Documentation
¶
Overview ¶
Package rules checks and compiles a collection's rules (the `rules:` section of its collection.yaml): expr-lang expressions deciding, per operation, whether a caller may act on a whole document. Read rules also become backend-neutral storage filters. It knows nothing about HTTP or MongoDB.
Index ¶
Constants ¶
This section is empty.
Variables ¶
Ops lists the operations in a fixed order.
Functions ¶
This section is empty.
Types ¶
type Op ¶
type Op string
Op is an operation a rule can allow.
const ( Read Op = "read" Create Op = "create" Update Op = "update" Delete Op = "delete" // Restore and Purge are the operations of a collection that soft-deletes // (collection.yaml): restore decides who may read the deleted documents // and bring them back, purge who may remove them for good. Neither is // covered by `write`: they are denied unless declared. Restore Op = "restore" Purge Op = "purge" // Invoke is a function's invoke rule (function.yaml): it decides who // may call the function and sees only `user`. Invoke Op = "invoke" )
type Rule ¶
type Rule struct {
Op Op
Key string // the rules key it came from: the op, or "write"
Source string
// contains filtered or unexported fields
}
Rule is one compiled rule.
func CompileInvoke ¶
CompileInvoke compiles and checks a function's invoke rule. It may use `user` and hasRole with the realm's roles; there is no document.
type Schema ¶
type Schema struct {
// DocumentField reports whether a dot path exists on stored documents
// (schema fields plus id and _meta fields).
DocumentField func(path string) bool
// DataField reports whether a dot path exists in request bodies.
DataField func(path string) bool
// ScalarField reports whether a document path holds a single value:
// declared with types that don't include "array", and not reached
// through an array. Read rules may only compare such fields, because
// MongoDB compares arrays element by element.
ScalarField func(path string) bool
// ArrayField reports whether a document path is declared as an array
// (and not reached through another array), for `value in document.path`.
ArrayField func(path string) bool
// DateField reports whether a path is stored as a date (x-backd-store:
// date): its value is a time in rules, comparable with `now`. May be nil.
DateField func(path string) bool
// Roles are the role names declared in realm.yaml.
Roles []string
}
Schema describes what the rules of one collection may refer to.
type Set ¶
type Set struct {
File string
// contains filtered or unexported fields
}
Set is a collection's compiled rules. A nil rule denies the operation.