Documentation
¶
Overview ¶
Package rbac provides Role-Based Access Control (RBAC) with role inheritance.
Quick start:
store := rbac.NewMemoryStore()
store.AddRole(rbac.Role{
Name: "editor",
Parents: []string{"viewer"},
Permissions: []rbac.Permission{{Resource: "posts", Action: "create"}},
})
store.AssignRole("alice", "editor")
e := rbac.New(store)
e.Can("alice", "create", "posts") // true
Index ¶
- Variables
- func Require(enforcer *Enforcer, action, resource string) func(http.Handler) http.Handler
- func RequireRole(enforcer *Enforcer, roles ...string) func(http.Handler) http.Handler
- type Enforcer
- type MemoryStore
- func (s *MemoryStore) AddRole(role Role) error
- func (s *MemoryStore) AssignRole(subject, role string) error
- func (s *MemoryStore) GetRole(name string) (Role, error)
- func (s *MemoryStore) GetSubjectRoles(subject string) ([]string, error)
- func (s *MemoryStore) RemoveRole(name string) error
- func (s *MemoryStore) UnassignRole(subject, role string) error
- type Permission
- type Role
- type Store
Constants ¶
This section is empty.
Variables ¶
var ErrPermissionDenied = errors.New("rbac: permission denied")
ErrPermissionDenied is returned by Enforce when access is not granted.
var ErrRoleNotFound = errors.New("rbac: role not found")
ErrRoleNotFound is returned when a requested role does not exist in the store.
Functions ¶
func Require ¶
Require returns HTTP middleware that enforces a single RBAC permission. The subject is taken from the JWT claims stored in the request context, so the JWT middleware must run before this one.
Usage:
mux.Handle("/posts", authmw.JWT(svc)(rbac.Require(enforcer, "read", "posts")(handler)))
func RequireRole ¶
RequireRole returns HTTP middleware that passes only when the authenticated subject has been directly assigned at least one of the given role names.
Usage:
mux.Handle("/admin", authmw.JWT(svc)(rbac.RequireRole(enforcer, "admin")(handler)))
Types ¶
type Enforcer ¶
type Enforcer struct {
// contains filtered or unexported fields
}
Enforcer evaluates access decisions using the configured Store.
func (*Enforcer) Can ¶
Can reports whether the subject has permission to perform action on resource. Role inheritance is resolved transitively; cycles are guarded against.
func (*Enforcer) Enforce ¶
Enforce is like Can but returns ErrPermissionDenied when access is not granted.
type MemoryStore ¶
type MemoryStore struct {
// contains filtered or unexported fields
}
MemoryStore is a thread-safe in-memory implementation of Store. It is suitable for testing and simple applications. For production, back the store with a database.
func NewMemoryStore ¶
func NewMemoryStore() *MemoryStore
NewMemoryStore returns an initialised MemoryStore.
func (*MemoryStore) AddRole ¶
func (s *MemoryStore) AddRole(role Role) error
func (*MemoryStore) AssignRole ¶
func (s *MemoryStore) AssignRole(subject, role string) error
func (*MemoryStore) GetSubjectRoles ¶
func (s *MemoryStore) GetSubjectRoles(subject string) ([]string, error)
func (*MemoryStore) RemoveRole ¶
func (s *MemoryStore) RemoveRole(name string) error
func (*MemoryStore) UnassignRole ¶
func (s *MemoryStore) UnassignRole(subject, role string) error
type Permission ¶
type Permission struct {
// Resource is the name of the protected resource (e.g. "posts", "users").
Resource string
// Action is the operation being performed (e.g. "read", "create", "delete").
Action string
}
Permission defines a single operation on a resource. Use "*" as a wildcard for either field to match anything.
func (Permission) String ¶
func (p Permission) String() string
String returns a "resource:action" representation of the permission.
type Role ¶
type Role struct {
// Name is the unique identifier for this role (e.g. "admin", "viewer").
Name string
// Parents lists role names whose permissions this role inherits transitively.
Parents []string
// Permissions are the access rights granted directly by this role.
Permissions []Permission
}
Role is a named set of permissions that can be assigned to subjects.
type Store ¶
type Store interface {
// GetRole retrieves a role by name. Returns ErrRoleNotFound when absent.
GetRole(name string) (Role, error)
// GetSubjectRoles returns all role names directly assigned to a subject.
GetSubjectRoles(subject string) ([]string, error)
// AssignRole grants a role to a subject (idempotent).
AssignRole(subject, role string) error
// UnassignRole removes a role from a subject (no-op if not assigned).
UnassignRole(subject, role string) error
// AddRole persists a role definition, overwriting any previous definition
// with the same name.
AddRole(role Role) error
// RemoveRole deletes a role by name.
RemoveRole(name string) error
}
Store is the persistence layer for roles and subject role assignments.
Source Files