Documentation
¶
Overview ¶
Package rbac checks permissions by role:
var policy = rbac.New(map[string][]string{
"viewer": {"projects:read"},
"editor": {"projects:read", "projects:write"},
"admin": {"*"},
}, func(ctx *kit.Ctx) []string {
return sessions.Get(ctx).Strings("roles") // however your app stores them
})
func Load(ctx *kit.Ctx) (Page, error) {
if err := policy.Require(ctx, "projects:read"); err != nil {
return Page{}, err // 401 when signed out, 403 without the permission
}
...
}
Permissions are strings; "projects:*" grants every permission that starts with "projects:", and "*" grants everything. A role can include other roles with "role:<name>".
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Policy ¶
type Policy struct {
// contains filtered or unexported fields
}
Policy maps roles to permissions.
func New ¶
New returns a policy. roles maps each role to its permissions; rolesOf returns the current user's roles, or nil when nobody is signed in.
func (*Policy) Hook ¶
Hook returns a kit hook that requires perm for every request whose path starts with prefix, such as rbac.Hook("/admin", "admin:access").
func (*Policy) Permissions ¶
Permissions returns everything the roles grant, including included roles.
Source Files
Click to show internal directories.
Click to hide internal directories.