Documentation
¶
Overview ¶
Package identity is who a request runs as and what they ask to do, without HTTP: the part of the identity port (docs/ARCHITECTURE.md) the engine may know. internal/auth adds the HTTP side (authenticators, the middleware, classifying a request) and re-exports everything here, so adapters and the API keep using auth's names.
Index ¶
Constants ¶
const ( VerbRead = "read" VerbWrite = "write" )
Verbs an Action carries. Read is any safe method; Write is the rest.
const ( ResourceAccess = "access" // the access list ResourceVault = "vault" // applying and recovering the vault ResourceSession = "session" // who the caller is ResourceAgent = "agent" // acting through an agent at all )
Resources an action may concern besides a manifest.
const ( RoleReader = "reader" RoleContributor = "contributor" RoleStrategyEditor = "strategyEditor" RoleAdministrator = "administrator" )
The roles an access list grants (docs/adr/0011, TAXONOMY.md D27).
Variables ¶
var Anonymous = Principal{Subject: "", Anonymous: true}
Anonymous is the principal of a request nobody identified.
var ErrAgentProposes = fmt.Errorf("%w: an agent proposes this, and its person confirms it", ErrForbidden)
ErrAgentProposes refuses an agent something that makes the record: a version, a reading, a state change, a deletion. It may propose it, and its person confirms (docs/adr/0016).
var ErrForbidden = errors.New("forbidden")
ErrForbidden is returned by an Authorizer that refuses an action.
var Roles = []string{RoleReader, RoleContributor, RoleStrategyEditor, RoleAdministrator}
Roles is every role, from the least to the most a role may do.
Functions ¶
Types ¶
type Action ¶
type Action struct {
// Verb is read or write (the HTTP method's intent).
Verb string
// Kind and ID name the manifest, when the action concerns one.
Kind string
ID string
// Resource names what the action concerns when it is not a manifest:
// ResourceAccess, ResourceVault or ResourceSession.
Resource string
// Change is what a write would do to the manifest's content. The HTTP
// layer cannot see it and leaves it nil; the engine sets it at every
// write, so a policy that decides by content decides there.
Change *Change
}
Action is one thing a principal asks to do.
type Authorizer ¶
Authorizer decides whether a principal may perform an action.
type Change ¶
type Change struct {
// TeamsBefore and TeamsAfter are the chains of teams the manifest
// sits under, nearest first, as stored and as it would be after the
// write. A new manifest has no chain before; a deletion none after;
// a manifest that names no team has none on that side.
TeamsBefore, TeamsAfter []string
// Fields are the top-level spec fields whose values change, sorted.
Fields []string
}
Change is what one write does to one manifest.
type Grants ¶
type Grants struct {
Listed bool
Roles []string
// Teams are the teams the principal acts for, without the teams
// beneath them.
Teams []string
// Agents is whether the principal may act through an agent: one of
// their roles is allowed agents, and an administrator has not turned
// theirs off (docs/adr/0016).
Agents bool
}
Grants are what an access list gives a principal: whether they are listed at all, and the roles and teams they hold, from an administrator and from the directory together.
type Principal ¶
type Principal struct {
// Subject is the stable identifier, what a version's Actor records.
Subject string
// Name is for display. Falls back to Subject.
Name string
// Email is the organisation address, when the authenticator has
// one: what an access list knows a person by.
Email string
// Roles are the groups the principal belongs to, for an Authorizer.
Roles []string
// Anonymous is true when no authenticator identified anyone.
Anonymous bool
// Agent names the agent acting for this person, through MCP
// (docs/adr/0016); empty when the person acts themself. An agent
// holds its person's authority and no more, and may read and propose
// but not make the record: that waits for the person.
Agent string
// Delegated is a principal an agent grant carries, not a sign-in: no
// directory groups came with the request, so the person's roles and
// teams are the ones recorded at their last sign-in.
Delegated bool
// Grant is the agent grant an agent connected with, when it connected
// through Cartograph's own authorization server: one connection, so
// two agents of the same person keep their work apart (ADR 0022).
Grant string
}
Principal is who a request runs as.
func PrincipalFrom ¶
PrincipalFrom returns the principal on ctx, or Anonymous.
Source Files