rbac

package
v0.2.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 10, 2026 License: MIT Imports: 1 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var KnownScopes = map[string]struct{}{
	"audit:read":      {},
	"ddns:admin":      {},
	"dns:admin":       {},
	"geo:admin":       {},
	"geo:read":        {},
	"group:admin":     {},
	"group:read":      {},
	"inventory:admin": {},
	"inventory:read":  {},
	"kv:admin":        {},
	"kv:read":         {},
	"kv:write":        {},
	"log:admin":       {},
	"log:read":        {},
	"log:write":       {},
	"monitor:admin":   {},
	"monitor:read":    {},
	"netguard:admin":  {},
	"netguard:read":   {},
	"netpolicy:admin": {},
	"netpolicy:read":  {},
	"network:apply":   {},
	"network:plan":    {},
	"node:admin":      {},
	"node:read":       {},
	"notify:send":     {},
	"oidc:admin":      {},
	"plugin:admin":    {},
	"plugin:verify":   {},
	"proxy:admin":     {},
	"proxy:read":      {},
	"static:admin":    {},
	"static:read":     {},
	"static:write":    {},
	"task:read":       {},
	"task:run":        {},
	"terminal:open":   {},
	"token:admin":     {},
	"tunnel:admin":    {},
	"user:admin":      {},
	"worker:deploy":   {},
}

KnownScopes is the catalog of grantable RBAC scope strings. It is the authoritative allowlist the user-management API validates assignments against so an operator cannot be saddled with a typo'd or made-up scope that silently grants nothing (or, worse, a future-meaningful string). Keep it in sync with the scopes actually checked by withAuth(...)/requireScope across the server.

Functions

func Allows 

func Allows(p Principal, scope string, nodeID string) bool

func ValidScope added in v0.2.0 

func ValidScope(s string) bool

ValidScope reports whether s is a grantable scope: the global superuser "*", a known catalog member, or a domain wildcard ("node:*") whose prefix matches a known scope's domain.

Types

type Principal 

type Principal struct {
	ActorID         string
	TokenID         string
	Scopes          []string
	ServerAllowlist []string
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.