rules

package
v0.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 8, 2026 License: MIT Imports: 12 Imported by: 0

Documentation

Overview

Package rules checks and compiles a collection's rules (the `rules:` section of its collection.yaml): expr-lang expressions deciding, per operation, whether a caller may act on a whole document. Read rules also become backend-neutral storage filters. It knows nothing about HTTP or MongoDB.

Index

Constants

This section is empty.

Variables

Ops lists the operations in a fixed order.

Functions

This section is empty.

Types

type Op

type Op string

Op is an operation a rule can allow.

const (
	Read   Op = "read"
	Create Op = "create"
	Update Op = "update"
	Delete Op = "delete"
	// Restore and Purge are the operations of a collection that soft-deletes
	// (collection.yaml): restore decides who may read the deleted documents
	// and bring them back, purge who may remove them for good. Neither is
	// covered by `write`: they are denied unless declared.
	Restore Op = "restore"
	Purge   Op = "purge"
	// Invoke is a function's invoke rule (function.yaml): it decides who
	// may call the function and sees only `user`.
	Invoke Op = "invoke"
)

type Rule

type Rule struct {
	Op     Op
	Key    string // the rules key it came from: the op, or "write"
	Source string
	// contains filtered or unexported fields
}

Rule is one compiled rule.

func CompileInvoke

func CompileInvoke(src string, roles []string) (*Rule, error)

CompileInvoke compiles and checks a function's invoke rule. It may use `user` and hasRole with the realm's roles; there is no document.

func (*Rule) Allow

func (r *Rule) Allow(v Values) (bool, error)

Allow evaluates the rule. An evaluation error (for example comparing values of different types) is returned, and must be treated as a denial.

func (*Rule) Filter

func (r *Rule) Filter(v Values) (storage.Filter, error)

Filter turns a read rule into a storage filter for the given caller. The result is simplified: Const(true) allows every document, Const(false) none, whatever they contain.

type Schema

type Schema struct {
	// DocumentField reports whether a dot path exists on stored documents
	// (schema fields plus id and _meta fields).
	DocumentField func(path string) bool
	// DataField reports whether a dot path exists in request bodies.
	DataField func(path string) bool
	// ScalarField reports whether a document path holds a single value:
	// declared with types that don't include "array", and not reached
	// through an array. Read rules may only compare such fields, because
	// MongoDB compares arrays element by element.
	ScalarField func(path string) bool
	// ArrayField reports whether a document path is declared as an array
	// (and not reached through another array), for `value in document.path`.
	ArrayField func(path string) bool
	// DateField reports whether a path is stored as a date (x-backd-store:
	// date): its value is a time in rules, comparable with `now`. May be nil.
	DateField func(path string) bool
	// Roles are the role names declared in realm.yaml.
	Roles []string
}

Schema describes what the rules of one collection may refer to.

type Set

type Set struct {
	File string
	// contains filtered or unexported fields
}

Set is a collection's compiled rules. A nil rule denies the operation.

func Parse

func Parse(doc map[string]string, schema Schema) (*Set, []error)

Parse compiles and checks the `rules:` section of a collection's collection.yaml: a mapping of operation (read, create, update, delete, restore, purge, or write for the three that change a document) to an expression.

func (*Set) For

func (s *Set) For(op Op) *Rule

For returns the rule of op, or nil if none allows it.

type User

type User struct {
	ID            string   `expr:"id"`
	Email         string   `expr:"email"`
	EmailVerified bool     `expr:"email_verified"`
	Roles         []string `expr:"roles"`
}

User is the signed-in user as rules see it; nil for anonymous callers.

type Values

type Values struct {
	User     *User          // nil for anonymous callers
	Document map[string]any // stored document (read, update, delete)
	Data     map[string]any // incoming document (create, update)
	Now      time.Time
}

Values are what a rule is evaluated with.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL