acl

type CachedScopeExpander ¶

type CachedScopeExpander struct {
	// contains filtered or unexported fields
}

CachedScopeExpander wraps a ScopeExpander with an in-memory TTL cache. The cache is keyed by scope+subject and stores the expanded descendant list. It is safe for concurrent use.

func NewCachedScopeExpander(backend ScopeExpander, ttl time.Duration) *CachedScopeExpander

func (c *CachedScopeExpander) ExpandScope(ctx context.Context, scope aclscope.Scope, subject aclscope.Subject) ([]Ownerref, error)

func (c *CachedScopeExpander) ExpandScopes(ctx context.Context, seeds []Ownerref) (map[Ownerref][]Ownerref, error)

func (c *CachedScopeExpander) Invalidate(scope aclscope.Scope, subject aclscope.Subject)

func (c *CachedScopeExpander) InvalidateAll()

type Ownerref ¶

type Ownerref struct {
	Scope   aclscope.Scope
	Subject aclscope.Subject
}

Ownerref represents a scope+subject pair that a user has access to.

type OwnerrefFilter ¶ added in v1.20.2

type OwnerrefFilter struct {
	Scopes   []aclscope.Scope
	Subjects []aclscope.Subject
}

OwnerrefFilter narrows the ownerrefs returned by ResolveOwnerrefs. Each dimension is optional: an empty slice means "no restriction" for that dimension. When Scopes is non-empty, only ownerrefs whose scope is in the set are returned. When Subjects is non-empty, only ownerrefs whose subject is in the set are returned. Both must match when both are set.

func (f OwnerrefFilter) IsEmpty() bool

func (f OwnerrefFilter) Matches(ref Ownerref) bool

type Resolver ¶

type Resolver struct {
	// contains filtered or unexported fields
}

Resolver resolves access for a set of groups using a Store. It loads all entries in one batch call, then compiles access in-memory. An optional ScopeExpander enables hierarchical scope resolution: if a user has access to a Project, the expander resolves all descendant ownerrefs (Workspaces, Clusters, etc.) so they are included in the result.

func NewResolver(store Store, opts ...ResolverOption) *Resolver

func (r *Resolver) HasAccess(ctx context.Context, groups []string, scope aclscope.Scope, subject aclscope.Subject, requiredAccess aclmodels.AccessTypeV3) (bool, error)

func (r *Resolver) ResolveAccess(ctx context.Context, groups []string, scope aclscope.Scope, subject aclscope.Subject) ([]aclmodels.AccessTypeV3, error)

func (r *Resolver) ResolveOwnerrefs(ctx context.Context, groups []string, requiredAccess aclmodels.AccessTypeV3, filter OwnerrefFilter) ([]Ownerref, error)

type ResolverOption ¶

type ResolverOption func(*Resolver)

ResolverOption configures a Resolver.

func WithScopeExpander(expander ScopeExpander) ResolverOption

type ScopeExpander ¶

type ScopeExpander interface {
	ExpandScope(ctx context.Context, scope aclscope.Scope, subject aclscope.Subject) ([]Ownerref, error)

	// ExpandScopes expands several seeds in a single round-trip, returning the
	// descendant ownerrefs for each seed keyed by the seed ownerref. It is
	// equivalent to calling ExpandScope for each seed but avoids per-seed
	// round-trips. Seeds with no descendants map to a nil/empty slice.
	ExpandScopes(ctx context.Context, seeds []Ownerref) (map[Ownerref][]Ownerref, error)
}

ScopeExpander resolves hierarchical scope relationships by walking the ownerref chain in resourcesv2. No business logic or hardcoded hierarchy — the tree emerges from rormeta.ownerref data on each resource.

ExpandScope recursively finds all resourcesv2 resources whose ownerref matches {scope, subject}, then their children, and so on.

Example: if Workspace "ws-dev" has ownerref {Project, proj-1} and Cluster "cluster-abc" has ownerref {Workspace, ws-dev}, then ExpandScope(ctx, "Project", "proj-1") returns:

[{Workspace, ws-dev}, {KubernetesCluster, cluster-abc}]

Returns nil if no resources have the given ownerref (leaf scope). The original scope+subject is NOT included in the result.

type Store ¶

type Store interface {
	// GetByGroups returns all ACL entries for the given group names as V3 items.
	// V2 entries in the database are converted to V3 using aclmodels.V2ToV3.
	GetByGroups(ctx context.Context, groups []string) (map[string][]aclmodels.AclV3ListItem, error)

	// GetV2ByGroups returns all ACL entries for the given group names as V2 items.
	// V3 entries in the database are converted to V2 using aclmodels.V3ToV2.
	// V3-only capabilities (e.g. "kubernetes:admin") are dropped in the conversion.
	GetV2ByGroups(ctx context.Context, groups []string) (map[string][]aclmodels.AclV2ListItem, error)
}

Store is the interface for loading ACL entries. Implementations can use MongoDB, Redis, or any other backend. Both methods load all entries (V2 and V3) in a single round-trip and convert to the requested format. V2 entries are converted to V3 using the v3 struct tags on AclV2ListItemAccess. V3 entries are converted to V2 with capabilities that have no V2 equivalent silently dropped.