Documentation
¶
Overview ¶
Package systemadmin owns who holds a deployment-scoped role.
A system grant is the only authority in this system that is not scoped to a space, so both edges that change one are worth recording and neither may invent its own rules about it. What differs between them is authority, not procedure: the shell reached the machine and its database credentials, the route carries a session and an existing grant.
Index ¶
- Variables
- type Service
- func (s *Service) Grant(ctx context.Context, userID, role string, actor coreaudit.Actor) (*coreidentity.SystemGrant, error)
- func (s *Service) RemainingHolders(ctx context.Context, role string) (int, error)
- func (s *Service) Revoke(ctx context.Context, userID, role string, actor coreaudit.Actor) error
Constants ¶
This section is empty.
Variables ¶
var ( // ErrAccountNotFound means no account has that id. ErrAccountNotFound = apierr.New(apierr.KindNotFound, "account not found") // ErrAlreadyHeld means the account already holds the role. ErrAlreadyHeld = apierr.New(apierr.KindConflict, "the account already holds this role") // ErrNotHeld means the account does not hold the role, so there is nothing // to revoke. Revoking is otherwise idempotent. ErrNotHeld = apierr.New(apierr.KindNotFound, "the account does not hold this role") // ErrUnknownRole means the role is not one this deployment implements. ErrUnknownRole = apierr.New(apierr.KindInvalid, "unknown system role") // ErrAccountDisabled means the target account is disabled. A grant on it // could not authorize a request, so it is refused with an actionable // conflict rather than stored as dormant authority an operator cannot see. ErrAccountDisabled = apierr.New(apierr.KindConflict, "the account is disabled; enable it before granting a role") // ErrLastHolder means revoking would leave the deployment with nobody in // the role. Only the shell may do that, because only the shell can undo it. ErrLastHolder = apierr.New(apierr.KindConflict, "this is the deployment's last holder of the role") )
Refusals a caller can act on. Everything else is a failure, not an answer.
Functions ¶
This section is empty.
Types ¶
type Service ¶
type Service struct {
Grants coreidentity.SystemGrantStore
Users coreidentity.UserStore
Audit *audit.Recorder
}
Service grants and revokes deployment-scoped roles.
func (*Service) Grant ¶
func (s *Service) Grant(ctx context.Context, userID, role string, actor coreaudit.Actor) (*coreidentity.SystemGrant, error)
Grant gives an account a system role.
func (*Service) RemainingHolders ¶
RemainingHolders reports how many accounts still hold the role. The shell uses it to say what it just did; nothing decides anything with it.
func (*Service) Revoke ¶
Revoke takes a system role away.
Leaving the deployment with nobody in the role is refused for a signed-in caller and permitted from the shell. That is not a convenience: the HTTP route is reached through the very grant it would be removing, so a caller who took the last one would lock the deployment out of its own admin area with no way back through the same door. The shell is the way back, which is why it may do it -- and why the caller decides nothing here. The authority does.
Source Files