Documentation
¶
Overview ¶
Package authz provides multi-principal, RBAC-style access control for the control plane. It generalizes the legacy single static bearer token into a set of named principals, each with its own token, an allowed-profile glob list, and permission flags.
The zero value and a nil *Store both mean "RBAC not configured", allowing the caller to fall back to legacy single-token behavior.
Index ¶
Constants ¶
const EnvFile = "RUNEWARD_AUTHZ_FILE"
EnvFile is the environment variable that points at the RBAC principals file.
Variables ¶
var ErrEmpty = errors.New("authz: store not configured")
ErrEmpty is returned by helpers that require a configured store. It is exported for callers that wish to distinguish "not configured" from other failures.
Functions ¶
This section is empty.
Types ¶
type Principal ¶
type Principal struct {
// Name is the human-readable identity used as the audit actor.
Name string `json:"name"`
// Token is the bearer token that authenticates this principal.
Token string `json:"token"`
// AllowedProfiles is a list of glob patterns (path.Match syntax) matched
// against a profile name. An empty list for a non-admin principal means it
// may launch nothing; a list containing "*" allows every profile.
AllowedProfiles []string `json:"allowed_profiles"`
// CanApprove permits the principal to approve or deny pending actions.
CanApprove bool `json:"can_approve"`
// Admin bypasses all profile restrictions and implies approval rights.
Admin bool `json:"admin"`
}
Principal is a named identity that authenticates with a bearer token and carries its own authorization scope.
func (*Principal) CanLaunch ¶
CanLaunch reports whether the principal may launch the named profile. Admins bypass all restrictions. For non-admins, the profile must match at least one of the AllowedProfiles glob patterns.
func (*Principal) MayApprove ¶
MayApprove reports whether the principal may approve or deny actions.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store holds principals indexed by token. It is safe for concurrent reads. A nil *Store means RBAC is not configured.
func FromEnv ¶
FromEnv builds a Store from the file named by RUNEWARD_AUTHZ_FILE. When the variable is unset (or empty) it returns (nil, nil), signaling that RBAC is not configured and the caller should fall back to legacy single-token auth.
func Load ¶
Load reads a JSON principals file of the form:
{"principals": [ {"name": "...", "token": "...", ...}, ... ]}
It rejects entries with empty names, empty tokens, or duplicate tokens.
Source Files