Help us shape the future of Go! Take the 2026 Go Developer Survey

rbac

package
v1.0.1403 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 14, 2026 License: Apache-2.0 Imports: 24 Imported by: 11

Documentation

Index

Constants

View Source 
const MaxSubjectAccessReviewSubjects = 500

Variables

View Source 
var ActionContract func(action string) (resources, targets []string, ok bool)

ActionContract returns the resource types an action accepts as its primary resource and as a target. ok is false for an action without a contract. Mission Control sets it; without it, no request fits.

View Source 
var DefaultModel string

Functions

func AddCustomFunctions added in v1.0.840 

func AddCustomFunctions(enforcer addableEnforcer)

func AddRoleForUser 

func AddRoleForUser(user string, role ...string) error

func Check 

func Check(ctx context.Context, subject, object, action string) bool

func CheckContext added in v1.0.841 

func CheckContext(ctx context.Context, object, action string) bool

func DeleteAllRolesForUser 

func DeleteAllRolesForUser(user string) error

func DeleteRole 

func DeleteRole(role string) (bool, error)

func DeleteRoleForUser 

func DeleteRoleForUser(user string, role string) error

func Enforcer 

func Enforcer() *casbin.SyncedCachedEnforcer

func GetActionFromHttpMethod 

func GetActionFromHttpMethod(method string) string

func GetObjectByTable 

func GetObjectByTable(resource string) string

func HasImplicitGrants added in v1.0.1387 

func HasImplicitGrants(subject string) bool

HasImplicitGrants reports whether the subject is granted the "everyone" role and, in CheckContext, the viewer role on top of what it was explicitly granted.

Role bindings and federated identities have no implicit grants. A binding must not join "everyone", or every member of the binding would inherit "everyone" through it.

func HasPermission added in v1.0.841 

func HasPermission(ctx context.Context, subject string, attr *models.ABACAttribute, action string) bool

func Init 

func Init(ctx context.Context, superUserIDs []string, adapters ...Adapter) error

func LimitToScopes added in v1.0.1392 

func LimitToScopes(ctx context.Context, scopeIDs []string) context.Context

LimitToScopes returns a context whose resource checks (HasPermission) allow only resources in at least one of the Scopes, on top of what the subject's rules allow. It's the check side of rls.Grants.Limit, which limits listings. Limits add up: a context limited twice allows only resources in a Scope of each. A limit naming no Scope allows no resource.

func MembershipRefs added in v1.0.1390 

func MembershipRefs(attrs ...*models.ABACAttribute) []membership.Ref

MembershipRefs returns the resources of a request whose Scope membership is stored, for reading an operation's snapshot (membership.ForOperation).

func PermsForUser 

func PermsForUser(user string) ([]policy.Permission, error)

func ReloadPolicy 

func ReloadPolicy() error

func RolesForUser 

func RolesForUser(user string) ([]string, error)

func RuleCondition added in v1.0.1387 

func RuleCondition(resourceScopes, targetScopes []string) (string, error)

RuleCondition returns the Casbin condition of a Role rule, over the request's Membership.

It holds when the request fits the action, its primary resource is in every one of resourceScopes, and its target is in every one of targetScopes, or there's no target when targetScopes is empty.

func ScopeCondition added in v1.0.1390 

func ScopeCondition(resourceType, scopeID string) (string, error)

ScopeCondition returns the Casbin condition of a Permission that names a Scope, for the Scope's resources of one type: the request has a resource of the type, and it's in the Scope.

func ScopeLimits added in v1.0.1392 

func ScopeLimits(ctx context.Context) [][]string

ScopeLimits returns the limits of the context, oldest first. Nil when it isn't limited.

func ScopeRef added in v1.0.1058 

func ScopeRef(scopeID string) string

ScopeRef is how a Scope appears in a request's membership lists and in Casbin conditions.

func Stop 

func Stop()

Types

type Adapter added in v1.0.840 

type Adapter func(ctx context.Context, main *gormadapter.Adapter) persist.Adapter

type NamespacedNameIDSelector added in v1.0.1074 

type NamespacedNameIDSelector struct {
	ID        string `json:"id,omitempty"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name,omitempty"`
}

type Selectors added in v1.0.840 

type Selectors struct {
	Playbooks   []types.ResourceSelector `json:"playbooks,omitempty"`
	Connections []types.ResourceSelector `json:"connections,omitempty"`
	Configs     []types.ResourceSelector `json:"configs,omitempty"`
	Components  []types.ResourceSelector `json:"components,omitempty"`
	Views       []ViewRef                `json:"views,omitempty"`
}

Selectors represents the object_selector from a permission and specifies resource selectors for multiple resource types used in ABAC authorization.

For authorization to succeed, all specified resource type selectors must match the corresponding resources in the ABACAttribute. If a selector is specified for a resource type but the attribute lacks that resource, authorization fails. If an attribute provides a resource but no selector exists for that type, the permission is considered non-restrictive for that resource (authorized).

type SubjectAccessReviewRequest added in v1.0.1305 

type SubjectAccessReviewRequest struct {
	Resource SubjectAccessReviewResource `json:"resource"`
	Action   string                      `json:"action"`

	// Supports ["*"], in which case we iterate over all permission subjects in the database.
	Subjects []string `json:"subjects"`
}

func (SubjectAccessReviewRequest) Validate added in v1.0.1305 

func (req SubjectAccessReviewRequest) Validate(ctx context.Context) error

type SubjectAccessReviewResource added in v1.0.1305 

type SubjectAccessReviewResource struct {
	Playbook   string `json:"playbook,omitempty"`
	Config     string `json:"config,omitempty"`
	Check      string `json:"check,omitempty"`
	View       string `json:"view,omitempty"`
	Connection string `json:"connection,omitempty"`
	Global     string `json:"global,omitempty"`
}

type SubjectAccessReviewResult added in v1.0.1305 

type SubjectAccessReviewResult struct {
	Subject string `json:"subject"`
	Allowed bool   `json:"allowed"`
	Error   string `json:"error,omitempty"`
}

func RunSubjectAccessReview added in v1.0.1305 

func RunSubjectAccessReview(ctx context.Context, req SubjectAccessReviewRequest) ([]SubjectAccessReviewResult, error)

RunSubjectAccessReview checks what each subject may do on the resource, by the subject's own access alone: the requester's Scope limits (LimitToScopes) don't apply to it.

type SubjectAccessSearchRequest added in v1.0.1305 

type SubjectAccessSearchRequest struct {
	Subject       string   `json:"subject"`
	Action        string   `json:"action"`
	ResourceTypes []string `json:"resource_types,omitempty"`
}

func (*SubjectAccessSearchRequest) Validate added in v1.0.1305 

func (req *SubjectAccessSearchRequest) Validate() error

type SubjectAccessSearchResponse added in v1.0.1305 

type SubjectAccessSearchResponse struct {
	Subject       string                      `json:"subject"`
	Action        string                      `json:"action"`
	ResourceTypes []string                    `json:"resource_types"`
	Total         int                         `json:"total"`
	Results       []SubjectAccessSearchResult `json:"results"`
}

func RunSubjectAccessSearch added in v1.0.1305 

func RunSubjectAccessSearch(ctx context.Context, req SubjectAccessSearchRequest) (SubjectAccessSearchResponse, error)

type SubjectAccessSearchResult added in v1.0.1305 

type SubjectAccessSearchResult struct {
	ResourceType string `json:"resource_type"`
	ID           string `json:"id"`
}

type ViewRef added in v1.0.1074 

type ViewRef NamespacedNameIDSelector

Source Files

View all Source files

Directories

Path Synopsis
Package membership stores which Scopes each resource belongs to.
 Package membership stores which Scopes each resource belongs to.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.