Documentation
¶
Overview ¶
Package rbac is the agent-side handler for RbacRequest frames sent by the admin server. The admin server has no access to the application's authorizer; it routes the UI's Access control reads to a connected agent over the existing bidi stream. The agent snapshots the Casbin roles and policies locally (read-only — the app's authorizer stays the single writer) and sends an RbacResponse back.
Construction is opt-in: pass a non-nil PolicySource (the framework's *authz.Enforcer satisfies it) in the agent's Config. When the source is nil, the Handler is disabled and the agent answers RbacRequests with a canned "rbac not enabled on this agent" error response.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler answers RbacRequest frames. Goroutine-safe: it holds no state beyond the source, and each Dispatch snapshot is independent.
func New ¶
func New(src PolicySource) *Handler
New constructs a Handler. Returns nil when src is nil (caller treats this as "RBAC disabled on this agent").
func (*Handler) Dispatch ¶
func (h *Handler) Dispatch(req *adminv1.RbacRequest) *adminv1.RbacResponse
Dispatch executes the snapshot and returns the response. The response always carries the same RequestId; on failure, Error is non-empty and the lists are empty. Dispatch never returns nil.
type PolicySource ¶
type PolicySource interface {
// GetPolicy returns the policy rows: {subject, object, action} with an
// optional fourth effect column ("allow"/"deny") depending on model.
GetPolicy() ([][]string, error)
// GetGroupingPolicy returns the grouping rows: {subject, role}.
GetGroupingPolicy() ([][]string, error)
// GetAllRoles returns every role that appears in a grouping rule.
GetAllRoles() ([]string, error)
}
PolicySource is the read-only slice of the framework's authorizer the handler needs. *authz.Enforcer (nucleus) satisfies it.
Source Files