Documentation
¶
Index ¶
- Constants
- func AuthVars(ctx context.Context) map[string]any
- func CtxWithPerm(ctx context.Context, perm *RolePermissions) context.Context
- type Op
- type Permission
- type PermissionFieldRule
- func (r *PermissionFieldRule) EnterArgument(_ *validator.WalkContext, _ *ast.ArgumentDefinition, _ *ast.Argument) gqlerror.List
- func (r *PermissionFieldRule) EnterDirective(_ *validator.WalkContext, _ *ast.Definition, _ *ast.Directive) gqlerror.List
- func (r *PermissionFieldRule) EnterField(ctx *validator.WalkContext, parentDef *ast.Definition, field *ast.Field) gqlerror.List
- func (r *PermissionFieldRule) EnterFragment(_ *validator.WalkContext, _ *ast.Definition, _ ast.Selection) gqlerror.List
- type RolePermissions
- func (r *RolePermissions) CheckMutationInput(ctx context.Context, defs base.DefinitionsSource, inputName string, ...) error
- func (r *RolePermissions) CheckQuery(query *ast.Field) error
- func (r *RolePermissions) DataArgument(ctx context.Context, object, field string) map[string]any
- func (r *RolePermissions) DataObjectData(ctx context.Context, objType string, op Op) map[string]any
- func (r *RolePermissions) DataObjectDisabled(objType string, op Op) bool
- func (r *RolePermissions) DataObjectFilter(ctx context.Context, objType string, op Op) map[string]any
- func (r *RolePermissions) DataObjectHidden(objType string) bool
- func (r *RolePermissions) Enabled(object, field string) (*Permission, bool)
- func (r *RolePermissions) FilterArgument(ctx context.Context, object, field string) map[string]any
- func (r *RolePermissions) Visible(object, field string) (*Permission, bool)
- type Service
- type Store
Constants ¶
const DataObjectTypePrefix = "data-object:"
DataObjectTypePrefix marks permission rows that carry table-level rules. Such rows use a synthetic type_name ("data-object:query", "data-object:insert", "data-object:update", "data-object:delete") and put the data-object's GraphQL type name (or "*" for all data objects) in field_name. The ":" makes collision with real GraphQL type names impossible, so field-level rows are unaffected.
Variables ¶
This section is empty.
Functions ¶
func CtxWithPerm ¶
func CtxWithPerm(ctx context.Context, perm *RolePermissions) context.Context
Types ¶
type Op ¶ added in v0.3.39
type Op string
Op is a data-object operation for table-level permission lookups.
type Permission ¶
type PermissionFieldRule ¶ added in v0.3.0
type PermissionFieldRule struct{}
PermissionFieldRule is an InlineRule that checks field access permissions using RolePermissions from the context.
func (*PermissionFieldRule) EnterArgument ¶ added in v0.3.0
func (r *PermissionFieldRule) EnterArgument(_ *validator.WalkContext, _ *ast.ArgumentDefinition, _ *ast.Argument) gqlerror.List
func (*PermissionFieldRule) EnterDirective ¶ added in v0.3.0
func (r *PermissionFieldRule) EnterDirective(_ *validator.WalkContext, _ *ast.Definition, _ *ast.Directive) gqlerror.List
func (*PermissionFieldRule) EnterField ¶ added in v0.3.0
func (r *PermissionFieldRule) EnterField(ctx *validator.WalkContext, parentDef *ast.Definition, field *ast.Field) gqlerror.List
func (*PermissionFieldRule) EnterFragment ¶ added in v0.3.0
func (r *PermissionFieldRule) EnterFragment(_ *validator.WalkContext, _ *ast.Definition, _ ast.Selection) gqlerror.List
type RolePermissions ¶
type RolePermissions struct {
Name string `json:"name"`
Disabled bool `json:"disabled"`
CanImpersonate bool `json:"can_impersonate"`
Permissions []Permission `json:"permissions"`
}
func PermissionsFromCtx ¶
func PermissionsFromCtx(ctx context.Context) *RolePermissions
PermissionsFromCtx returns the permissions to enforce for this context.
Full access answers the same way Service.RolePermissions does, and it wins over whatever the context already carries: an internal read that elevates runs on a context the endpoint middleware has already stamped with the caller's role, and the caller's rules must not follow it there. The validation rule short-circuits on the flag itself; the planner and the introspection resolvers come through here, so this is where the two agree.
Two consequences, since this is the process-wide answer and not an MCP-local one: the auth UDFs (core_auth_my_permissions, core_auth_check_access) report admin when they run inside an elevated read rather than the role the context was stamped with, and an elevated read no longer carries the caller's row filters or data defaults. Both follow from "full access means admin", which is what the flag has always meant to Service.RolePermissions — only the planner disagreed. Every elevation site is internal (cluster, cache, catalog and data-source maintenance, role loading, MCP's ranking read); none of them runs a query the caller supplied.
func (*RolePermissions) CheckMutationInput ¶
func (r *RolePermissions) CheckMutationInput(ctx context.Context, defs base.DefinitionsSource, inputName string, data map[string]any) error
func (*RolePermissions) CheckQuery ¶
func (r *RolePermissions) CheckQuery(query *ast.Field) error
func (*RolePermissions) DataArgument ¶
func (*RolePermissions) DataObjectData ¶ added in v0.3.39
DataObjectData returns the table-level data values for insert/update mutations, with [$auth.*] placeholders substituted. These values are applied over the client's data (force-stamp): a data-object:insert row with {owner_id: "[$auth.user_id]"} makes it impossible to insert rows for another principal regardless of the submitted data.
func (*RolePermissions) DataObjectDisabled ¶ added in v0.3.39
func (r *RolePermissions) DataObjectDisabled(objType string, op Op) bool
DataObjectDisabled reports whether the operation on the data object is denied. A disabled data-object:query row denies the table on EVERY path (reads and mutations alike); op-specific rows can additionally deny a single operation.
func (*RolePermissions) DataObjectFilter ¶ added in v0.3.39
func (r *RolePermissions) DataObjectFilter(ctx context.Context, objType string, op Op) map[string]any
DataObjectFilter returns the table-level filter for the data object, with [$auth.*] placeholders substituted. The filter is a property of the TABLE: the planner applies it wherever the object is materialised — top-level queries, _by_pk, relations, _join, aggregations, and mutation WHERE clauses. For OpDelete/OpUpdate the op-specific row's filter takes precedence; when it is absent the OpQuery filter applies (you cannot delete/update rows you cannot read, unless an op row explicitly widens or narrows the scope).
func (*RolePermissions) DataObjectHidden ¶ added in v0.3.39
func (r *RolePermissions) DataObjectHidden(objType string) bool
DataObjectHidden reports whether the data object is hidden from introspection (set on the data-object:query row). Fields returning a hidden data object are omitted from the introspected schema but remain queryable unless also disabled.
func (*RolePermissions) Enabled ¶
func (r *RolePermissions) Enabled(object, field string) (*Permission, bool)
func (*RolePermissions) FilterArgument ¶
func (*RolePermissions) Visible ¶
func (r *RolePermissions) Visible(object, field string) (*Permission, bool)
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func (*Service) ContextWithPermissions ¶
func (*Service) RolePermissions ¶
func (s *Service) RolePermissions(ctx context.Context) (RolePermissions, error)
type Store ¶
type Store interface {
// ContextWithPermissions returns a new context with the permissions of the user.
ContextWithPermissions(ctx context.Context) (context.Context, error)
RolePermissions(ctx context.Context) (RolePermissions, error)
}
Store manager that provides methods to to retrieve Role permissions info from context.
Source Files