Documentation
¶
Overview ¶
Package require applies existing RBAC permissions to HTTP routes and non-HTTP callers. HTTP helpers return ordinary Gin groups whose child routes inherit the permission check. Install authentication and org-resolution middleware on the parent router before registering protected routes. Public and global route classification stays with the listener's middleware.
Index ¶
- func AppInOrg(db *gorm.DB) gin.HandlerFunc
- func ComponentInOrg(db *gorm.DB) gin.HandlerFunc
- func InstallWorkflowInOrg(db *gorm.DB) gin.HandlerFunc
- func IsDeclared(ctx *gin.Context) bool
- func NotFederatedToken(ctx context.Context, action string) error
- func NotFederatedTokenRoute(router gin.IRouter, action string) *gin.RouterGroup
- func Org(ctx context.Context) (string, error)
- func OrgOrInstallRoute(router gin.IRouter) *gin.RouterGroup
- func OrgRoute(router gin.IRouter) *gin.RouterGroup
- func PathOrgMatches() gin.HandlerFunc
- func PermissionDeniedError(acct *app.Account, orgID string, perm permissions.Permission, scope string) stderr.ErrAuthorization
- func Read(ctx context.Context) (string, error)
- func ResourceRoute(router gin.IRouter, kind permissions.ResourceKind, paramName string) *gin.RouterGroup
- func Route(router gin.IRouter, kind permissions.ResourceKind, verb permissions.Permission, ...) *gin.RouterGroup
- func RunnerInOrg(db *gorm.DB) gin.HandlerFunc
- func ScopeFromPath(fullPath string) string
- func WorkflowInOrg(db *gorm.DB) gin.HandlerFunc
- func Write(ctx context.Context) (string, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AppInOrg ¶ added in v0.19.1273
func AppInOrg(db *gorm.DB) gin.HandlerFunc
AppInOrg rejects requests whose :app_id is not an app in the selected org. Org-level "all" makes permission object checks succeed for arbitrary app IDs under the header org, so route handlers must also prove ownership.
func ComponentInOrg ¶ added in v0.19.1273
func ComponentInOrg(db *gorm.DB) gin.HandlerFunc
ComponentInOrg rejects requests whose :component_id is not in the selected org.
func InstallWorkflowInOrg ¶ added in v0.19.1273
func InstallWorkflowInOrg(db *gorm.DB) gin.HandlerFunc
InstallWorkflowInOrg rejects requests whose :install_workflow_id is not in the selected org.
func IsDeclared ¶ added in v0.19.1239
IsDeclared reports whether the matched route was registered through Route or OrgRoute. It is available before authentication and does not mean access was granted; the later permission guard must still run.
func NotFederatedToken ¶ added in v0.19.1263
NotFederatedToken rejects the request if it was made with a federated (OIDC-exchanged) token. action completes "federated tokens cannot <action>" in the error message.
func NotFederatedTokenRoute ¶ added in v0.19.1263
func NotFederatedTokenRoute(router gin.IRouter, action string) *gin.RouterGroup
NotFederatedTokenRoute returns a group that rejects federated tokens before the handler runs, so the restriction is visible at route registration instead of buried in the handler body.
require.NotFederatedTokenRoute(orgs, "create organizations").POST("", s.CreateOrg)
func Org ¶ added in v0.19.1159
Org returns the org ID from context. Empty org means the caller did not pass X-Nuon-Org-ID. Use for non-Gin callers (MCP tool handlers). It does not check permissions; use Read or Write for authorization.
func OrgOrInstallRoute ¶ added in v0.19.1273
func OrgOrInstallRoute(router gin.IRouter) *gin.RouterGroup
OrgOrInstallRoute is like OrgRoute, but also allows accounts that only have install-scoped grants when runnerguard has set an install-scoped runner on the request (job SA path). Org-wide grants still pass. Denials stay 403.
func OrgRoute ¶ added in v0.19.1239
func OrgRoute(router gin.IRouter) *gin.RouterGroup
OrgRoute returns a group requiring permission on the selected org, inferred using permissions.FromRequest: GET/HEAD read, POST create, PUT/PATCH update, and DELETE delete. Unsupported methods fail closed at request time. Use Route with KindOrg and an explicit verb when the operation differs from this mapping.
org := require.OrgRoute(api)
org.GET("/v1/orgs/current", handler)
func PathOrgMatches ¶ added in v0.19.1273
func PathOrgMatches() gin.HandlerFunc
PathOrgMatches rejects requests whose :org_id path param does not match the selected org from the auth header. Handlers often load the header org and ignore the path, which lets callers probe arbitrary org IDs with a 200.
func PermissionDeniedError ¶ added in v0.19.1239
func PermissionDeniedError(acct *app.Account, orgID string, perm permissions.Permission, scope string) stderr.ErrAuthorization
PermissionDeniedError phrases a 403 in terms of the access level the request needs rather than the raw permission key, so the message reads sensibly from any action that triggered the check.
func ResourceRoute ¶ added in v0.19.1273
func ResourceRoute(router gin.IRouter, kind permissions.ResourceKind, paramName string) *gin.RouterGroup
func Route ¶
func Route(router gin.IRouter, kind permissions.ResourceKind, verb permissions.Permission, paramName string) *gin.RouterGroup
Route returns a group requiring verb on the resource named by paramName in the request path, within the selected org. For KindOrg it checks the org itself and ignores paramName. The explicit verb is authoritative, regardless of the HTTP method. Resource denials return 404 to avoid disclosing existence; org denials return 403.
require.Route(api, permissions.KindStack, permissions.PermissionRead, "install_id").
GET("/v1/stacks/:install_id/config", handler)
func RunnerInOrg ¶ added in v0.19.1273
func RunnerInOrg(db *gorm.DB) gin.HandlerFunc
RunnerInOrg rejects requests whose :runner_id is not in the selected org.
func ScopeFromPath ¶ added in v0.19.1239
ScopeFromPath derives the denied-error scope from the route, naming the resource the request operates on: /v1/service-accounts/:id becomes "service accounts in this organization".
func WorkflowInOrg ¶ added in v0.19.1273
func WorkflowInOrg(db *gorm.DB) gin.HandlerFunc
WorkflowInOrg rejects requests whose :workflow_id is not in the selected org.
Types ¶
This section is empty.
Source Files