Documentation
¶
Overview ¶
Package rolestore is the statedb-backed authz.RuntimeSource: the layer of role bindings an operator writes during an incident, as opposed to the layer deployed in .cloop/config.yaml (Task 20248).
It is the same split as pkg/sessionstore and pkg/quotastore. pkg/authz owns the model and the precedence rule and stays stdlib-only; this package owns storage, the translation between a table row and a binding, and the caching that makes reading it on every authorization decision affordable.
Why it is cached rather than loaded once ¶
The configured bindings are read once at startup because configuration does not change under a running process. Runtime bindings are the opposite: their entire purpose is to change while the hub serves, from a shell, without a restart — "demote this account, now". So they are re-read on a short TTL and a write converges within it.
The TTL is also the propagation bound an operator is entitled to know, and it is deliberately shorter than the 30 seconds pkg/oidcauth already accepts for session revocation: the two are used together during a compromise, and the demotion should not be the slower half.
Failure policy ¶
A read that fails returns the last good answer, never an empty one. Bindings here only ever remove or redirect authority that config already granted, so "the database is briefly unreachable" must not be a path back to admin. The first load happens eagerly in New and its failure is fatal to hub startup, which keeps the degraded case ("serving from a stale list") strictly bounded by a case that was known-good once.
Index ¶
Constants ¶
const DefaultTTL = 10 * time.Second
DefaultTTL bounds how long a runtime binding write takes to reach a running hub's authorization decisions.
Variables ¶
This section is empty.
Functions ¶
func BindingFrom ¶
func BindingFrom(row statedb.RoleBindingRow) (authz.Binding, error)
BindingFrom translates a stored row into the binding the resolver evaluates.
The single translation point for both readers: the resolver's cache above and the `cloop hub role` CLI. A second copy would be a second chance for what an operator is shown to differ from what is enforced.
Types ¶
type Option ¶
type Option func(*Store)
Option configures a Store.
func WithErrorHandler ¶
WithErrorHandler installs a sink for failed refreshes.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store reads runtime role bindings and caches them for TTL.
func New ¶
New adapts a control-plane database and performs the first load.
Which database matters, and it is the same rule as sessions and API tokens: runtime bindings belong in the *hub's* own state, never a managed project's. A tenant able to write the file holding this table could grant itself admin across the fleet with one INSERT.
func (*Store) Invalidate ¶ added in v0.0.5
func (s *Store) Invalidate()
Invalidate makes the next RuntimeBindings read the table rather than the cache (Task 20412). For the moments a binding written a second ago must already hold: minting a credential, and the offboarding that just wrote a deny on this hub.
func (*Store) RuntimeBindings ¶
RuntimeBindings implements authz.RuntimeSource.
Source Files