roles.
func (*PolicyEngine) Allowed ¶
func (pe *PolicyEngine) Allowed(roleName string, resource Resource, action Action) bool
Allowed checks whether the given role has permission for the resource and action.
func (*PolicyEngine) GetRole ¶
func (pe *PolicyEngine) GetRole(name string) (*Role, bool)
GetRole retrieves a role by name.
func (*PolicyEngine) ListRoles ¶
func (pe *PolicyEngine) ListRoles() []*Role
ListRoles returns all registered roles.
func (*PolicyEngine) RegisterRole ¶
func (pe *PolicyEngine) RegisterRole(role *Role)
RegisterRole adds or replaces a role definition.
type Role ¶
type Role struct {
Name string `json:"name"`
Description string `json:"description"`
Permissions []Permission `json:"permissions"`
}
Role represents a named set of permissions.
type RoleExtractor ¶
RoleExtractor is a function that extracts a role name from the request.
func ContextRoleExtractor ¶
func ContextRoleExtractor() RoleExtractor
ContextRoleExtractor returns a RoleExtractor that reads the role from the request context.
func HeaderRoleExtractor ¶
func HeaderRoleExtractor(header string) RoleExtractor
HeaderRoleExtractor returns a RoleExtractor that reads the role from an HTTP header.
Source Files