Documentation
¶
Overview ¶
Package iam implements the metaxisdata permission-check engine.
It resolves a caller's effective permission set from the IAM model: a permission is a fine-grained string (backend/common/permission), a role is a named bundle of permissions (backend/store/predefined_roles.go for built-in roles, the role table for custom roles), and the workspace IAM policy binds principals to roles (backend/store/policy.go). This mirrors laelia's backend/component/iam, adapted to metaxisdata's single-workspace model.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager resolves permissions against the IAM model.
func NewManager ¶
NewManager builds an IAM manager backed by the given store.
func (*Manager) CheckPermission ¶
func (m *Manager) CheckPermission(ctx context.Context, perm permission.Permission, user *store.UserMessage) (bool, error)
CheckPermission reports whether the caller holds the permission.
Every authenticated principal receives the roles/workspaceMember baseline (the implicit allUsers->workspaceMember binding of the single-workspace model); user callers additionally receive the permissions of every role they hold in the workspace IAM policy, directly, through a group, or via allUsers. The check short-circuits on the first granting set, so the common case costs one map lookup and no allocation.
func (*Manager) EffectivePermissions ¶
func (m *Manager) EffectivePermissions(ctx context.Context, user *store.UserMessage) ([]permission.Permission, error)
EffectivePermissions returns the caller's whole workspace permission set: the workspaceMember baseline unioned with the permissions of every role the user holds in the workspace IAM policy. Used by GetCurrentUser to populate User.permissions for frontend gating.
type Store ¶
type Store interface {
utils.MemberStore
GetWorkspaceIamPolicy(ctx context.Context) (*store.IamPolicyMessage, error)
GetRoleSnapshot(ctx context.Context, resourceID string) (*store.RoleMessage, error)
}
Store is the subset of the metadata store the engine reads. Narrowing it keeps permission resolution testable without a database.
Source Files