Documentation
¶
Index ¶
- Constants
- Variables
- func ActorObject(atespace, name string) string
- func ActorTemplateObject(atespace, name string) string
- func AtespaceObject(name string) string
- func ContextWithTx(ctx context.Context, tx pgx.Tx) context.Context
- func EnsureStoreAndModel(ctx context.Context, pool *pgxpool.Pool, fgaServer *server.Server) (string, string, error)
- func FormatMember(member string) (string, error)
- func IsBypassed(ctx context.Context) bool
- func New(ctx context.Context, pool *pgxpool.Pool, fgaServer *server.Server, ...) (*Authorizer, *PolicyManager, error)
- func NewOpenFGAServer(pool *pgxpool.Pool) (*server.Server, error)
- func TxFromContext(ctx context.Context) (pgx.Tx, bool)
- func UnaryServerInterceptor(authorizer *Authorizer, enforce bool) grpc.UnaryServerInterceptor
- func WithBypass(ctx context.Context) context.Context
- type Authorizer
- type PolicyManager
- func (m *PolicyManager) DeleteAtespacePolicies(ctx context.Context, tx pgx.Tx, name string) error
- func (m *PolicyManager) ReconcileAtespaceBindings(ctx context.Context, tx pgx.Tx, name string, bindings []*ateapipb.Binding) error
- func (m *PolicyManager) ReconcileGlobalBindings(ctx context.Context, tx pgx.Tx, bindings []*ateapipb.Binding) error
Constants ¶
const ( // GlobalRootObject is the singleton global scope object identifier in OpenFGA. GlobalRootObject = "global:root" RoleOwner = "owner" RoleEditor = "editor" RoleViewer = "viewer" RelationCanCreateAtespace = "can_create_atespace" RelationCanListAtespaces = "can_list_atespaces" RelationCanCreateActor = "can_create_actor" RelationCanListActors = "can_list_actors" RelationCanCreateActorTemplate = "can_create_actor_template" RelationCanListActorTemplates = "can_list_actor_templates" RelationCanGet = "can_get" RelationCanUseTemplate = "can_use_template" RelationCanUpdate = "can_update" RelationCanDelete = "can_delete" RelationCanCreateAccessPolicy = "can_create_access_policy" RelationCanGetAccessPolicy = "can_get_access_policy" RelationCanUpdateAccessPolicy = "can_update_access_policy" RelationCanDeleteAccessPolicy = "can_delete_access_policy" )
Variables ¶
var ErrNilTransaction = errors.New("authz: policy tuple writes require a non-nil pgx.Tx")
ErrNilTransaction is returned by PolicyManager tuple writes called without a PostgreSQL transaction.
var ErrNoTransactionInContext = errors.New("authz datastore: active pgx.Tx required in context")
ErrNoTransactionInContext is returned by ReadPage and Write when called without an active pgx.Tx injected via ContextWithTx.
Functions ¶
func ActorObject ¶ added in v0.4.0
ActorObject formats an actor as an OpenFGA object string.
func ActorTemplateObject ¶ added in v0.4.0
ActorTemplateObject formats an actor template as an OpenFGA object string.
func AtespaceObject ¶ added in v0.3.0
AtespaceObject formats an atespace name as an OpenFGA object string.
func ContextWithTx ¶
ContextWithTx injects an active pgx.Tx into ctx.
func EnsureStoreAndModel ¶
func EnsureStoreAndModel(ctx context.Context, pool *pgxpool.Pool, fgaServer *server.Server) (string, string, error)
EnsureStoreAndModel ensures the default OpenFGA store and checked-in authorization model are provisioned on fgaServer (serialized across replicas via a PostgreSQL advisory lock on pool) and returns the provisioned (storeID, modelID).
func FormatMember ¶ added in v0.4.0
FormatMember validates a policy member string (such as "user:alice@example.com") and returns the percent-encoded OpenFGA user string. Control characters are rejected because OpenFGA does not accept them in tuple user IDs.
func IsBypassed ¶ added in v0.3.0
IsBypassed reports whether ctx has authorization checks bypassed.
func New ¶ added in v0.3.0
func New(ctx context.Context, pool *pgxpool.Pool, fgaServer *server.Server, bootstrapOwners []string) (*Authorizer, *PolicyManager, error)
New provisions the default OpenFGA store and authorization model via EnsureStoreAndModel and returns the read-path Authorizer and write-path PolicyManager. bootstrapOwners are principal IDs (with or without the "user:" prefix) that the Authorizer treats as owners of global:root on every check, independent of any stored AccessPolicy.
func NewOpenFGAServer ¶
NewOpenFGAServer creates an embedded OpenFGA server backed by a transaction-aware PostgreSQL datastore on pool. Calling Close on the returned server stops OpenFGA's background workers without closing the caller-owned pool.
func TxFromContext ¶
TxFromContext retrieves the active pgx.Tx from ctx, if present.
func UnaryServerInterceptor ¶ added in v0.3.0
func UnaryServerInterceptor(authorizer *Authorizer, enforce bool) grpc.UnaryServerInterceptor
UnaryServerInterceptor returns a gRPC unary interceptor that enforces per-RPC permissions registered in defaultRPCPermissions using authorizer. When enforce is false, only rules marked alwaysEnforce are checked.
Types ¶
type Authorizer ¶ added in v0.3.0
type Authorizer struct {
// contains filtered or unexported fields
}
Authorizer is the read-only policy decision point that evaluates runtime OpenFGA permissions against Substrate's store and authorization model.
func (*Authorizer) Check ¶ added in v0.3.0
func (a *Authorizer) Check(ctx context.Context, relation, object string) error
Check verifies that the principal in ctx has relation on object. Structural hierarchy links (global:root as parent_global of every atespace, and each atespace as parent_atespace of its actors and actor templates) and the caller's bootstrap owner grant, if any, are injected as OpenFGA ContextualTuples at evaluation time rather than persisted in the tuple table.
type PolicyManager ¶ added in v0.3.0
type PolicyManager struct {
// contains filtered or unexported fields
}
PolicyManager writes OpenFGA tuples for access policy and atespace mutations within the caller's PostgreSQL transaction.
func (*PolicyManager) DeleteAtespacePolicies ¶ added in v0.3.0
DeleteAtespacePolicies removes all OpenFGA tuples associated with an atespace within tx. The tuple deletions commit or roll back with tx.
func (*PolicyManager) ReconcileAtespaceBindings ¶ added in v0.4.0
func (m *PolicyManager) ReconcileAtespaceBindings(ctx context.Context, tx pgx.Tx, name string, bindings []*ateapipb.Binding) error
ReconcileAtespaceBindings reconciles the OpenFGA role bindings on an atespace within tx. The tuple changes commit or roll back with tx.
func (*PolicyManager) ReconcileGlobalBindings ¶ added in v0.4.0
func (m *PolicyManager) ReconcileGlobalBindings(ctx context.Context, tx pgx.Tx, bindings []*ateapipb.Binding) error
ReconcileGlobalBindings reconciles the OpenFGA role bindings on global:root within tx. The tuple changes commit or roll back with tx.
Source Files