rbac

package
v0.18.8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 21, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	TargetServicePrefix = "service:"
	TargetBindingPrefix = "binding:"
)

Grant target entry prefixes for the non-app target kinds. A target entry like service:postgres/* scopes service:* permissions to matching service ids (<type>/<name>, no leading slash); binding:/apps/** scopes binding:* permissions to matching binding paths. Entries without these prefixes are app path targets ("service" and "binding" are reserved words in the target domain position, they cannot be used as app domain patterns)

View Source 
const (
	ResourceApp     = "app"
	ResourceSync    = "sync"
	ResourceService = "service"
	ResourceBinding = "binding"
)

Resource names used for owner permission lookup

View Source 
const RBAC_AUTH_PREFIX = "rbac:"
View Source 
const RBAC_CUSTOM_PREFIX = "custom:" // used for app level custom permissions
View Source 
const RBAC_GROUP_PREFIX = "group:"
View Source 
const RBAC_REGEX_PREFIX = "regex:" // used for regex matching in users list
View Source 
const RBAC_ROLE_PREFIX = "role:"
View Source 
const ReservedRolePrefix = "openrun-"

ReservedRolePrefix is reserved for built-in roles; user-defined role names may not use it

Variables

This section is empty.

Functions

func AppRBACActive added in v0.18.7 

func AppRBACActive(ctx context.Context) bool

AppRBACActive reports whether app level surfaces (X-Openrun-Rbac-Enabled header, request data, plugin permit checks) should treat RBAC as active for this request: the real per-request RBAC state, or a _cl_perm test URL directive (the simulated permission set then replaces allow-all, so apps exercise their permission gated paths against it)

func BuiltinRoleNames added in v0.18.7 

func BuiltinRoleNames() []string

BuiltinRoleNames returns the predefined built-in role names, sorted. UIs list these alongside user-defined roles so they can be selected in grants

func GetTestUrlPerms added in v0.18.7 

func GetTestUrlPerms(ctx context.Context) ([]string, bool)

GetTestUrlPerms returns the simulated permission set, false when not present

func GetTestUrlPrefix added in v0.18.7 

func GetTestUrlPrefix(ctx context.Context) string

GetTestUrlPrefix returns the extended app path prefix (app path plus directive segments), "" when no directives are present

func HasSyncAuthorizer added in v0.18.7 

func HasSyncAuthorizer(ctx context.Context) bool

HasSyncAuthorizer reports whether the context carries a sync run authorizer

func HasTestUrlPerms added in v0.18.7 

func HasTestUrlPerms(ctx context.Context) bool

HasTestUrlPerms reports whether the request carries a simulated permission set

func MatchGlob 

func MatchGlob(appPathGlob string, app types.AppPathDomain) (bool, error)

func ParseGlob 

func ParseGlob(appPathGlob string, apps []types.AppPathDomain) ([]types.AppPathDomain, error)

ParseGlob parses a path spec in the format of domain:path. If domain is not specified, it will match empty domain. glob patters are supported, *:** matches all apps.

func ParseGlobFromInfo 

func ParseGlobFromInfo(appPathGlob string, apps []types.AppInfo) ([]types.AppInfo, error)

ParseGlobFromInfo parses a path spec in the format of domain:path. If domain is not specified, it will match empty domain. glob patters are supported, *:** matches all apps.

func PermissionResource added in v0.18.4 

func PermissionResource(perm types.RBACPermission) string

PermissionResource returns the resource part of a permission name (app, sync, ...)

func ValidateGlob added in v0.18.7 

func ValidateGlob(targetGlob string) error

ValidateGlob checks that a grant target entry is well formed, so bad patterns are rejected when the config is updated instead of erroring every authorization check that evaluates them. An entry is a domain:path app glob, a service:<id glob> entry (matched against <type>/<name> service ids) or a binding:<path glob> entry (matched against binding paths)

func ValidatePermissionName added in v0.18.4 

func ValidatePermissionName(perm types.RBACPermission) error

ValidatePermissionName checks that a permission entry is a valid resource:verb permission or permission glob. Used for local validation of draft edits

func WithSyncAuthorizer added in v0.18.7 

func WithSyncAuthorizer(ctx context.Context, a *SyncAuthorizer) context.Context

WithSyncAuthorizer attaches the frozen sync run authorization to the background run context, activating API enforcement against it

Types

type RBACAPI 

type RBACAPI interface {
	AuthorizeAny(ctx context.Context, permissions []string) (bool, error)
	Authorize(ctx context.Context, permission types.RBACPermission, isAppLevelPermission bool) (bool, error)
	GetCustomPermissions(ctx context.Context) ([]string, error)
}

RBACAPI is the interface used by the app package for app level (custom permission) checks. The management API enforcement methods (AuthorizeAPI, AuthorizeGlobalAPI, GetAPIPermissions) are used through the concrete RBACManager by the server package and are not part of this interface

type RBACManager 

type RBACManager struct {
	*types.Logger
	RbacConfig *types.RBACConfig
	// contains filtered or unexported fields
}

func NewRBACHandler 

func NewRBACHandler(logger *types.Logger, rbacConfig *types.RBACConfig, serverConfig *types.ServerConfig) (*RBACManager, error)

func (*RBACManager) APIEnforced added in v0.18.4 

func (h *RBACManager) APIEnforced(ctx context.Context) bool

APIEnforced reports whether management API RBAC enforcement is active for this request: the RBAC config is enabled (it then applies to every app). The bool is computed once at request setup and stored in the context, so the common case is a single context lookup with no locking or allocation. When that lookup misses, enforcement is still active for a _cl_perm test URL directive (only set on dev apps where enforcement is otherwise inactive; the simulated permission set replaces allow-all, so simulation can only narrow access) and for a background sync run carrying the frozen creator snapshot (SyncAuthorizer).

Trusted administrative paths (authenticated admin/UDS management API requests, token authenticated webhooks, internal background operations) carry the TRUSTED_OPERATION marker and are never enforced. A context with NO marker at all is a propagation bug: enforcement is reported active when RBAC is enabled, and AuthorizeAPI then fails closed for it

func (*RBACManager) Authorize 

func (h *RBACManager) Authorize(ctx context.Context, permission types.RBACPermission, isCustomPermission bool) (bool, error)

Authorize checks if the user has access to the specified permission

func (*RBACManager) AuthorizeAPI added in v0.18.4 

func (h *RBACManager) AuthorizeAPI(ctx context.Context, perm types.RBACPermission,
	target types.AppPathDomain, owner string) (bool, error)

AuthorizeAPI checks if the user can perform the management API operation needing permission perm on the app at target. target must be resolved to the main app path for stage/preview apps. owner is the app creator ("" if not known); the owner of an app holds the configured owner permissions on it without any grant. Returns true without any evaluation when enforcement is not active (see APIEnforced)

func (*RBACManager) AuthorizeAny 

func (h *RBACManager) AuthorizeAny(ctx context.Context, permissions []string) (bool, error)

AuthorizeAny checks if the user has access to any of the specified custom permissions Used for app level permissions, like actions access

func (*RBACManager) AuthorizeGlobalAPI added in v0.18.4 

func (h *RBACManager) AuthorizeGlobalAPI(ctx context.Context, perm types.RBACPermission, owner string) (bool, error)

AuthorizeGlobalAPI checks a global (untargeted) permission like sync:create or config:read. owner is the creator of the specific entry being operated on ("" when not applicable); the owner holds the configured owner permissions on their entries

func (*RBACManager) AuthorizeInt 

func (h *RBACManager) AuthorizeInt(user string, appPathDomain types.AppPathDomain,
	permission types.RBACPermission, groups []string, isAppLevelPermission bool) (bool, error)

func (*RBACManager) AuthorizeResourceAPI added in v0.18.7 

func (h *RBACManager) AuthorizeResourceAPI(ctx context.Context, perm types.RBACPermission,
	resourceId string, owner string) (bool, error)

AuthorizeResourceAPI checks a service or binding scoped permission against the resource identity: the service id (<type>/<name>) for service:* permissions, the binding path for binding:* permissions. owner is the entry's creator ("" if not known); the owner holds the configured owner permissions on their entries

func (*RBACManager) AuthorizeUserPerm added in v0.18.4 

func (h *RBACManager) AuthorizeUserPerm(user string, groups []string, perm types.RBACPermission) (bool, error)

AuthorizeUserPerm evaluates a global permission for the given user and groups directly against this manager's config, without request context. Used for lockout checks when publishing a candidate config

func (*RBACManager) BuildUrlDirectives added in v0.18.7 

func (h *RBACManager) BuildUrlDirectives(perms, roleNames []string, extendedPrefix string) (*UrlDirectives, error)

BuildUrlDirectives builds the test URL directives for a request, resolving _cl_role names against the configured roles (roles are resolved at config update time even when RBAC is disabled, with hierarchy and implications flattened; the built-in openrun-* roles are always defined). Unknown role names are an error (fail closed). The app visible permission list (Perms) is the explicit _cl_perm values plus the custom permissions the roles confer, mirroring what GetCustomPermissions computes for a user granted those roles (a role granting the admin permission confers every custom permission). The resolved roles are immutable snapshots, so a concurrent config update does not affect an in-flight request.

func (*RBACManager) ConfigEnabled added in v0.18.7 

func (h *RBACManager) ConfigEnabled() bool

ConfigEnabled reports whether RBAC is enabled at the config level. Lock free (atomic load), safe on the per-request paths

func (*RBACManager) GetAPIPermissions added in v0.18.4 

func (h *RBACManager) GetAPIPermissions(ctx context.Context, target types.AppPathDomain, owner string) ([]string, error)

GetAPIPermissions returns the management API permissions the user holds: app permissions evaluated against target/owner plus the global permissions the user holds. With no target (empty AppPathDomain, no owner) scoped permissions are reported when held on at least one target of their kind ("can the user do this somewhere"), so UIs can gate chrome for users whose grants are all scoped; enforcement stays per resource at action time. When enforcement is not active, all permissions are returned

func (*RBACManager) GetCustomPermissions 

func (h *RBACManager) GetCustomPermissions(ctx context.Context) ([]string, error)

GetCustomPermissions returns the custom permissions for the user on the current app

func (*RBACManager) GetCustomPermissionsInt 

func (h *RBACManager) GetCustomPermissionsInt(user string, appPathDomain types.AppPathDomain,
	groups []string) ([]string, error)

GetCustomPermissions returns the custom permissions set for the user for the given app path domain Values in returned list do not have the custom: prefix

func (*RBACManager) IsAppRBACEnabled 

func (h *RBACManager) IsAppRBACEnabled(_ context.Context) bool

IsAppRBACEnabled checks if RBAC is enabled. When enabled, RBAC applies to every app (the ctx is unused, kept for the RBACAPI interface)

func (*RBACManager) SnapshotUserGrants added in v0.18.7 

func (h *RBACManager) SnapshotUserGrants(ctx context.Context) (*types.RBACSnapshot, error)

SnapshotUserGrants builds the frozen authorization snapshot for the calling user, stored on a sync entry at create time and enforced on its background runs. Returns nil (no snapshot, runs stay unrestricted) when API enforcement is not active for this call: RBAC disabled, or a unix socket / admin over TCP call with no app context. Group membership (config groups and SSO context groups) is resolved now, so the snapshot stays valid without live group data. Under a _cl_perm test URL directive the real grants of the (anonymous) user are snapshotted, not the simulated set: simulation is a narrowing debug aid and must never mint durable authority.

func (*RBACManager) UpdateRBACConfig 

func (h *RBACManager) UpdateRBACConfig(rbacConfig *types.RBACConfig) error

UpdateRBACConfig resolves and validates rbacConfig and swaps it in atomically: everything is built into locals first and published only when the whole update has succeeded, so a rejected config never leaves partial state behind (mixed old/new groups and roles, or the enabled flag out of sync with the resolved state)

type SyncAuthorizer added in v0.18.7 

type SyncAuthorizer struct {
	// contains filtered or unexported fields
}

SyncAuthorizer evaluates management API permissions against a frozen RBACSnapshot, independent of the live RBAC config. Immutable after construction, safe for concurrent use.

func GetSyncAuthorizer added in v0.18.7 

func GetSyncAuthorizer(ctx context.Context) *SyncAuthorizer

GetSyncAuthorizer returns the sync run authorizer from the context, nil when not present

func NewSyncAuthorizer added in v0.18.7 

func NewSyncAuthorizer(snap *types.RBACSnapshot) *SyncAuthorizer

NewSyncAuthorizer builds the authorizer for a stored snapshot, nil in -> nil out

func (*SyncAuthorizer) Authorize added in v0.18.7 

func (a *SyncAuthorizer) Authorize(perm types.RBACPermission, target types.AppPathDomain,
	resourceId string, owner string) (bool, error)

Authorize mirrors authorizeAPIInt against the snapshot: empty user fails closed, admin bypasses every check, the snapshot user holds the snapshotted owner permissions on assets they own (never approve), and otherwise a grant must match the permission with scoped permissions matched against the grant's target entries of the matching kind (app path domain for app:*, resourceId for service:*/binding:*) and every other permission global

type UrlDirectives added in v0.18.7 

type UrlDirectives struct {
	// Perms is the simulated permission set, in the same form apps see in
	// X-Openrun-Perms (custom permissions without the custom: prefix): the
	// explicit _cl_perm values plus the custom permissions conferred by any
	// _cl_role roles. nil means no simulated permission set.
	Perms []string
	// ExtendedPrefix is the app path plus the raw directive segments, e.g.
	// "/abc/_cl_perm=app:read". Used as the effective app path when
	// generating app-absolute URLs so directive URLs stay sticky.
	ExtendedPrefix string
	// contains filtered or unexported fields
}

UrlDirectives holds the parsed _cl_ test URL directives for a request. Set in the request context (types.TESTURL_DIRECTIVES) only when security.unsafe_enable_testurl_rbac is on and the request is for a dev mode app with none auth (anonymous user) and RBAC inactive for the app. In that state every permission check is allow-all, so the simulated permissions replace allow-all and can only narrow access, never widen it.

func GetUrlDirectives added in v0.18.7 

func GetUrlDirectives(ctx context.Context) *UrlDirectives

GetUrlDirectives returns the test URL directives from the request context, nil when not present

func NewUrlDirectives added in v0.18.7 

func NewUrlDirectives(perms []string, extendedPrefix string) *UrlDirectives

NewUrlDirectives builds the directives with the permission matcher resolved. Matching follows the same rules as real grants: app:manage expands to all app permissions except app:approve, app:approve matches only by its literal name, glob entries match, and entries that are not builtin permissions are treated as custom permissions (matched with or without the custom: prefix).

func (*UrlDirectives) HasPerms added in v0.18.7 

func (d *UrlDirectives) HasPerms() bool

HasPerms reports whether a simulated permission set is present. Safe on nil.

func (*UrlDirectives) MatchesCustomPerm added in v0.18.7 

func (d *UrlDirectives) MatchesCustomPerm(perm string) bool

MatchesCustomPerm reports whether the simulated permission set grants the app level custom permission perm (given without the custom: prefix, as in plugin permit lists). Safe on nil.

func (*UrlDirectives) MatchesPerm added in v0.18.7 

func (d *UrlDirectives) MatchesPerm(perm types.RBACPermission) bool

MatchesPerm reports whether the simulated permission set grants perm: either an explicit _cl_perm value or any _cl_role role grants it. Used for builtin management API permissions. Safe on nil.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.