Documentation
¶
Overview ¶
Package policy enforces authorization and action risk.
Package policy enforces RBAC (role → allowed permission/risk) plus per-connection ownership/sharing grants, using embedded Casbin. Risk levels come from route metadata — never client-supplied.
Index ¶
- Variables
- type AccessInput
- type Enforcer
- func (en *Enforcer) AddRolePermissionPolicy(role models.Role, permission string, risk plugin.RiskLevel) error
- func (en *Enforcer) AddRolePolicy(role models.Role, risk plugin.RiskLevel) error
- func (en *Enforcer) Authorize(in AccessInput) error
- func (en *Enforcer) LoadStorePolicies(ctx context.Context, policies store.PolicyStore) error
Constants ¶
This section is empty.
Variables ¶
var ErrForbidden = errors.New("policy: forbidden")
ErrForbidden is the deny-by-default authorization failure.
Functions ¶
This section is empty.
Types ¶
type AccessInput ¶
type AccessInput struct {
User models.User
Permission string
Risk plugin.RiskLevel
// Connection context. ConnectionID == "" means a non-connection route (e.g.
// the plugin catalog), which only needs the role/risk gate.
ConnectionID string
OwnerID string
HasGrant bool
GrantAccess models.Access
}
AccessInput is everything an authorization decision needs. The caller (the route wrapper) resolves the connection + the user's grant before calling.
type Enforcer ¶
type Enforcer struct {
// contains filtered or unexported fields
}
Enforcer answers authorization decisions. It is safe for concurrent use.
func (*Enforcer) AddRolePermissionPolicy ¶
func (en *Enforcer) AddRolePermissionPolicy(role models.Role, permission string, risk plugin.RiskLevel) error
AddRolePermissionPolicy grants a role a route permission/risk pair.
func (*Enforcer) AddRolePolicy ¶
AddRolePolicy grants a role an additional risk level (extensibility hook).
func (*Enforcer) Authorize ¶
func (en *Enforcer) Authorize(in AccessInput) error
Authorize applies the route gate and, for shared connections, the grant tier. Owners are constrained by their role. Grantees are constrained by the grant they received, while still needing an active account with at least one role.
Admin is a user-management role, not a super-user: it grants no implicit access to other users' connections.
func (*Enforcer) LoadStorePolicies ¶
LoadStorePolicies loads additive policy rows from the control-plane store.
Source Files