Documentation
¶
Overview ¶
Package core defines the bootstrapped core application for identity, roles, and permissions.
Index ¶
Constants ¶
const ( AdminEmail = "admin@localhost" AdminRole = "System Administrator" )
Variables ¶
var App = app.Definition{ Name: "core", Title: "Orjanda Core", Version: "0.1.0", Description: "Core identity, role, and permission documents", Publisher: "Orjanda Framework", Modules: []app.Module{ {Name: "core", Title: "Core"}, }, }
App is the app.Definition for Orjanda Core. See PRD §11 and TAD §4.
var ErrUserAlreadyExists = errors.New("a user with that email already exists")
ErrUserAlreadyExists is returned when CreateSuperuser is asked to create an account whose email is already taken. Callers surface it as a user-facing error rather than a silent no-op.
Functions ¶
func CreateSuperuser ¶ added in v1.0.0
func CreateSuperuser(ctx context.Context, db dal.Database, reg schema.Registry, email, fullName, password string) error
CreateSuperuser explicitly creates a System Administrator account from the operator-supplied email and plaintext password. The password is bcrypt-hashed before storage; the plaintext value is never stored or returned. The role and its full permissions are created alongside the user in a single transaction (TAD §4.2). Returns ErrUserAlreadyExists if the email is taken.
func EnsureAdminRole ¶ added in v1.0.0
EnsureAdminRole creates the "System Administrator" Role (if missing) and grants it full CRUD+Submit permissions on every registered DocType. It is idempotent and safe to call before creating user accounts, so the CLI's explicit admin-creation command can provision the role and its permissions independently of any specific user. See TAD §4.2.
func RegisterUserHooks ¶
RegisterUserHooks installs the core User lifecycle hooks. The stored Password value is a bcrypt hash (TAD §4.1, PRD §15.1): a plaintext password written through the Document Engine is hashed on before_save so the built-in login endpoint (api/auth.go) can verify it. Values that are already bcrypt hashes pass through untouched, so updates that re-send a stored hash are idempotent.
Call once per site with the site's EventBus. The hook is keyed by the docType name, so registration order relative to document registration does not matter.
Types ¶
type Role ¶
type Role struct {
schema.BaseDocument
RoleName string `oj:"required,unique"`
}
Role represents a system role definition. See TAD §4.1.
type RolePermission ¶
type RolePermission struct {
schema.BaseDocument
Role schema.Link `oj:"link=Role,required"`
DocType string `oj:"required"`
Read bool
Write bool
Create bool
Delete bool
Submit bool
}
RolePermission represents a granted set of CRUD/Submit permissions for a Role on a DocType. See TAD §4.1.
func (*RolePermission) DocMeta ¶
func (rp *RolePermission) DocMeta() schema.Meta
func (*RolePermission) Get ¶
func (rp *RolePermission) Get(field string) any
type User ¶
type User struct {
schema.BaseDocument
Email string `oj:"required,unique,format=email,searchable"`
FullName string `oj:"required,searchable"`
Password string `oj:"hidden"`
Roles []UserRole `oj:"child_table"`
Active bool `oj:"default=true"`
}
User represents a system user account. See TAD §4.1.
Source Files