authz

package
v0.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 18, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	RepoResourceTypeCertificate      RepoResourceType = RepoResourceType(constants.CertificateTable)
	RepoResourceTypeEvent            RepoResourceType = RepoResourceType(constants.EventTable)
	RepoResourceTypeGroup            RepoResourceType = RepoResourceType(constants.GroupTable)
	RepoResourceTypeImportparam      RepoResourceType = RepoResourceType(constants.ImportparamTable)
	RepoResourceTypeKey              RepoResourceType = RepoResourceType(constants.KeyTable)
	RepoResourceTypeKeyconfiguration RepoResourceType = RepoResourceType(constants.KeyconfigurationTable)
	RepoResourceTypeKeystore         RepoResourceType = RepoResourceType(constants.KeystoreTable)
	RepoResourceTypeKeyversion       RepoResourceType = RepoResourceType(constants.KeyVersionTable)
	RepoResourceTypeKeyLabel         RepoResourceType = RepoResourceType(constants.KeyLabelTable)
	RepoResourceTypeSystem           RepoResourceType = RepoResourceType(constants.SystemTable)
	RepoResourceTypeSystemProperty   RepoResourceType = RepoResourceType(constants.SystemPropertyTable)
	RepoResourceTypeTag              RepoResourceType = RepoResourceType(constants.TagTable)
	RepoResourceTypeTenant           RepoResourceType = RepoResourceType(constants.TenantTable)
	RepoResourceTypeTenantconfig     RepoResourceType = RepoResourceType(constants.TenantconfigTable)
	RepoResourceTypeWorkflow         RepoResourceType = RepoResourceType(constants.WorkflowTable)
	RepoResourceTypeWorkflowApprover RepoResourceType = RepoResourceType(constants.WorkflowApproverTable)

	RepoActionList   RepoAction = "list"
	RepoActionFirst  RepoAction = "first"
	RepoActionCount  RepoAction = "count"
	RepoActionCreate RepoAction = "create"
	RepoActionUpdate RepoAction = "update"
	RepoActionDelete RepoAction = "delete"

	APIResourceTypeKeyConfiguration APIResourceType = "KeyConfiguration"
	APIResourceTypeKey              APIResourceType = "Key"
	APIResourceTypeSystem           APIResourceType = "System"
	APIResourceTypeWorkFlow         APIResourceType = "Workflow"
	APIResourceTypeUserGroup        APIResourceType = "UserGroup"
	APIResourceTypeTenant           APIResourceType = "Tenant"
	APIResourceTypeTenantSettings   APIResourceType = "TenantSettings"
	APIResourceTypeEvent            APIResourceType = "Event"
	APIResourceTypeImportParams     APIResourceType = "ImportParams"
	APIResourceTypeKeyStoreConfig   APIResourceType = "KeyStoreConfig"

	APIActionRead             APIAction = "read"
	APIActionCreate           APIAction = "create"
	APIActionUpdate           APIAction = "update"
	APIActionDelete           APIAction = "delete"
	APIActionKeyRotate        APIAction = "KeyRotate"
	APIActionSystemModifyLink APIAction = "ModifySystemLink"
)

These are linked to table names, so will require a migration if changed. Having this linkage ensures that tables are more coupled to the authz resource identifiers

Variables

View Source 
var (
	ErrAuthzDecision           = errors.New("error making authorization decision")
	ErrAuthzUnauthorized       = errors.New("action authorized")
	ErrExtractBusinessUserData = errors.New("error extracting client data from context")
	ErrExtractInternalUserData = errors.New("error extracting internal data from context")
)
View Source 
var (
	ErrInvalidRequest        = errors.New("invalid request")
	ErrAuthorizationDecision = errors.New("authorization decision error")
	ErrAuthorizationDenied   = errors.New("authorization denied")

	ErrCreateAuthzRequest = errors.New("error creating authorization request")
	ErrExtractTenantID    = errors.New("error extracting tenant ID from context")

	ErrActionInvalid            = errors.New("action is invalid")
	ErrResourceTypeInvalid      = errors.New("resource type is invalid")
	ErrActionInvalidForResource = errors.New("action is invalid for resource type")
)
View Source 
var (
	ErrEmptyRequest       = errors.New("empty request")
	ErrWrongTenantID      = errors.New("wrong tenant ID in request")
	ErrNoAuthzForUserType = errors.New("incompatible user type")
)
View Source 
var (
	ErrValidation = errors.New("validation failed")
	ErrUserEmpty  = errors.New("user is empty")
)
View Source 
var APIPolicies = RolePolicies[constants.BusinessRole, APIResourceType, APIAction]{
	constants.TenantAuditorRole: {
		{
			ID: constants.AuditorPolicy,
			ResourceTypes: []Resource[APIResourceType, APIAction]{
				{
					Type: APIResourceTypeKeyConfiguration,
					Actions: []APIAction{
						APIActionRead,
					},
				},
				{
					Type: APIResourceTypeKey,
					Actions: []APIAction{
						APIActionRead,
					},
				},
				{
					Type: APIResourceTypeSystem,
					Actions: []APIAction{
						APIActionRead,
					},
				},
				{
					Type: APIResourceTypeWorkFlow,
					Actions: []APIAction{
						APIActionRead,
					},
				},
				{
					Type: APIResourceTypeTenantSettings,
					Actions: []APIAction{
						APIActionRead,
					},
				},
				{
					Type: APIResourceTypeUserGroup,
					Actions: []APIAction{
						APIActionRead,
					},
				},
				{
					Type: APIResourceTypeTenant,
					Actions: []APIAction{
						APIActionRead,
					},
				},
			},
		},
	},
	constants.KeyAdminRole: {
		{
			ID: constants.KeyAdminPolicy,
			ResourceTypes: []Resource[APIResourceType, APIAction]{
				{
					Type: APIResourceTypeKeyConfiguration,
					Actions: []APIAction{
						APIActionRead,
						APIActionCreate,
						APIActionDelete,
						APIActionUpdate,
					},
				},
				{
					Type: APIResourceTypeKey,
					Actions: []APIAction{
						APIActionRead,
						APIActionCreate,
						APIActionDelete,
						APIActionUpdate,
						APIActionKeyRotate,
					},
				},
				{
					Type: APIResourceTypeUserGroup,
					Actions: []APIAction{
						APIActionRead,
					},
				},
				{
					Type: APIResourceTypeSystem,
					Actions: []APIAction{
						APIActionSystemModifyLink,
						APIActionRead,
						APIActionUpdate,
					},
				},
				{
					Type: APIResourceTypeWorkFlow,
					Actions: []APIAction{
						APIActionRead,
						APIActionCreate,
						APIActionDelete,
						APIActionUpdate,
					},
				},
				{
					Type: APIResourceTypeTenantSettings,
					Actions: []APIAction{
						APIActionRead,
					},
				},
			},
		},
	},
	constants.TenantAdminRole: {
		{
			ID: constants.TenantAdminPolicy,
			ResourceTypes: []Resource[APIResourceType, APIAction]{
				{
					Type: APIResourceTypeTenant,
					Actions: []APIAction{
						APIActionRead,
						APIActionUpdate,
					},
				},
				{
					Type: APIResourceTypeUserGroup,
					Actions: []APIAction{
						APIActionRead,
						APIActionCreate,
						APIActionDelete,
						APIActionUpdate,
					},
				},
				{
					Type: APIResourceTypeTenantSettings,
					Actions: []APIAction{
						APIActionRead,
						APIActionUpdate,
					},
				},
			},
		},
	},
}
View Source 
var APIResourceTypeActions = map[APIResourceType][]APIAction{
	APIResourceTypeKeyConfiguration: {
		APIActionRead,
		APIActionCreate,
		APIActionDelete,
		APIActionUpdate,
	},
	APIResourceTypeKey: {
		APIActionRead,
		APIActionCreate,
		APIActionDelete,
		APIActionUpdate,
		APIActionKeyRotate,
	},
	APIResourceTypeSystem: {
		APIActionRead,
		APIActionSystemModifyLink,
	},
	APIResourceTypeWorkFlow: {
		APIActionRead,
		APIActionCreate,
		APIActionDelete,
		APIActionUpdate,
	},
	APIResourceTypeTenantSettings: {
		APIActionRead,
		APIActionUpdate,
	},
	APIResourceTypeUserGroup: {
		APIActionRead,
		APIActionCreate,
		APIActionDelete,
		APIActionUpdate,
	},
	APIResourceTypeTenant: {
		APIActionRead,
		APIActionUpdate,
	},
}
View Source 
var AllowListByAPI = map[string]struct{}{
	"GET /tenants":            {},
	"GET /tenants/{tenantID}": {},
	"GET /userInfo":           {},
	"GET /swagger":            {},
}

AllowListByAPI is a map acting like a set with O(1) search. As long as the endpoint exists it's valid

View Source 
var ErrInvalidRole = errors.New("invalid role")
View Source 
var InfoAuthorizationPassed = "Authorization check passed"
View Source 
var RepoBusinessPolicies = RolePolicies[constants.BusinessRole, RepoResourceType, RepoAction]{
	constants.TenantAuditorRole: {
		{
			ID: constants.AuditorPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeCertificate,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeEvent,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeGroup,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeImportparam,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeKey,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeKeyconfiguration,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeKeystore,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeKeyversion,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeKeyLabel,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeSystem,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeSystemProperty,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeTag,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeTenant,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeTenantconfig,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeWorkflow,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeWorkflowApprover,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
			},
		},
	},
	constants.KeyAdminRole: {
		{
			ID: constants.KeyAdminPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeCertificate,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeEvent,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeGroup,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeImportparam,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeKey,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeKeyconfiguration,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeKeystore,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeKeyversion,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeKeyLabel,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeSystem,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeSystemProperty,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeTag,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeTenant,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeTenantconfig,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeWorkflow,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeWorkflowApprover,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
			},
		},
	},
	constants.TenantAdminRole: {
		{
			ID: constants.TenantAdminPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeGroup,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeKeyconfiguration,
					Actions: []RepoAction{
						RepoActionFirst,
					},
				},
				{
					Type: RepoResourceTypeTenant,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeTenantconfig,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
			},
		},
	},
}
View Source 
var RepoInternalPolicies = RolePolicies[constants.InternalRole, RepoResourceType, RepoAction]{
	constants.InternalBusinessAuthzRole: {
		{
			ID: constants.InternalBusinessAuthzPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeGroup,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeKeyconfiguration,
					Actions: []RepoAction{
						RepoActionCount,
					},
				},
			},
		},
	},
	constants.InternalTenantCLIRole: {
		{
			ID: constants.InternalTenantCLIPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeTenant,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCreate,
						RepoActionDelete,
						RepoActionUpdate,
					},
				},
				{
					Type: RepoResourceTypeGroup,
					Actions: []RepoAction{
						RepoActionCreate,
					},
				},
			},
		},
	},
	constants.InternalEventReconcilerRole: {
		{
			ID: constants.InternalEventReconcilerPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeTenant,
					Actions: []RepoAction{
						RepoActionFirst,
					},
				},
				{
					Type: RepoResourceTypeKey,
					Actions: []RepoAction{
						RepoActionFirst,
						RepoActionList,
						RepoActionUpdate,
					},
				},
				{
					Type: RepoResourceTypeSystem,
					Actions: []RepoAction{
						RepoActionFirst,
						RepoActionCount,
						RepoActionList,
						RepoActionUpdate,
					},
				},
				{

					Type: RepoResourceTypeCertificate,
					Actions: []RepoAction{
						RepoActionFirst,
					},
				},
				{

					Type: RepoResourceTypeTenantconfig,
					Actions: []RepoAction{
						RepoActionFirst,
						RepoActionDelete,
						RepoActionCreate,
					},
				},
				{

					Type: RepoResourceTypeEvent,
					Actions: []RepoAction{
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{

					Type: RepoResourceTypeKeyversion,
					Actions: []RepoAction{
						RepoActionFirst,
					},
				},
			},
		},
	},
	constants.InternalTenantProvisioningRole: {
		{
			ID: constants.InternalTenantProvisioningPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeTenant,
					Actions: []RepoAction{
						RepoActionCreate,
						RepoActionUpdate,
						RepoActionDelete,
					},
				},
				{
					Type: RepoResourceTypeGroup,
					Actions: []RepoAction{
						RepoActionFirst,
						RepoActionCreate,
					},
				},
				{
					Type: RepoResourceTypeSystem,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
						RepoActionFirst,
						RepoActionUpdate,
					},
				},
				{
					Type: RepoResourceTypeKey,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
						RepoActionUpdate,
					},
				},
				{
					Type: RepoResourceTypeKeyconfiguration,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionFirst,
						RepoActionList,
					},
				},
			},
		},
	},
	constants.InternalTaskProcessingRole: {
		{
			ID: constants.InternalTaskProcessingPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeTenant,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
					},
				},
			},
		},
	},
	constants.InternalTaskCertRotationRole: {
		{
			ID: constants.InternalTaskCertRotationPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeCertificate,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionFirst,
						RepoActionCreate,
						RepoActionCount,
						RepoActionUpdate,
					},
				},
			},
		},
	},
	constants.InternalTaskWorkflowApproversRole: {
		{
			ID: constants.InternalTaskWorkflowApproversPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeTenant,
					Actions: []RepoAction{
						RepoActionFirst,
					},
				},
				{
					Type: RepoResourceTypeTenantconfig,
					Actions: []RepoAction{
						RepoActionFirst,
					},
				},
				{
					Type: RepoResourceTypeWorkflow,
					Actions: []RepoAction{
						RepoActionUpdate,
						RepoActionFirst,

						RepoActionDelete,
						RepoActionCreate,
					},
				},
				{
					Type: RepoResourceTypeWorkflowApprover,
					Actions: []RepoAction{
						RepoActionCreate,
						RepoActionDelete,
						RepoActionCount,
						RepoActionList,
					},
				},
				{
					Type: RepoResourceTypeKey,
					Actions: []RepoAction{
						RepoActionFirst,

						RepoActionUpdate,
					},
				},
				{
					Type: RepoResourceTypeKeyversion,
					Actions: []RepoAction{
						RepoActionFirst,
					},
				},
				{
					Type: RepoResourceTypeGroup,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
					},
				},
				{
					Type: RepoResourceTypeKeyconfiguration,
					Actions: []RepoAction{
						RepoActionFirst,
						RepoActionList,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeSystem,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
						RepoActionFirst,

						RepoActionUpdate,
					},
				},
				{
					Type: RepoResourceTypeSystemProperty,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
					},
				},
				{
					Type: RepoResourceTypeEvent,
					Actions: []RepoAction{
						RepoActionFirst,
						RepoActionList,
						RepoActionCount,
					},
				},
			},
		},
	},
	constants.InternalTaskHYOKSyncRole: {
		{
			ID: constants.InternalTaskHYOKSyncPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeKey,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
						RepoActionUpdate,
					},
				},
				{
					Type: RepoResourceTypeKeyversion,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
						RepoActionUpdate,
					},
				},
				{
					Type: RepoResourceTypeCertificate,
					Actions: []RepoAction{
						RepoActionFirst,
						RepoActionCount,
						RepoActionCreate,
						RepoActionUpdate,
					},
				},
			},
		},
	},
	constants.InternalTaskKeystorePoolRole: {
		{
			ID: constants.InternalTaskKeystorePoolPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeKeystore,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionCreate,
					},
				},
			},
		},
	},
	constants.InternalTaskSystemRefreshRole: {
		{
			ID: constants.InternalTaskSystemRefreshPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeKeyconfiguration,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionCount,
					},
				},
				{
					Type: RepoResourceTypeSystem,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
					},
				},
				{
					Type: RepoResourceTypeSystemProperty,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
						RepoActionUpdate,
					},
				},
				{
					Type: RepoResourceTypeEvent,
					Actions: []RepoAction{
						RepoActionCount,
						RepoActionList,
					},
				},
			},
		},
	},
	constants.InternalTaskTenantRefreshRole: {
		{
			ID: constants.InternalTaskTenantRefreshPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeTenant,
					Actions: []RepoAction{
						RepoActionUpdate,
					},
				},
			},
		},
	},
	constants.InternalTaskWorkflowCleanupRole: {
		{
			ID: constants.InternalTaskWorkflowCleanupPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{

					Type: RepoResourceTypeTenantconfig,
					Actions: []RepoAction{
						RepoActionFirst,
						RepoActionDelete,
						RepoActionCreate,
					},
				},
				{

					Type: RepoResourceTypeTenant,
					Actions: []RepoAction{
						RepoActionFirst,
					},
				},
				{
					Type: RepoResourceTypeWorkflow,
					Actions: []RepoAction{
						RepoActionList,
						RepoActionCount,
						RepoActionDelete,
					},
				},
			},
		},
	},
	constants.InternalTaskWorkflowExpirationRole: {
		{
			ID: constants.InternalTaskWorkflowExpirationPolicy,
			ResourceTypes: []Resource[RepoResourceType, RepoAction]{
				{
					Type: RepoResourceTypeWorkflow,
					Actions: []RepoAction{
						RepoActionFirst,
						RepoActionList,
						RepoActionCount,
						RepoActionUpdate,
					},
				},
				{
					Type: RepoResourceTypeSystem,
					Actions: []RepoAction{
						RepoActionUpdate,
					},
				},
			},
		},
	},
}
View Source 
var RepoResourceTypeActions = map[RepoResourceType][]RepoAction{
	RepoResourceTypeCertificate:      repoActionList,
	RepoResourceTypeEvent:            repoActionList,
	RepoResourceTypeGroup:            repoActionList,
	RepoResourceTypeImportparam:      repoActionList,
	RepoResourceTypeKey:              repoActionList,
	RepoResourceTypeKeyconfiguration: repoActionList,
	RepoResourceTypeKeystore:         repoActionList,
	RepoResourceTypeKeyversion:       repoActionList,
	RepoResourceTypeKeyLabel:         repoActionList,
	RepoResourceTypeSystem:           repoActionList,
	RepoResourceTypeSystemProperty:   repoActionList,
	RepoResourceTypeTag:              repoActionList,
	RepoResourceTypeTenant:           repoActionList,
	RepoResourceTypeTenantconfig:     repoActionList,
	RepoResourceTypeWorkflow:         repoActionList,
	RepoResourceTypeWorkflowApprover: repoActionList,
}
View Source 
var RestrictionsByAPI = map[string]Restricted{

	"GET /keys": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionRead,
	},
	"POST /keys": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionCreate,
	},
	"GET /keys/{keyID}": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionRead,
	},
	"PATCH /keys/{keyID}": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionUpdate,
	},
	"DELETE /keys/{keyID}": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionDelete,
	},
	"GET /keys/{keyID}/importParams": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionRead,
	},
	"POST /keys/{keyID}/importKeyMaterial": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionUpdate,
	},
	"GET /keys/{keyID}/versions": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionRead,
	},
	"POST /keys/{keyID}/versions": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionCreate,
	},
	"GET /keys/{keyID}/versions/{version}": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionRead,
	},
	"GET /key/{keyID}/labels": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionRead,
	},
	"POST /key/{keyID}/labels": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionCreate,
	},
	"DELETE /key/{keyID}/label/{labelName}": {
		APIResourceTypeName: APIResourceTypeKey,
		APIAction:           APIActionDelete,
	},

	"GET /keyConfigurations": {
		APIResourceTypeName: APIResourceTypeKeyConfiguration,
		APIAction:           APIActionRead,
	},
	"POST /keyConfigurations": {
		APIResourceTypeName: APIResourceTypeKeyConfiguration,
		APIAction:           APIActionCreate,
	},
	"GET /keyConfigurations/{keyConfigurationID}": {
		APIResourceTypeName: APIResourceTypeKeyConfiguration,
		APIAction:           APIActionRead,
	},
	"PATCH /keyConfigurations/{keyConfigurationID}": {
		APIResourceTypeName: APIResourceTypeKeyConfiguration,
		APIAction:           APIActionUpdate,
	},
	"DELETE /keyConfigurations/{keyConfigurationID}": {
		APIResourceTypeName: APIResourceTypeKeyConfiguration,
		APIAction:           APIActionDelete,
	},
	"GET /keyConfigurations/{keyConfigurationID}/tags": {
		APIResourceTypeName: APIResourceTypeKeyConfiguration,
		APIAction:           APIActionRead,
	},
	"PUT /keyConfigurations/{keyConfigurationID}/tags": {
		APIResourceTypeName: APIResourceTypeKeyConfiguration,
		APIAction:           APIActionUpdate,
	},
	"GET /keyConfigurations/{keyConfigurationID}/certificates": {
		APIResourceTypeName: APIResourceTypeKeyConfiguration,
		APIAction:           APIActionRead,
	},

	"GET /systems": {
		APIResourceTypeName: APIResourceTypeSystem,
		APIAction:           APIActionRead,
	},
	"GET /systems/filterOptions": {
		APIResourceTypeName: APIResourceTypeSystem,
		APIAction:           APIActionRead,
	},
	"GET /systems/{systemID}": {
		APIResourceTypeName: APIResourceTypeSystem,
		APIAction:           APIActionRead,
	},
	"PATCH /systems/{systemID}/link": {
		APIResourceTypeName: APIResourceTypeSystem,
		APIAction:           APIActionSystemModifyLink,
	},
	"DELETE /systems/{systemID}/link": {
		APIResourceTypeName: APIResourceTypeSystem,
		APIAction:           APIActionSystemModifyLink,
	},
	"POST /systems/{systemID}/recoveryActions": {
		APIResourceTypeName: APIResourceTypeSystem,
		APIAction:           APIActionSystemModifyLink,
	},
	"GET /systems/{systemID}/recoveryActions": {
		APIResourceTypeName: APIResourceTypeSystem,
		APIAction:           APIActionSystemModifyLink,
	},

	"POST /workflows": {
		APIResourceTypeName: APIResourceTypeWorkFlow,
		APIAction:           APIActionCreate,
	},
	"GET /workflows": {
		APIResourceTypeName: APIResourceTypeWorkFlow,
		APIAction:           APIActionRead,
	},
	"POST /workflows/check": {
		APIResourceTypeName: APIResourceTypeWorkFlow,
		APIAction:           APIActionUpdate,
	},
	"GET /workflows/{workflowID}": {
		APIResourceTypeName: APIResourceTypeWorkFlow,
		APIAction:           APIActionRead,
	},
	"GET /workflows/{workflowID}/approvers": {
		APIResourceTypeName: APIResourceTypeWorkFlow,
		APIAction:           APIActionRead,
	},
	"POST /workflows/{workflowID}/approvers": {
		APIResourceTypeName: APIResourceTypeWorkFlow,
		APIAction:           APIActionCreate,
	},
	"POST /workflows/{workflowID}/state": {
		APIResourceTypeName: APIResourceTypeWorkFlow,
		APIAction:           APIActionUpdate,
	},

	"GET /groups": {
		APIResourceTypeName: APIResourceTypeUserGroup,
		APIAction:           APIActionRead,
	},
	"POST /groups": {
		APIResourceTypeName: APIResourceTypeUserGroup,
		APIAction:           APIActionCreate,
	},
	"POST /groups/iamCheck": {
		APIResourceTypeName: APIResourceTypeUserGroup,
		APIAction:           APIActionRead,
	},
	"GET /groups/{groupID}": {
		APIResourceTypeName: APIResourceTypeUserGroup,
		APIAction:           APIActionRead,
	},
	"PATCH /groups/{groupID}": {
		APIResourceTypeName: APIResourceTypeUserGroup,
		APIAction:           APIActionUpdate,
	},
	"DELETE /groups/{groupID}": {
		APIResourceTypeName: APIResourceTypeUserGroup,
		APIAction:           APIActionDelete,
	},

	"GET /tenantConfigurations/keystores": {
		APIResourceTypeName: APIResourceTypeTenantSettings,
		APIAction:           APIActionRead,
	},
	"GET /tenantConfigurations/workflow": {
		APIResourceTypeName: APIResourceTypeTenantSettings,
		APIAction:           APIActionRead,
	},
	"PATCH /tenantConfigurations/workflow": {
		APIResourceTypeName: APIResourceTypeTenantSettings,
		APIAction:           APIActionUpdate,
	},
	"GET /tenantInfo": {
		APIResourceTypeName: APIResourceTypeTenant,
		APIAction:           APIActionRead,
	},
}

RestrictionsByAPI maps "METHOD path" to authorization requirements

Functions

func CheckAuthz 

func CheckAuthz[
	Resource APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
](
	ctx context.Context,
	authzHandler *Handler[Resource, Action],
	resourceType Resource,
	action Action,
) (bool, error)

func CheckInternalUserRole added in v0.9.0 

func CheckInternalUserRole(ctx context.Context, role constants.InternalRole) error

func CheckInternalUserRoles added in v0.9.0 

func CheckInternalUserRoles(ctx context.Context,
	allowedRoles []constants.InternalRole,
) error

func LogDecision 

func LogDecision[TUser UserRequest, TResourceTypeName, TAction comparable](
	ctx context.Context, request Request[TUser, TResourceTypeName, TAction],
	auditor *auditor.Auditor, isAllowed bool, reason Reason,
)

LogDecision logs the authorization decision made for a request. It logs the request ID, tenant ID, resource type, action, decision, and reason. The decision is logged as an Info log if it is "Allow", otherwise as a Warn log. Additionally, it sends an audit log for unauthorized requests using the provided auditor.

Types

type APIAction added in v0.5.0 

type APIAction string

type APIMethod 

type APIMethod string

type APIResourceType added in v0.5.0 

type APIResourceType string

type AuthorizationKey 

type AuthorizationKey[
	User BusinessUserCheck | InternalUserCheck,
	Resource APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
] struct {
	User         User
	ResourceType Resource
	Action       Action
}

type AuthzData added in v0.9.0 

type AuthzData[
	Role constants.BusinessRole | constants.InternalRole,
	UserCheck BusinessUserCheck | InternalUserCheck,
	Resource APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
] struct {
	RolePolicies RolePolicies[Role, Resource, Action]
	AuthzKeys    map[AuthorizationKey[UserCheck, Resource, Action]]struct{}
}

type BusinessUser added in v0.9.0 

type BusinessUser struct {
	TenantID TenantID
	Groups   []string
}

type BusinessUserAuthzData added in v0.9.0 

type BusinessUserAuthzData[
	Resource APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
] AuthzData[constants.BusinessRole, BusinessUserCheck, Resource, Action]

func NewBusinessUserAuthzData added in v0.9.0 

func NewBusinessUserAuthzData[
	Resource APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
](
	rolePolicies RolePolicies[constants.BusinessRole, Resource, Action]) (
	*BusinessUserAuthzData[Resource, Action], error,
)

NewBusinessUserAuthzData creates and return a BusinessUserAuthzData. We have separate functions to add the entities, since these are dynamic

func (*BusinessUserAuthzData[ResourceType, Action]) AddUser added in v0.9.0 

func (l *BusinessUserAuthzData[ResourceType, Action]) AddUser(
	user map[constants.BusinessRole]*BusinessUser,
) error

func (*BusinessUserAuthzData[ResourceType, Action]) InitialiseAuthzKeys added in v0.9.0 

func (l *BusinessUserAuthzData[ResourceType, Action]) InitialiseAuthzKeys()

type BusinessUserCheck added in v0.9.0 

type BusinessUserCheck struct {
	TenantID TenantID
	Group    string
}

type BusinessUserRequest added in v0.9.0 

type BusinessUserRequest struct {
	TenantID TenantID
	UserName string
	Groups   []string
}

func (BusinessUserRequest) IsEmpty added in v0.9.0 

func (u BusinessUserRequest) IsEmpty() bool

func (BusinessUserRequest) IsValidContext added in v0.9.0 

func (r BusinessUserRequest) IsValidContext(ctx context.Context) error

type Entity 

type Entity[
	Role constants.BusinessRole | constants.InternalRole,
	User BusinessUser,
] struct {
	User User
	Role Role
}

type Handler 

type Handler[
	Resource APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
] struct {
	InternalUserAuthzData InternalUserAuthzData[Resource, Action]
	BusinessUserAuthzData BusinessUserAuthzData[Resource, Action]

	Auditor *auditor.Auditor
	// contains filtered or unexported fields
}

func NewAuthorizationHandler 

func NewAuthorizationHandler[
	Resource APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
](
	auditor *auditor.Auditor,
	internalUserPolicies RolePolicies[constants.InternalRole, Resource, Action],
	businessUserPolicies RolePolicies[constants.BusinessRole, Resource, Action],
	resourceActions map[Resource][]Action,
	mu *sync.Mutex,
) (*Handler[Resource, Action], error)

func (*Handler[Resource, Action]) IsBusinessUserAllowed added in v0.9.0 

func (as *Handler[Resource, Action]) IsBusinessUserAllowed(
	ctx context.Context,
	request Request[BusinessUserRequest, Resource, Action],
) (bool, error)

IsBusinessUserAllowed checks if the given Business User is allowed to perform the given Action on the given Resource

func (*Handler[Resource, Action]) IsInternalUserAllowed added in v0.9.0 

func (as *Handler[Resource, Action]) IsInternalUserAllowed(
	ctx context.Context,
	request Request[InternalUserRequest, Resource, Action],
) (bool, error)

IsInternalUserAllowed checks if the given Business User is allowed to perform the given Action on the given Resource

func (*Handler[Resource, Action]) ResetBusinessUserData added in v0.9.0 

func (as *Handler[Resource, Action]) ResetBusinessUserData()

func (*Handler[Resource, Action]) UpdateBusinessUserData added in v0.9.0 

func (as *Handler[Resource, Action]) UpdateBusinessUserData(
	user map[constants.BusinessRole]*BusinessUser,
) error

type InternalUserAuthzData added in v0.9.0 

type InternalUserAuthzData[
	Resource APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
] AuthzData[constants.InternalRole, InternalUserCheck, Resource, Action]

func NewInternalUserAuthzData added in v0.9.0 

func NewInternalUserAuthzData[
	Resource APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
](
	rolePolicies RolePolicies[constants.InternalRole, Resource, Action]) (
	*InternalUserAuthzData[Resource, Action], error,
)

NewInternalUserAuthzData creates and return a InternalUserAuthzData. There are no separate functions to add the entities, they are created on construction, since the policies and roles are all static

type InternalUserCheck added in v0.9.0 

type InternalUserCheck struct {
	Role constants.InternalRole
}

type InternalUserRequest added in v0.9.0 

type InternalUserRequest struct {
	Role constants.InternalRole
}

func (InternalUserRequest) IsEmpty added in v0.9.0 

func (u InternalUserRequest) IsEmpty() bool

func (InternalUserRequest) IsValidContext added in v0.9.0 

func (r InternalUserRequest) IsValidContext(ctx context.Context) error

type Policy 

type Policy[
	ResourceType APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
] struct {
	ID            constants.PolicyID
	ResourceTypes []Resource[ResourceType, Action]
}

type Reason 

type Reason string

type RepoAction added in v0.5.0 

type RepoAction string

type RepoResourceType added in v0.5.0 

type RepoResourceType string

type Request 

type Request[TUser UserRequest, TResourceTypeName, TAction comparable] struct {
	ID               string            // required
	User             TUser             // required
	ResourceTypeName TResourceTypeName // optional
	Action           TAction           // optional
}

func NewRequest 

func NewRequest[TUser UserRequest, TResourceTypeName, TAction comparable](
	ctx context.Context, user TUser,
	resourceTypeName TResourceTypeName, action TAction,
) (*Request[TUser, TResourceTypeName, TAction], error)

func (Request[Tuser, TResourceTypeName, TAction]) GetActionString added in v0.5.0 

func (r Request[Tuser, TResourceTypeName, TAction]) GetActionString() string

func (Request[Tuser, TResourceTypeName, TAction]) GetResourceTypeNameString added in v0.5.0 

func (r Request[Tuser, TResourceTypeName, TAction]) GetResourceTypeNameString() string

func (Request[Tuser, TResourceTypeName, TAction]) IsEmpty added in v0.9.0 

func (r Request[Tuser, TResourceTypeName, TAction]) IsEmpty() bool

func (Request[Tuser, TResourceTypeName, TAction]) IsValidContext added in v0.9.0 

func (r Request[Tuser, TResourceTypeName, TAction]) IsValidContext(ctx context.Context) error

type Resource added in v0.9.0 

type Resource[
	Type APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
] struct {
	Type    Type
	Actions []Action
}

type Restricted 

type Restricted struct {
	APIResourceTypeName APIResourceType
	APIAction           APIAction
}

type RolePolicies 

type RolePolicies[
	Role constants.BusinessRole | constants.InternalRole,
	Resource APIResourceType | RepoResourceType,
	Action APIAction | RepoAction,
] map[Role][]Policy[Resource, Action]

type TenantID 

type TenantID string

type UserRequest added in v0.9.0 

type UserRequest interface {
	IsEmpty() bool
	IsValidContext(ctx context.Context) error
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.