accesscontrol

package
v0.2.68 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 2, 2026 License: MIT Imports: 17 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	MaxActiveCustomGroups = 32
)

Variables

View Source 
var (
	ErrCategoryRequired         = errors.New("at least one category is required")
	ErrTooManyCategories        = errors.New("at most three categories are allowed")
	ErrCategoryPermissionDenied = errors.New("category capability is insufficient")
	ErrRestrictedCategorySingle = errors.New("a restricted category must be the topic's only category")
)
View Source 
var Default = newDefaultResolver()
View Source 
var ErrTooManyActiveGroups = errors.New("user exceeds active access group limit")

Functions

func CanUserManageAnyCategory 

func CanUserManageAnyCategory(userID uint64, categoryIDs []uint64) bool

func CanonicalTopicCategoryIDs 

func CanonicalTopicCategoryIDs(categoryIDs []uint64) ([]uint64, error)

CanonicalTopicCategoryIDs enforces the persistence-level shape shared by every topic write path while preserving the selected main-category order.

func FilterReadableUserIDs 

func FilterReadableUserIDs(userIDs []uint64, categoryID uint64) ([]uint64, error)

func InvalidateGroup 

func InvalidateGroup(groupID uint64)

func InvalidateSystemGroups 

func InvalidateSystemGroups()

func InvalidateUser 

func InvalidateUser(userID uint64)

func LockPublicCategoryStateWithDB 

func LockPublicCategoryStateWithDB(tx *gorm.DB, categoryIDs []uint64) (uint64, map[uint64]struct{}, error)

LockPublicCategoryStateWithDB returns the everyone group and the requested categories that are currently public while locking the relevant rows when supported by the database.

func MainCategoryOf 

func MainCategoryOf(categoryIDs []uint64) uint64

MainCategoryOf returns the category a topic draws its visibility from: the first one selected. The rest are auxiliary tags and never widen or narrow who can read the topic.

func ManagementScope 

func ManagementScope(userID uint64) (global bool, categoryIDs []uint64, err error)

func SameCategorySelection 

func SameCategorySelection(a []uint64, b []uint64) bool

SameCategorySelection compares order-sensitively: the first entry is the main category, so reordering the same three categories is a real change.

func ValidateCategorySelection 

func ValidateCategorySelection(actor Snapshot, categoryIDs []uint64, required Capability) ([]uint64, error)

func ValidateRestrictedCategorySelection 

func ValidateRestrictedCategorySelection(everyone Snapshot, categoryIDs []uint64) error

func ValidateRestrictedCategorySelectionWithDB 

func ValidateRestrictedCategorySelectionWithDB(tx *gorm.DB, categoryIDs []uint64) error

ValidateRestrictedCategorySelectionWithDB rechecks the single-restricted- category invariant against current database grants. Callers must run it in the same transaction that persists the topic. On databases that support row locking, the everyone grants are locked so a concurrent restriction change cannot pass between validation and the topic write.

func ValidateTopicCategoryWrite 

func ValidateTopicCategoryWrite(actor Snapshot, everyone Snapshot, input TopicCategoryWrite) ([]uint64, error)

ValidateTopicCategoryWrite centralizes category authorization for topic creation, editing, publishing, and category changes. Only the main category decides who can read a topic, so only a change of main category changes visibility, and only that is escalated to a management operation.

Types

type Capability 

type Capability int8
const (
	CapabilityNone   Capability = 0
	CapabilityRead   Capability = Capability(categoryGroupPermissions.PermissionRead)
	CapabilityReply  Capability = Capability(categoryGroupPermissions.PermissionReply)
	CapabilityCreate Capability = Capability(categoryGroupPermissions.PermissionCreate)
	CapabilityManage Capability = Capability(categoryGroupPermissions.PermissionManage)
)

type CategoryGrant 

type CategoryGrant struct {
	CategoryID uint64
	Capability Capability
}

type Resolver 

type Resolver struct {
	// contains filtered or unexported fields
}

func NewResolver 

func NewResolver(
	store Store,
	globalContentManager func(userID uint64) bool,
	moderationScope func(userID uint64) (bool, []uint64),
) *Resolver

func (*Resolver) FilterReadableUserIDs 

func (resolver *Resolver) FilterReadableUserIDs(userIDs []uint64, categoryID uint64) ([]uint64, error)

FilterReadableUserIDs filters a batch for a single category while preserving input order. The default resolver uses one membership query for the entire batch; custom resolvers fall back to Resolve so tests and integrations retain exactly the same semantics without implementing the optional batch store.

func (*Resolver) InvalidateGroup 

func (resolver *Resolver) InvalidateGroup(groupID uint64)

func (*Resolver) InvalidateSystemGroups 

func (resolver *Resolver) InvalidateSystemGroups()

func (*Resolver) InvalidateUser 

func (resolver *Resolver) InvalidateUser(userID uint64)

func (*Resolver) Resolve 

func (resolver *Resolver) Resolve(userID uint64) (Snapshot, error)

type Snapshot 

type Snapshot struct {
	// contains filtered or unexported fields
}

func Resolve 

func Resolve(userID uint64) (Snapshot, error)

func (Snapshot) CanCreateCategory 

func (snapshot Snapshot) CanCreateCategory(categoryID uint64) bool

func (Snapshot) CanManageAnyCategory 

func (snapshot Snapshot) CanManageAnyCategory(categoryIDs []uint64) bool

func (Snapshot) CanManageCategory 

func (snapshot Snapshot) CanManageCategory(categoryID uint64) bool

func (Snapshot) CanReadCategory 

func (snapshot Snapshot) CanReadCategory(categoryID uint64) bool

func (Snapshot) CanReplyCategory 

func (snapshot Snapshot) CanReplyCategory(categoryID uint64) bool

func (Snapshot) Capability 

func (snapshot Snapshot) Capability(categoryID uint64) Capability

func (Snapshot) CreatableCategoryIDs 

func (snapshot Snapshot) CreatableCategoryIDs() []uint64

func (Snapshot) HasAnyManage 

func (snapshot Snapshot) HasAnyManage() bool

func (Snapshot) HasGlobalManage 

func (snapshot Snapshot) HasGlobalManage() bool

func (Snapshot) ListCacheAudience 

func (snapshot Snapshot) ListCacheAudience() (string, bool)

func (Snapshot) ManageableCategoryIDs 

func (snapshot Snapshot) ManageableCategoryIDs() []uint64

func (Snapshot) ReadableCategoryIDs 

func (snapshot Snapshot) ReadableCategoryIDs() []uint64

type Store 

type Store interface {
	SystemGroupIDs() (map[string]uint64, error)
	ActiveCustomGroupIDs(userID uint64) ([]uint64, error)
	EnabledCategoryGrants(groupID uint64) ([]CategoryGrant, error)
}

type TopicCategoryWrite 

type TopicCategoryWrite struct {
	Current    []uint64
	Next       []uint64
	Publishing bool
	NewTopic   bool
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.