Documentation
¶
Overview ¶
Package gate builds ContentKit's route gates from the host's auth. It asks the auth.Authenticator who a request is, at most once, builds the access.Actor from the Verified, enforces the route's tier (httpapi.Tier) and answers every refusal with the status and challenge helpers/auth's Refuse gives, in ContentKit's error body.
Index ¶
- func Actor(ctx context.Context) access.Actor
- func Can(ctx context.Context, a auth.Authenticator, actor access.Actor, perm string) (bool, error)
- func Check(a auth.Authenticator, perms ...access.Permission) error
- func RootScope(ctx context.Context, a auth.Authenticator) (s auth.Scope, err error)
- type Gate
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Can ¶
Can reports whether actor holds perm, an access.Permission's name, as staff: the root:<resource>:<action> permission in the Authenticator's root scope. It is the one place a staff permission is checked; a tenant that corresponded to a group would also admit that group's merchant: form here. An error never grants.
func Check ¶
func Check(a auth.Authenticator, perms ...access.Permission) error
Check refuses a missing Authenticator, typed nil pointers included. A module with staff routes passes their permissions: the Authenticator must name its root scope (auth.Root), where they are held, and know each one when it can say (auth.PermissionCatalog), so a host whose roles lack one fails at start instead of refusing every request.
Source Files