Documentation
¶
Index ¶
- Constants
- func CurrentUserID(c *fiber.Ctx) (uuid.UUID, error)
- func IsSuperuserLocal(c *fiber.Ctx) bool
- func JWTClaimsMiddleware() fiber.Handler
- func RequireAdminAccess(svc *Service) fiber.Handler
- func RequireAnyPermission(svc *Service, codenames ...string) fiber.Handler
- func RequirePermission(svc *Service, codename string) fiber.Handler
- func RequireRole(svc *Service, repo *repositories.ACLRepository, roleName string) fiber.Handler
- func RequireSuperuser(svc *Service) fiber.Handler
- type Service
- func (s *Service) AssignPermissionToRole(ctx context.Context, roleID, permissionID uuid.UUID) error
- func (s *Service) AssignPermissionToUser(ctx context.Context, userID, permissionID uuid.UUID) error
- func (s *Service) AssignRole(ctx context.Context, userID, roleID uuid.UUID) error
- func (s *Service) CanAccessOwnedResource(ctx context.Context, c *fiber.Ctx, currentUserID, ownerUserID uuid.UUID, ...) (bool, error)
- func (s *Service) CreatePermission(ctx context.Context, codename, description string) (*models.Permission, error)
- func (s *Service) CreateRole(ctx context.Context, name, description string) (*models.Role, error)
- func (s *Service) DeletePermissionByCodename(ctx context.Context, codename string) error
- func (s *Service) DeleteRoleByName(ctx context.Context, name string) error
- func (s *Service) HasPermission(ctx context.Context, c *fiber.Ctx, userID uuid.UUID, codename string, ...) (bool, error)
- func (s *Service) HasRole(ctx context.Context, userID uuid.UUID, roleName string) (bool, error)
- func (s *Service) Repo() *repositories.ACLRepository
- func (s *Service) RevokePermissionFromRole(ctx context.Context, roleID, permissionID uuid.UUID) error
- func (s *Service) RevokePermissionFromUser(ctx context.Context, userID, permissionID uuid.UUID) error
- func (s *Service) RevokeRole(ctx context.Context, userID, roleID uuid.UUID) error
- func (s *Service) SetSuperuserByEmail(ctx context.Context, email string, super bool) error
Constants ¶
const ( LocalUserID = "acl_user_id" LocalEmail = "acl_email" LocalRoles = "acl_roles" LocalIsSuperuser = "acl_is_superuser" LocalSessionID = "acl_session_id" )
Context locals set by JWTClaimsMiddleware (after jwtware).
Variables ¶
This section is empty.
Functions ¶
func CurrentUserID ¶
CurrentUserID parses Locals user id as UUID.
func IsSuperuserLocal ¶
IsSuperuserLocal reads JWT-derived superuser flag from Locals.
func JWTClaimsMiddleware ¶
JWTClaimsMiddleware copies MapClaims into Locals for ACL and handlers. Requires c.Locals("user") *jwt.Token.
func RequireAdminAccess ¶
RequireAdminAccess allows superuser or permission admin.access.
func RequireAnyPermission ¶
RequireAnyPermission allows if any codename matches.
func RequirePermission ¶
RequirePermission denies with 403 when the user lacks the codename.
func RequireRole ¶
func RequireRole(svc *Service, repo *repositories.ACLRepository, roleName string) fiber.Handler
RequireRole denies with 403 when the user does not have the role name.
func RequireSuperuser ¶
RequireSuperuser allows only JWT is_superuser or DB superuser.
Types ¶
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service resolves permissions and ownership checks.
func NewService ¶
func NewService(r *repositories.ACLRepository) *Service
NewService builds an ACL service.
func (*Service) AssignPermissionToRole ¶
AssignPermissionToRole attaches a permission to a role.
func (*Service) AssignPermissionToUser ¶
AssignPermissionToUser grants a direct user permission.
func (*Service) AssignRole ¶
AssignRole links a user (by id) to a role (by id).
func (*Service) CanAccessOwnedResource ¶
func (s *Service) CanAccessOwnedResource(ctx context.Context, c *fiber.Ctx, currentUserID, ownerUserID uuid.UUID, manageAnyCodename string, jwtIsSuperuser bool) (bool, error)
CanAccessOwnedResource is true for superuser, or holders of manageAnyCodename, or when currentUserID equals ownerUserID.
func (*Service) CreatePermission ¶
func (s *Service) CreatePermission(ctx context.Context, codename, description string) (*models.Permission, error)
CreatePermission inserts a permission codename.
func (*Service) CreateRole ¶
CreateRole inserts a role.
func (*Service) DeletePermissionByCodename ¶
DeletePermissionByCodename removes a permission.
func (*Service) DeleteRoleByName ¶
DeleteRoleByName removes a role.
func (*Service) HasPermission ¶
func (s *Service) HasPermission(ctx context.Context, c *fiber.Ctx, userID uuid.UUID, codename string, jwtIsSuperuser bool) (bool, error)
HasPermission returns true if the user has the codename (roles + direct) or is superuser. jwtIsSuperuser comes from signed JWT claims; when true, DB is not queried for superuser.
func (*Service) Repo ¶
func (s *Service) Repo() *repositories.ACLRepository
Repo exposes the underlying repository for admin CLI/API (nil if service nil).
func (*Service) RevokePermissionFromRole ¶
func (s *Service) RevokePermissionFromRole(ctx context.Context, roleID, permissionID uuid.UUID) error
RevokePermissionFromRole removes a permission from a role.
func (*Service) RevokePermissionFromUser ¶
func (s *Service) RevokePermissionFromUser(ctx context.Context, userID, permissionID uuid.UUID) error
RevokePermissionFromUser removes a direct user permission.
func (*Service) RevokeRole ¶
RevokeRole removes a user–role link.
Source Files