Documentation
¶
Overview ¶
Package group is what groups of people (migration 00074, docs/GROUPS.md) do beyond storing rows: checking a group before it is stored, keeping the memberships an outside directory decides in step with it, and keeping each member's built-in level in step with the role their group gives them.
What a group REACHES is decided elsewhere: its folder grants by acl.UserGrants, its role by perm.EffectiveRole.
Index ¶
- Constants
- Variables
- func EffectiveRoles(ctx context.Context, store db.Store, users []*model.User) (map[int64]Via, error)
- func GivesAdmin(groups []*model.Group, providerID *int64) bool
- func GroupDirectory(g *model.Group) string
- func HoldingRole(ctx context.Context, store db.Store, roleID int64) ([]int64, error)
- func IsLDAPDN(v string) bool
- func LDAPValue(s string) string
- func LastAdmin(ctx context.Context, store db.Store, u *model.User) (bool, error)
- func MemberIDs(ctx context.Context, store db.Store, groupIDs ...int64) ([]int64, error)
- func Normalize(g *model.Group) error
- func SyncLevels(ctx context.Context, store db.Store, userIDs []int64) error
- func SyncLinked(ctx context.Context, store db.Store, u *model.User, kind string, ...) (bool, error)
- func SyncStored(ctx context.Context, store db.Store, users []*model.User) error
- type Via
Constants ¶
const ( MaxNameLen = 100 MaxDescriptionLen = 1000 // MaxLinks bounds how many outside groups one group names. MaxLinks = 50 // MaxPriority bounds a group's priority either way. MaxPriority = 1000 )
MaxNameLen bounds a group's name, MaxDescriptionLen its description.
Variables ¶
var ErrInvalid = errors.New("group: invalid")
ErrInvalid wraps every validation failure so callers can map it to a 400.
Functions ¶
func EffectiveRoles ¶
func EffectiveRoles(ctx context.Context, store db.Store, users []*model.User) (map[int64]Via, error)
EffectiveRoles maps every account with no custom role of its own, whose groups give it one, to that role — what the Roles and Users pages count and show. Administrators are left out: no role binds them.
func GivesAdmin ¶ added in v0.52.0
GivesAdmin reports whether one of these groups — the account's, of its tenant — makes its members administrators.
func GroupDirectory ¶ added in v0.52.0
GroupDirectory is the LDAP directory a group belongs to: the one whose sync brought it in, else the main directory.
func HoldingRole ¶
HoldingRole returns the ids of the groups that hold role roleID.
func IsLDAPDN ¶ added in v0.52.0
IsLDAPDN reports whether an LDAP link names a group by its DN rather than by its common name.
func LDAPValue ¶ added in v0.52.0
LDAPValue is the form an LDAP group's name is compared in, on both sides (a group's link, and the groups a directory sign-in reports): lower case, and a DN without the space around its commas, equals and plus signs — a directory is free to write "CN=Finance, OU=Groups" for what an administrator typed as "cn=finance,ou=groups". LDAP compares these names without case.
func LastAdmin ¶ added in v0.52.0
LastAdmin reports whether u is the only administrator of its tenant still switched on — taking it away would leave nobody to administer it. (An administrator of another tenant administers only that tenant.)
func Normalize ¶
Normalize validates g in place and canonicalizes what it can: trimmed name and description, trimmed and de-duplicated links. It does not check that the role exists or is in the group's tenant — that needs the store and is the handler's job.
func SyncLevels ¶
SyncLevels keeps each account's built-in level in step with the role its groups give it (perm.RoleHolder: User when the role can change or share anything, Viewer otherwise) — what giving a person a role on their own page does. Called after anything that can change which role a member gets through their groups: a membership, a group's role or priority, a role's permissions or switch.
The level an account had before a group's role first moved it is kept (user_group_levels) and put back when no group role applies any more — so leaving a read-only group gives back User, and leaving a group whose role made a Viewer account a User gives back Viewer, never the full built-in User role it never had.
An account with a role of its own is left alone (its own role set its level, and the kept level is dropped), and so is an administrator (bound by no role).
func SyncLinked ¶
func SyncLinked(ctx context.Context, store db.Store, u *model.User, kind string, values []string) (bool, error)
SyncLinked makes a person's memberships through one kind of link (kind, e.g. model.GroupLinkSSO) match the outside groups a sign-in says they are in (values, compared exactly — LDAP names in LDAPValue's form): they join every group of their tenant — and install-wide groups only if they are the supertenant's — that names one of those values, and leave every group they were in only through such a link that no longer does. A member added by hand stays whatever the directory says. It reports whether anything changed.
func SyncStored ¶ added in v0.52.0
SyncStored re-applies every account's directory-linked memberships from the groups its LAST sign-in carried — SSO's (user_sso_groups) and LDAP's (user_ldap_groups) — what a changed link on a group does at once, instead of waiting for each person to sign in again. users are the accounts to consider (the caller's tenant's); an account that never signed in through a directory has no stored groups and is only taken out of groups it was in through one, if any.
Source Files