Documentation
¶
Overview ¶
Package permissions defines client roles and the capability lookup that gates privileged API methods.
Three orthogonal properties describe a request's authority:
- Locality: a connection from the device itself (loopback). Local means "physically at the device" — anyone with OS access owns the whole system anyway, so local connections default to admin.
- Role: the identity of a paired client, chosen at pairing approval.
- Session role: a voluntary downgrade a client declares for its own connection (e.g. a kiosk frontend restricting the UI it exposes). Reserved — nothing sets it yet, but the check honors it so kiosk support can land without touching handlers.
Handlers never compare roles directly; they require a capability, and roles map to capability sets. Finer-grained roles later are new map entries, not handler changes.
A remote request with no paired identity (plaintext WebSocket while service.encryption is off) is treated as admin: it predates the permission system and restricting it would break unpaired clients. Setting service.encryption = true requires every remote client to be paired, which is what makes member restrictions enforceable.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Capability ¶
type Capability string
Capability names a privileged operation a handler can require. The guiding rule for what needs a capability: anything that can weaken playtime limits is admin.
const ( // CapProfilesManage covers creating, updating, and deleting device // profiles, and reading profile switch IDs (bearer credentials that // authorize PIN-free switching). CapProfilesManage Capability = "profiles.manage" // CapSettingsWrite covers device settings changes, which include // disabling playtime limits and the require-profile launch gate. CapSettingsWrite Capability = "settings.write" )
type Grant ¶
type Grant struct {
// Role is the paired client's stored role, or "" when the request
// carries no paired identity.
Role Role
// SessionRole is a voluntary downgrade declared by the client for
// this session. Empty means no downgrade. Reserved for kiosk mode.
SessionRole Role
// IsLocal is true for loopback connections.
IsLocal bool
}
Grant describes the authority of a single request.
func (Grant) Capabilities ¶
func (g Grant) Capabilities() []Capability
Capabilities returns the effective grant's enabled capabilities in stable lexical order. The returned slice is always non-nil.
func (Grant) EffectiveRole ¶
EffectiveRole resolves the request's role: local connections and unpaired remote requests are admin (see the package doc for why), a paired identity uses its stored role (unknown values degrade to member), and a voluntary session downgrade to member always wins.
func (Grant) Has ¶
func (g Grant) Has(capability Capability) bool
Has reports whether the request may perform the given capability.
Source Files