auth

type AuthorizationCache ¶

type AuthorizationCache struct {
	// contains filtered or unexported fields
}

AuthorizationCache maintains a cache on the set of workspaces a user or group can access.

func NewAuthorizationCache(
	workspaceLister workspacelisters.WorkspaceLister,
	workspaceLastSyncResourceVersioner LastSyncResourceVersioner,
	reviewer Reviewer,
	informers rbacv1informers.Interface,
) *AuthorizationCache

func (ac *AuthorizationCache) GetClusterRoleLister() SyncedClusterRoleLister

func (ac *AuthorizationCache) List(userInfo user.Info, selector labels.Selector) (*workspaceapi.WorkspaceList, error)

func (ac *AuthorizationCache) ReadyForAccess() bool

func (ac *AuthorizationCache) Run(period time.Duration)

type LastSyncResourceVersioner ¶

type LastSyncResourceVersioner interface {
	LastSyncResourceVersion() string
}

LastSyncResourceVersioner is any object that can divulge a LastSyncResourceVersion

type Lister ¶

type Lister interface {
	// List returns the list of Workspace items that the user can access
	List(user user.Info, selector labels.Selector) (*workspaceapi.WorkspaceList, error)
}

Lister enforces ability to enumerate a resource based on role

type Review ¶

type Review interface {
	Users() []string
	Groups() []string
	EvaluationError() string
}

Review is a list of users and groups that can access a resource

type Reviewer ¶

type Reviewer interface {
	Review(name string) (Review, error)
}

Reviewer performs access reviews for a workspace by name

type ReviewerProvider ¶

type ReviewerProvider interface {
	ForVerb(checkedVerb string) Reviewer
}

func NewAuthorizerReviewerProvider(policyChecker rbac.SubjectLocator) ReviewerProvider

type SyncedClusterRoleBindingLister ¶

type SyncedClusterRoleBindingLister interface {
	rbacv1listers.ClusterRoleBindingLister
	LastSyncResourceVersioner
}

type SyncedClusterRoleLister ¶

type SyncedClusterRoleLister interface {
	rbacv1listers.ClusterRoleLister
	LastSyncResourceVersioner
}