Documentation
¶
Index ¶
- Variables
- type Grant
- type Grants
- type Payload
- func (t *Payload) AddDeny(resourceType string, grant Grant)
- func (t *Payload) DeniesFor(resourceType string) []Grant
- func (t *Payload) EvalFingerprint()
- func (t *Payload) Fingerprint() string
- func (t *Payload) GrantsFor(resourceType string) *Grants
- func (t Payload) JWTClaims() map[string]any
- func (t Payload) SetGlobalPostgresSessionRLS(db *gorm.DB) error
- func (t *Payload) SetGrants(resourceType string, grants *Grants)
- func (t Payload) SetPostgresSessionRLS(db *gorm.DB) error
Constants ¶
This section is empty.
Variables ¶
var GrantTypes = []string{"config", "component", "playbook", "canary", "check", "scraper", "view"}
GrantTypes are the resource types whose rows are filtered by grants.
Functions ¶
This section is empty.
Types ¶
type Grant ¶ added in v1.0.1390
type Grant struct {
// Scope grants the rows: the resource Scope of a Role rule, or a Scope a Permission names.
Scope string `json:"scope,omitempty"`
// Constraints narrow Scope: a row must be in every one of them, e.g. the resource Scope of a RoleBinding's
// constraint, or those of an access token's Roles. Empty when the grant isn't narrowed.
Constraints []string `json:"constraints,omitempty"`
}
Grant admits the rows of a resource type that are in all of its Scopes: Scope and every one of its Constraints. Each is a Scope id.
For example, a Role rule reading configs in Scope payments, bound with a constraint on Scope eu, for a request made with an access token whose Role reads Scope prod:
Grant{Scope: "<payments>", Constraints: []string{"<eu>", "<prod>"}} // configs in payments, eu and prod
type Grants ¶ added in v1.0.1390
type Grants struct {
// All admits every row of the type.
All bool
// Any admits a row that at least one grant admits.
Any []Grant
}
Grants are a subject's grants on one resource type: every row (All), or the rows at least one grant admits (Any). A type with no grants, or with neither, lists no rows.
They're marshalled into the claim as "all", or as the list of grants:
"all"
[{"scope": "<prod>"}, {"scope": "<payments>", "constraints": ["<eu>"]}] // rows in prod, or in both payments and eu
func (*Grants) Add ¶ added in v1.0.1390
Add adds a grant. A grant naming anything but Scope ids, or no Scope, is ignored: it admits nothing.
func (*Grants) Fingerprint ¶ added in v1.0.1390
Fingerprint identifies the grants.
func (Grants) MarshalJSON ¶ added in v1.0.1390
MarshalJSON writes the grants as the claim reads them: "all", or the list of grants.
func (*Grants) UnmarshalJSON ¶ added in v1.0.1390
type Payload ¶
type Payload struct {
Config *Grants `json:"config,omitempty"`
Component *Grants `json:"component,omitempty"`
Playbook *Grants `json:"playbook,omitempty"`
Canary *Grants `json:"canary,omitempty"`
Check *Grants `json:"check,omitempty"`
Scraper *Grants `json:"scraper,omitempty"`
View *Grants `json:"view,omitempty"`
// Scopes are the Scopes whose stamped rows of generated view tables the subject may read, through their
// __grants column. Permissions grant them; Role rules grant whole views through View instead.
Scopes []string `json:"scopes,omitempty"`
// Deny holds, by resource type, the grants of the rows the subject is denied: a row any of them admits isn't
// listed, whatever the type's grants admit. Deny RoleBindings produce them.
Deny map[string][]Grant `json:"deny,omitempty"`
Disable bool `json:"disable_rls,omitempty"`
// contains filtered or unexported fields
}
RLS Payload that's injected postgresl parameter `request.jwt.claims`
Each resource type carries the subject's grants on it (see Grants). A type without grants lists no rows.
func (*Payload) AddDeny ¶ added in v1.0.1414
AddDeny denies the rows of the type that the grant admits. A grant naming anything but Scope ids, or no Scope, is ignored. A type that isn't filtered by grants is ignored too.
func (*Payload) DeniesFor ¶ added in v1.0.1414
DeniesFor returns the deny grants of a resource type, e.g. "config".
func (*Payload) EvalFingerprint ¶
func (t *Payload) EvalFingerprint()
func (*Payload) Fingerprint ¶
func (*Payload) GrantsFor ¶ added in v1.0.1390
GrantsFor returns the grants of a resource type, e.g. "config". Nil when the type has none.
func (Payload) SetGlobalPostgresSessionRLS ¶ added in v1.0.819
Injects the payload as sessions parameter
Source Files