Documentation
¶
Overview ¶
Package authz is the list of permissions, the roles that bundle them and the check (ADR-0023, docs/product/roles.md). The platform decides with it on every call.
A role is the member's in the whole workspace: Owner (one), Maintainer, Developer. A permission is not given apart from a role. A server of the team is a member of its own kind and may act in its projects alone.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var All = []Permission{ WorkspaceView, WorkspaceManage, AuditView, ProjectCreate, ProjectConfigure, AppsManage, ServicesManage, ServersManage, SecretsManage, SecretsRead, MembersInvite, MembersManage, OverridesUse, EnvUse, ProductionDeploy, }
All is every permission.
Functions ¶
Types ¶
type Permission ¶
type Permission string
Permission is something a member may do.
const ( WorkspaceView Permission = "workspace.view" // see the workspace, its projects and members // WorkspaceManage is the owner's: the root of trust of signatures and the // workspace's secrets key. WorkspaceManage Permission = "workspace.manage" AuditView Permission = "audit.view" ProjectCreate Permission = "project.create" ProjectConfigure Permission = "project.configure" AppsManage Permission = "apps.manage" ServicesManage Permission = "services.manage" ServersManage Permission = "servers.manage" SecretsManage Permission = "secrets.manage" SecretsRead Permission = "secrets.read" MembersInvite Permission = "members.invite" MembersManage Permission = "members.manage" OverridesUse Permission = "overrides.use" EnvUse Permission = "env.use" // ProductionDeploy chooses the version production runs (ADR-0020). ProductionDeploy Permission = "production.deploy" )
Permissions of docs/product/roles.md.
type Role ¶
type Role string
Role is a fixed bundle of permissions.
const ( Owner Role = "owner" // the workspace's one owner: everything; not given, not handed over Maintainer Role = "maintainer" // sets the team's environment up, invites and removes developers Developer Role = "developer" // sees the settings, works with environments through the CLI // Server is a server of the team (ADR-0019): it runs the projects it is given and // nothing else; it signs in with a device token, not as a person. Server Role = "server" )
type Subject ¶
type Subject struct {
// Role in the workspace; empty for a non-member.
Role Role
// Projects a server runs: in others it may do nothing. Unused for people.
Projects map[string]bool
}
Subject is a member as the check sees them.
func (Subject) Can ¶
func (s Subject) Can(p Permission, project string) bool
Can reports whether the subject may do p: in the workspace when project is empty, otherwise in that project. People's roles hold in every project.
func (Subject) CanInvite ¶
CanInvite checks an invite of a role: the owner invites maintainers and developers, a maintainer developers.
func (Subject) CanManage ¶
CanManage checks removing a member of a role: the owner removes anyone but themselves, a maintainer developers.
func (Subject) CanSetRole ¶
CanSetRole checks giving a member another role: the owner alone makes maintainers and developers of members.
func (Subject) In ¶
func (s Subject) In(project string) []Permission
In lists the permissions the subject has, sorted.
Source Files