Documentation
¶
Overview ¶
Package roles provides a simple, performant RBAC (Role-Based Access Control) system.
Index ¶
- type Gate
- type Manager
- func (m *Manager) AllPermissions(ctx context.Context, userID int64) ([]Permission, error)
- func (m *Manager) Can(ctx context.Context, userID int64, permission Permission) (bool, error)
- func (m *Manager) Cannot(ctx context.Context, userID int64, permission Permission) (bool, error)
- func (m *Manager) Define(name string, permissions ...Permission) *Manager
- func (m *Manager) HasRole(ctx context.Context, userID int64, role string) (bool, error)
- func (m *Manager) Preload(ctx context.Context, userID int64) (context.Context, error)
- type Permission
- type Policy
- type Role
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Gate ¶
type Gate struct {
// contains filtered or unexported fields
}
Gate stores named policy functions.
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager is the central RBAC registry. Roles and their permissions are defined at startup and never change at runtime.
func New ¶
New creates a Manager with a function to resolve user roles.
roles.New(func(ctx context.Context, userID int64) ([]string, error) {
var r []string
err := db.Table("user_roles").Where("user_id = ?", userID).Pluck("role", &r)
return r, err
})
func (*Manager) AllPermissions ¶
AllPermissions returns all permissions granted to the user across all their roles.
func (*Manager) Can ¶
Can reports whether the user can perform the given permission. It checks all roles the user has and returns true if any grants the permission. Wildcard permissions (e.g. "users:*") match any sub-permission (e.g. "users:create").
func (*Manager) Define ¶
func (m *Manager) Define(name string, permissions ...Permission) *Manager
Define registers a role and its permissions.
m.Define("admin", "users:*", "posts:*")
m.Define("editor", "posts:create", "posts:update")
func (*Manager) Preload ¶
Preload resolves the user's roles once and caches them on the returned context. All subsequent Can/HasRole/AllPermissions calls with that context (and the same user ID) use the cached roles instead of hitting the userRolesFn (typically a DB query) on every check.
The cache is explicit and context-scoped: it lives exactly as long as the context (e.g. one HTTP request) and is never shared across requests, so role changes take effect on the next request with no invalidation dance.
ctx, err := rbac.Preload(ctx, userID) // one DB query rbac.Can(ctx, userID, "posts:update") // cached rbac.HasRole(ctx, userID, "admin") // cached
type Permission ¶
type Permission string
Permission is a string-based permission identifier (e.g. "users:create", "posts:delete").
type Policy ¶
Policy is a named gate function for fine-grained authorization logic. Policies supplement role-based rules with model-level checks.
type Role ¶
type Role struct {
Name string
Permissions map[Permission]bool
}
Role groups a set of Permissions under a name.
Source Files