Documentation
¶
Overview ¶
Package authzseed populates the RBAC engine's relation tuples out-of-band: pure constructors (single source of truth) + idempotent Backfill/BootstrapAdmins writers. Write-only; wiring tuples into decisions is Pass 2.
Index ¶
- func APIKeySubjectID(k models.APIKey) string
- func Backfill(ctx context.Context, store authz.Store, db *gorm.DB) error
- func BootstrapAdmins(ctx context.Context, store authz.Store, db *gorm.DB, emails []string, ...) error
- func CommonPoolViewerWildcard() authz.Tuple
- func DocumentEditor(docID uuid.UUID, subjectID string) authz.Tuple
- func DocumentTenantEdge(docID, tenantID uuid.UUID) authz.Tuple
- func DocumentViewer(docID uuid.UUID, subjectID string) authz.Tuple
- func SystemAdmin(subjectID string) authz.Tuple
- func TenantAdmin(tenantID uuid.UUID, subjectID string) authz.Tuple
- func TenantManager(tenantID uuid.UUID, subjectID string) authz.Tuple
- func TenantMember(tenantID uuid.UUID, subjectID string) authz.Tuple
- func TenantOwner(tenantID uuid.UUID, subjectID string) authz.Tuple
- func TenantSystemEdge(tenantID uuid.UUID) authz.Tuple
- func TenantViewer(tenantID uuid.UUID, subjectID string) authz.Tuple
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func APIKeySubjectID ¶
APIKeySubjectID resolves an API key's authz subject: explicit subject_id when set, else the tenant service principal. Mirrors the auth layer so backfill membership matches request-time subjects.
func Backfill ¶
Backfill derives the full tuple set from existing rows and writes it via store. Idempotent: re-running produces the same set. Reads use db, writes use store, so it can run inside the migration tx (pass authz.PostgresStore(tx), tx).
- each tenant -> system parent edge + svc:<tenant> membership
- each tenant_user -> membership (+ admin when role == admin, + owner when role == owner)
- admin tenant_user -> system#admin for its tenant's svc principal
- each document -> document#tenant parent edge
- each api_key -> its subject's membership
- common/bootstrap pool -> viewer@user:* wildcard (public read)
func BootstrapAdmins ¶
func BootstrapAdmins(ctx context.Context, store authz.Store, db *gorm.DB, emails []string, logger *slog.Logger) error
BootstrapAdmins seeds system:memory#admin for each email with a tenant_users row (verified email -> tenant_users.id); unknown emails are skipped, never invented. Also grants system#admin to every admin tenant's svc principal (operator API-key admin gap; see seedAdminServicePrincipals), independent of the allowlist. Idempotent. Pass the parsed ADMIN_ALLOWED_EMAILS list here.
func CommonPoolViewerWildcard ¶
CommonPoolViewerWildcard returns tenant:<bootstrap>#viewer@user:*, the public read grant on the common/bootstrap pool.
func DocumentEditor ¶
DocumentEditor returns document:<D>#editor@user:<subjectID>, a per-document guest write grant (also confers read via the editor⇒viewer rewrite).
func DocumentTenantEdge ¶
DocumentTenantEdge returns document:<D>#tenant@tenant:<T>, set at document create; routes document viewer/editor through the owning tenant's membership.
func DocumentViewer ¶
DocumentViewer returns document:<D>#viewer@user:<subjectID>, a per-document guest read grant.
func SystemAdmin ¶
SystemAdmin returns system:memory#admin@user:<subjectID>, the global-admin grant seeded from ADMIN_ALLOWED_EMAILS.
func TenantAdmin ¶
TenantAdmin returns tenant:<T>#admin@user:<subjectID>.
func TenantManager ¶
TenantManager returns tenant:<T>#manager@user:<subjectID>.
func TenantMember ¶
TenantMember returns tenant:<T>#member@user:<subjectID>.
func TenantOwner ¶
TenantOwner returns tenant:<T>#owner@user:<subjectID>, the personal-tenant owner grant. An owner folds up into manager (owner ⇒ manager) but not admin, so it confers full self-management without system-admin reach.
func TenantSystemEdge ¶
TenantSystemEdge returns tenant:<T>#system@system:memory, seeded at tenant create; lets global admins reach admin on every tenant via the "admin from system" rewrite.
Types ¶
This section is empty.
Source Files