Documentation
¶
Overview ¶
Package authz maps external groups, the Rauthy clients of calling applications, and the personal keys people make, to application-defined roles and permissions.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Actor ¶
type Actor struct {
// contains filtered or unexported fields
}
Actor is a permission snapshot. Its zero value grants nothing.
func (Actor) Permissions ¶
type Policy ¶
type Policy struct {
// contains filtered or unexported fields
}
Policy is immutable after construction and safe for concurrent use.
func New ¶
New validates and copies the application's role definitions, the external groups that grant them to people, the Rauthy client IDs that grant them to calling applications, and the permissions a person may give a key. An application nobody calls passes nil clients; one that issues no keys passes nil delegable. A delegable permission must be one some role grants.
func (*Policy) Delegable ¶ added in v0.11.0
Delegable returns the permissions a key may carry, sorted.
func (*Policy) Resolve ¶
Resolve ignores unmapped groups. Identity.Roles are deliberately not trusted as application roles. Additional local role assignments must come from trusted code.
func (*Policy) ResolveClient ¶ added in v0.5.0
ResolveClient returns what a calling application, named by its Rauthy client ID, may do. An unlisted client gets nothing.
func (*Policy) ResolveKey ¶ added in v0.11.0
ResolveKey returns what a key may do: the scopes it was given that are delegable and that the policy grants to its holder's groups. Roles are the holder's, as Resolve gives them; a key with no permission left gets nothing.
Source Files