Documentation
¶
Overview ¶
Package rbac defines authorization with row-level security. An Authorizer is consulted before every DML tool execution (invariant I5: RBAC runs before the cost gate). RoleAuthorizer checks the role against the entity's RoleAccess, projects fields (invariant I6), and injects a row-level filter predicate for the role (invariant I7: effective predicate = user_predicate AND role_filter).
Authorization denials are Decision{Allowed:false}, not errors; errors are reserved for authorization-system failures.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NormalizeRole ¶
NormalizeRole returns the canonical role identity used by authorization, transport session binding, and configuration.
Types ¶
type Authorizer ¶
Authorizer authorizes a request. Implementations must be safe for concurrent use (invariant I9).
type Decision ¶
Decision is the authorization outcome. When Allowed, Fields is the projected set the caller may read, and RowFilter is the role's row-level predicate to AND with the request predicate.
type Request ¶
type Request struct {
Role string
Entity string
Action entity.Action
Fields []string // requested fields; nil/empty means all visible
ReadFields []string // fields used by projections, filters, grouping, or aggregates
WriteFields []string // fields assigned by create/update
Subject map[string]any // caller attributes for ${subject.x} row-policy resolution
Predicate relalg.Predicate // the request's own filter (for context, not mutated here)
}
Request describes an authorization query.
type RoleAuthorizer ¶
type RoleAuthorizer struct {
// contains filtered or unexported fields
}
RoleAuthorizer authorizes against an immutable entity.Registry.
func NewRoleAuthorizer ¶
func NewRoleAuthorizer(reg *entity.Registry) *RoleAuthorizer
NewRoleAuthorizer returns an Authorizer backed by the given registry.
Source Files