Documentation
¶
Overview ¶
Package mode builds the authorization provider a deployment configured (ADR-008): role-based ("rbac") or relationship-based ("rebac") with an engine, from an authz.ModeConfig.
It is a separate package from authz because both providers import authz, and so that loading a configuration file links neither provider. An application reads the `authz` key of its SystemAuth configuration and builds the provider once:
res, err := mode.New(ctx, cfg.Authz, mode.Deps{DB: db, Registry: registry})
if err != nil { ... }
defer res.Close()
orgs := organization.NewService(db, organization.WithAuthzSyncer(res.Syncer))
invites := invite.NewService(db, baseURL, invite.WithAuthzSyncer(res.Syncer), invite.WithResourceGrants(res.Grants))
Both modes implement the same platform contract (organization roles, application roles, resource grants, ListResources) with the same semantics, so switching modes is a configuration change; the membership, role and grant tables remain the record in both.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Deps ¶
type Deps struct {
// DB is the identity database: the membership and grant tables both
// modes keep. Required.
DB *ent.Client
// Registry holds the application vocabularies. It restricts grants to
// registered applications' resource types and, in mode rebac, supplies
// the schema fragments composed into the engine's schema. Optional.
Registry *authz.VocabularyRegistry
// SyncMode decides what a failed write to the relationship engine
// does: authz.SyncModeStrict returns it, SyncModeEventual (the default)
// logs it. Mode rbac writes nothing.
SyncMode authz.SyncMode
// AccessChangeSink announces the access changes grants record
// (ADR-010). Optional.
AccessChangeSink accesschange.Sink
// Logger records sync failures and startup. Default: slog.Default().
Logger *slog.Logger
// PlatformAdmin and ManagerRoles feed the role-based provider's
// platform-admin bypass and manager-role checks (rbac.WithPlatformAdminChecker and rbac.WithManagerRoleGetter). Mode rebac reads
// both from the graph. Optional.
PlatformAdmin func(ctx context.Context, principalID uuid.UUID) (bool, error)
ManagerRoles authz.ManagerRoleGetter
// RBACOptions are further options for the role-based provider, such as
// WithPermissions and WithRoleHierarchy. They apply after the ones
// above.
RBACOptions []rbac.Option
}
Deps are the collaborators a mode needs.
type Result ¶
type Result struct {
// Mode is the configured mode.
Mode authz.Mode
// Provider answers authorization checks and implements the resource
// grant contract. For mode rbac it is a *rbac.Provider, which also
// implements authz.DecisionAuthorizer; for rebac, a *spicedb.Provider.
Provider authz.Provider
// Syncer is the relationship syncer to pass to the identity services
// (organization, invite, approle: their WithAuthzSyncer options). Mode
// rbac returns the no-op syncer, since it reads the tables at check
// time; mode rebac returns the engine's, which also implements
// authz.AppRoleSyncer and authz.ResourceGrantSyncer.
Syncer authz.RelationshipSyncer
// Grants is the resource-grant store both modes keep, for services that
// grant inside their own transactions (invite.WithResourceGrants).
Grants *resourcegrant.Service
// contains filtered or unexported fields
}
Result is a configured mode.
func New ¶
New builds the provider cfg selects. It applies the configuration's defaults and validates it, so a zero authz.ModeConfig is mode rbac.
For mode rebac with an embedded engine it starts the instance and writes the composed schema; with a remote engine it connects, and writes the schema only when the configuration says so (authz.SpiceDBConfig. WriteSchema).
Source Files