Documentation
¶
Overview ¶
Package rbac defines roles and permissions for the auth module.
A permission is a specific action named "resource:action", such as "invoices:create". A role is a named set of permissions. Roles live in Go code, not the database, so every change to who can do what goes through code review. Code checks permissions, never role names, so roles can change without hunting through handlers.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Permission ¶
type Permission string
Permission is an action, named "resource:action": lowercase letters, digits, and underscores on each side of the colon.
const All Permission = "*"
All grants every permission. Give it only to roles such as an organization's owner.
type Roles ¶
type Roles map[string][]Permission
Roles maps role names to the permissions they grant. Role names are lowercase letters, digits, and underscores, starting with a letter.
func (Roles) Has ¶
func (r Roles) Has(role string, p Permission) bool
Has reports whether role grants p. An unknown role grants nothing.
func (Roles) Mentions ¶
func (r Roles) Mentions(p Permission) bool
Mentions reports whether any role lists p by name. All doesn't count: it's used to catch permissions that are misspelled where they're required, which a role with All would otherwise hide.
Source Files