Documentation
¶
Overview ¶
Package require applies existing RBAC permissions to HTTP routes and non-HTTP callers. HTTP helpers return ordinary Gin groups whose child routes inherit the permission check. Install authentication and org-resolution middleware on the parent router before registering protected routes. Public and global route classification stays with the listener's middleware.
Index ¶
- func IsDeclared(ctx *gin.Context) bool
- func Org(ctx context.Context) (string, error)
- func OrgRoute(router gin.IRouter) *gin.RouterGroup
- func PermissionDeniedError(acct *app.Account, orgID string, perm permissions.Permission, scope string) stderr.ErrAuthorization
- func Read(ctx context.Context) (string, error)
- func Route(router gin.IRouter, kind permissions.ResourceKind, verb permissions.Permission, ...) *gin.RouterGroup
- func ScopeFromPath(fullPath string) string
- func Write(ctx context.Context) (string, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsDeclared ¶ added in v0.19.1239
IsDeclared reports whether the matched route was registered through Route or OrgRoute. It is available before authentication and does not mean access was granted; the later permission guard must still run.
func Org ¶ added in v0.19.1159
Org returns the selected org ID from context. Empty org means the caller must select_org or pass X-Nuon-Org-ID. Use for non-Gin callers (MCP tool handlers). It does not check permissions; use Read or Write for authorization.
func OrgRoute ¶ added in v0.19.1239
func OrgRoute(router gin.IRouter) *gin.RouterGroup
OrgRoute returns a group requiring permission on the selected org, inferred using permissions.FromRequest: GET/HEAD read, POST create, PUT/PATCH update, and DELETE delete. Unsupported methods fail closed at request time. Use Route with KindOrg and an explicit verb when the operation differs from this mapping.
org := require.OrgRoute(api)
org.GET("/v1/orgs/current", handler)
func PermissionDeniedError ¶ added in v0.19.1239
func PermissionDeniedError(acct *app.Account, orgID string, perm permissions.Permission, scope string) stderr.ErrAuthorization
PermissionDeniedError phrases a 403 in terms of the access level the request needs rather than the raw permission key, so the message reads sensibly from any action that triggered the check.
func Route ¶
func Route(router gin.IRouter, kind permissions.ResourceKind, verb permissions.Permission, paramName string) *gin.RouterGroup
Route returns a group requiring verb on the resource named by paramName in the request path, within the selected org. For KindOrg it checks the org itself and ignores paramName. The explicit verb is authoritative, regardless of the HTTP method. Resource denials return 404 to avoid disclosing existence; org denials return 403.
require.Route(api, permissions.KindStack, permissions.PermissionRead, "install_id").
GET("/v1/stacks/:install_id/config", handler)
func ScopeFromPath ¶ added in v0.19.1239
ScopeFromPath derives the denied-error scope from the route, naming the resource the request operates on: /v1/service-accounts/:id becomes "service accounts in this organization".
Types ¶
This section is empty.
Source Files