Documentation
¶
Index ¶
- Constants
- func AuthVars(ctx context.Context) map[string]any
- func CtxWithPerm(ctx context.Context, perm *RolePermissions) context.Context
- type Op
- type Permission
- type PermissionFieldRule
- func (r *PermissionFieldRule) EnterArgument(_ *validator.WalkContext, _ *ast.ArgumentDefinition, _ *ast.Argument) gqlerror.List
- func (r *PermissionFieldRule) EnterDirective(_ *validator.WalkContext, _ *ast.Definition, _ *ast.Directive) gqlerror.List
- func (r *PermissionFieldRule) EnterField(ctx *validator.WalkContext, parentDef *ast.Definition, field *ast.Field) gqlerror.List
- func (r *PermissionFieldRule) EnterFragment(_ *validator.WalkContext, _ *ast.Definition, _ ast.Selection) gqlerror.List
- type RolePermissions
- func (r *RolePermissions) CheckMutationInput(ctx context.Context, defs base.DefinitionsSource, inputName string, ...) error
- func (r *RolePermissions) CheckQuery(query *ast.Field) error
- func (r *RolePermissions) DataArgument(ctx context.Context, object, field string) map[string]any
- func (r *RolePermissions) DataObjectData(ctx context.Context, objType string, op Op) map[string]any
- func (r *RolePermissions) DataObjectDisabled(objType string, op Op) bool
- func (r *RolePermissions) DataObjectFilter(ctx context.Context, objType string, op Op) map[string]any
- func (r *RolePermissions) DataObjectHidden(objType string) bool
- func (r *RolePermissions) Enabled(object, field string) (*Permission, bool)
- func (r *RolePermissions) FilterArgument(ctx context.Context, object, field string) map[string]any
- func (r *RolePermissions) Visible(object, field string) (*Permission, bool)
- type Service
- type Store
Constants ¶
const DataObjectTypePrefix = "data-object:"
DataObjectTypePrefix marks permission rows that carry table-level rules. Such rows use a synthetic type_name ("data-object:query", "data-object:insert", "data-object:update", "data-object:delete") and put the data-object's GraphQL type name (or "*" for all data objects) in field_name. The ":" makes collision with real GraphQL type names impossible, so field-level rows are unaffected.
Variables ¶
This section is empty.
Functions ¶
func CtxWithPerm ¶
func CtxWithPerm(ctx context.Context, perm *RolePermissions) context.Context
Types ¶
type Op ¶ added in v0.3.39
type Op string
Op is a data-object operation for table-level permission lookups.
type Permission ¶
type PermissionFieldRule ¶ added in v0.3.0
type PermissionFieldRule struct{}
PermissionFieldRule is an InlineRule that checks field access permissions using RolePermissions from the context.
func (*PermissionFieldRule) EnterArgument ¶ added in v0.3.0
func (r *PermissionFieldRule) EnterArgument(_ *validator.WalkContext, _ *ast.ArgumentDefinition, _ *ast.Argument) gqlerror.List
func (*PermissionFieldRule) EnterDirective ¶ added in v0.3.0
func (r *PermissionFieldRule) EnterDirective(_ *validator.WalkContext, _ *ast.Definition, _ *ast.Directive) gqlerror.List
func (*PermissionFieldRule) EnterField ¶ added in v0.3.0
func (r *PermissionFieldRule) EnterField(ctx *validator.WalkContext, parentDef *ast.Definition, field *ast.Field) gqlerror.List
func (*PermissionFieldRule) EnterFragment ¶ added in v0.3.0
func (r *PermissionFieldRule) EnterFragment(_ *validator.WalkContext, _ *ast.Definition, _ ast.Selection) gqlerror.List
type RolePermissions ¶
type RolePermissions struct {
Name string `json:"name"`
Disabled bool `json:"disabled"`
CanImpersonate bool `json:"can_impersonate"`
Permissions []Permission `json:"permissions"`
}
func PermissionsFromCtx ¶
func PermissionsFromCtx(ctx context.Context) *RolePermissions
func (*RolePermissions) CheckMutationInput ¶
func (r *RolePermissions) CheckMutationInput(ctx context.Context, defs base.DefinitionsSource, inputName string, data map[string]any) error
func (*RolePermissions) CheckQuery ¶
func (r *RolePermissions) CheckQuery(query *ast.Field) error
func (*RolePermissions) DataArgument ¶
func (*RolePermissions) DataObjectData ¶ added in v0.3.39
DataObjectData returns the table-level data values for insert/update mutations, with [$auth.*] placeholders substituted. These values are applied over the client's data (force-stamp): a data-object:insert row with {owner_id: "[$auth.user_id]"} makes it impossible to insert rows for another principal regardless of the submitted data.
func (*RolePermissions) DataObjectDisabled ¶ added in v0.3.39
func (r *RolePermissions) DataObjectDisabled(objType string, op Op) bool
DataObjectDisabled reports whether the operation on the data object is denied. A disabled data-object:query row denies the table on EVERY path (reads and mutations alike); op-specific rows can additionally deny a single operation.
func (*RolePermissions) DataObjectFilter ¶ added in v0.3.39
func (r *RolePermissions) DataObjectFilter(ctx context.Context, objType string, op Op) map[string]any
DataObjectFilter returns the table-level filter for the data object, with [$auth.*] placeholders substituted. The filter is a property of the TABLE: the planner applies it wherever the object is materialised — top-level queries, _by_pk, relations, _join, aggregations, and mutation WHERE clauses. For OpDelete/OpUpdate the op-specific row's filter takes precedence; when it is absent the OpQuery filter applies (you cannot delete/update rows you cannot read, unless an op row explicitly widens or narrows the scope).
func (*RolePermissions) DataObjectHidden ¶ added in v0.3.39
func (r *RolePermissions) DataObjectHidden(objType string) bool
DataObjectHidden reports whether the data object is hidden from introspection (set on the data-object:query row). Fields returning a hidden data object are omitted from the introspected schema but remain queryable unless also disabled.
func (*RolePermissions) Enabled ¶
func (r *RolePermissions) Enabled(object, field string) (*Permission, bool)
func (*RolePermissions) FilterArgument ¶
func (*RolePermissions) Visible ¶
func (r *RolePermissions) Visible(object, field string) (*Permission, bool)
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func (*Service) ContextWithPermissions ¶
func (*Service) RolePermissions ¶
func (s *Service) RolePermissions(ctx context.Context) (RolePermissions, error)
type Store ¶
type Store interface {
// ContextWithPermissions returns a new context with the permissions of the user.
ContextWithPermissions(ctx context.Context) (context.Context, error)
RolePermissions(ctx context.Context) (RolePermissions, error)
}
Store manager that provides methods to to retrieve Role permissions info from context.
Source Files