Documentation
¶
Overview ¶
Package rbac implements local control-plane identities, tenant isolation, role inheritance, and fail-closed permission evaluation.
Index ¶
- Constants
- Variables
- func AllPermissions() []string
- func HashPassword(password string) (string, error)
- func NewID(prefix string) string
- func VerifyPassword(hash, password string) bool
- type Principal
- type Service
- func (service *Service) Authenticate(ctx context.Context, tenantID, username, password string) (Principal, error)
- func (service *Service) Authorize(ctx context.Context, tenantID, userID, permission string) (Principal, error)
- func (service *Service) Bootstrap(ctx context.Context, username, password string) error
- func (service *Service) Principal(ctx context.Context, tenantID, userID string) (Principal, error)
- func (service *Service) ProvisionTenant(ctx context.Context, tenantID string) ([]model.Role, error)
Constants ¶
View Source
const ( DefaultTenantID = "tenant_default" BootstrapUserID = "user_bootstrap_admin" AdminRoleID = "role_default_admin" AuditorRoleID = "role_default_auditor" OperatorRoleID = "role_default_operator" ViewerRoleID = "role_default_viewer" PermissionDatasourceManage = "datasource.manage" PermissionStrategyManage = "strategy.manage" PermissionQueryExecute = "query.execute" PermissionAuditView = "audit.view" PermissionUserManage = "user.manage" PermissionRoleManage = "role.manage" PermissionTenantManage = "tenant.manage" )
Variables ¶
Functions ¶
func AllPermissions ¶
func AllPermissions() []string
func HashPassword ¶
HashPassword produces a bcrypt password hash suitable for persistence.
func VerifyPassword ¶
VerifyPassword compares a password with its bcrypt hash and rejects malformed hashes without exposing the underlying parser error.
Types ¶
type Principal ¶
type Principal struct {
UserID string
TenantID string
Username string
Permissions []string
RoleIDs []string
}
Principal is the authenticated, tenant-bound identity placed in a request.
func (Principal) IsBootstrapAdmin ¶
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service composes password verification and the persisted RBAC graph.
func NewService ¶
func NewService(repository *store.RBACRepository) *Service
func (*Service) Authenticate ¶
func (*Service) Bootstrap ¶
Bootstrap creates the default tenant, preset roles, and initial administrator exactly when missing. The password is accepted from the existing environment credential source and is persisted only as a bcrypt hash.
Source Files
Click to show internal directories.
Click to hide internal directories.