Documentation
¶
Overview ¶
Package rbac provides the role-based authorization provider, the "rbac" mode of ADR-008.
This provider uses role hierarchy and permission mappings to make authorization decisions, and, with WithResourceGrants, consults direct grants of resource roles on individual resources. It has no external dependencies and is suitable for applications whose access is organization roles, application roles and direct grants.
Index ¶
- Variables
- type Option
- func WithManagerRoleGetter(fn authz.ManagerRoleGetter) Option
- func WithOwnerFullAccess(enabled bool) Option
- func WithPermissions(p authz.RolePermissions) Option
- func WithPlatformAdminBypass(enabled bool) Option
- func WithPlatformAdminChecker(fn func(ctx context.Context, principalID uuid.UUID) (bool, error)) Option
- func WithResourceGrants(g ResourceGrants) Option
- func WithRoleGetter(fn func(ctx context.Context, principalID, orgID uuid.UUID) (string, error)) Option
- func WithRoleHierarchy(h authz.RoleHierarchy) Option
- type Provider
- func (a *Provider) Can(ctx context.Context, principal authz.Principal, action authz.Action, ...) (bool, error)
- func (a *Provider) CanAll(ctx context.Context, principal authz.Principal, actions []authz.Action, ...) (bool, error)
- func (a *Provider) CanAny(ctx context.Context, principal authz.Principal, actions []authz.Action, ...) (bool, error)
- func (a *Provider) CanForOrg(ctx context.Context, principal authz.Principal, orgID uuid.UUID, ...) (bool, error)
- func (a *Provider) Decide(ctx context.Context, principal authz.Principal, action authz.Action, ...) (authz.Decision, error)
- func (a *Provider) Filter(ctx context.Context, principal authz.Principal, action authz.Action, ...) ([]authz.Resource, error)
- func (a *Provider) GetRole(ctx context.Context, principal authz.Principal, orgID uuid.UUID) (string, error)
- func (a *Provider) GrantResourceRole(ctx context.Context, principalID uuid.UUID, resource authz.ResourceRef, ...) error
- func (a *Provider) IsMember(ctx context.Context, principal authz.Principal, orgID uuid.UUID) (bool, error)
- func (a *Provider) IsPlatformAdmin(ctx context.Context, principal authz.Principal) (bool, error)
- func (a *Provider) ListResourceGrants(ctx context.Context, resource authz.ResourceRef) ([]authz.Grant, error)
- func (a *Provider) ListResources(ctx context.Context, principalID uuid.UUID, resourceType string, ...) (authz.ResourceSet, error)
- func (a *Provider) RevokeResourceRole(ctx context.Context, principalID uuid.UUID, resource authz.ResourceRef) error
- type ResourceGrants
Constants ¶
This section is empty.
Variables ¶
var ErrNoResourceGrants = errors.New("rbac: resource grants are not configured (use WithResourceGrants)")
ErrNoResourceGrants is returned by the grant operations of a Provider built without WithResourceGrants.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*Provider)
Option configures an Provider.
func WithManagerRoleGetter ¶
func WithManagerRoleGetter(fn authz.ManagerRoleGetter) Option
WithManagerRoleGetter sets the function that returns the manager roles one principal holds over another. With it, permissions on authz.ResourceTypePrincipal resources follow authz.ManagerRolePermissions, matching the principal relations of the SpiceDB base schema.
func WithOwnerFullAccess ¶
WithOwnerFullAccess enables full access for resource owners.
func WithPermissions ¶
func WithPermissions(p authz.RolePermissions) Option
WithPermissions sets a custom permission mapping.
func WithPlatformAdminBypass ¶
WithPlatformAdminBypass enables platform admin bypass for all checks.
func WithPlatformAdminChecker ¶
func WithPlatformAdminChecker(fn func(ctx context.Context, principalID uuid.UUID) (bool, error)) Option
WithPlatformAdminChecker sets the function to check platform admin status.
func WithResourceGrants ¶
func WithResourceGrants(g ResourceGrants) Option
WithResourceGrants gives the provider direct resource grants (ADR-008). Can and Decide then allow view, edit and manage on a resource the principal holds a role on after the organization role has not, and the provider implements authz.ResourceGranter by delegating to g.
func WithRoleGetter ¶
func WithRoleGetter(fn func(ctx context.Context, principalID, orgID uuid.UUID) (string, error)) Option
WithRoleGetter sets the function to retrieve a principal's role in an organization.
func WithRoleHierarchy ¶
func WithRoleHierarchy(h authz.RoleHierarchy) Option
WithRoleHierarchy sets a custom role hierarchy.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements the Authorizer interface using role hierarchy and permissions.
func (*Provider) Can ¶
func (a *Provider) Can(ctx context.Context, principal authz.Principal, action authz.Action, resource authz.Resource) (bool, error)
Can checks if a principal can perform an action on a resource.
func (*Provider) CanAll ¶
func (a *Provider) CanAll(ctx context.Context, principal authz.Principal, actions []authz.Action, resource authz.Resource) (bool, error)
CanAll checks if a principal can perform all specified actions on a resource.
func (*Provider) CanAny ¶
func (a *Provider) CanAny(ctx context.Context, principal authz.Principal, actions []authz.Action, resource authz.Resource) (bool, error)
CanAny checks if a principal can perform any of the specified actions on a resource.
func (*Provider) CanForOrg ¶
func (a *Provider) CanForOrg(ctx context.Context, principal authz.Principal, orgID uuid.UUID, action authz.Action, resource authz.Resource) (bool, error)
CanForOrg checks permission scoped to a specific organization.
func (*Provider) Decide ¶
func (a *Provider) Decide(ctx context.Context, principal authz.Principal, action authz.Action, resource authz.Resource) (authz.Decision, error)
Decide returns a detailed authorization decision.
func (*Provider) Filter ¶
func (a *Provider) Filter(ctx context.Context, principal authz.Principal, action authz.Action, resources []authz.Resource) ([]authz.Resource, error)
Filter returns only the resources the principal can access with the given action.
func (*Provider) GetRole ¶
func (a *Provider) GetRole(ctx context.Context, principal authz.Principal, orgID uuid.UUID) (string, error)
GetRole returns the principal's role in an organization.
func (*Provider) GrantResourceRole ¶
func (a *Provider) GrantResourceRole(ctx context.Context, principalID uuid.UUID, resource authz.ResourceRef, role string, grantedBy uuid.UUID) error
GrantResourceRole gives the principal a role on the resource through the configured grant store. Granting to a principal with no membership in the resource's organization adds a collaborator membership.
func (*Provider) IsMember ¶
func (a *Provider) IsMember(ctx context.Context, principal authz.Principal, orgID uuid.UUID) (bool, error)
IsMember checks if a principal is a member of an organization.
func (*Provider) IsPlatformAdmin ¶
IsPlatformAdmin checks if a principal has platform-wide admin access.
func (*Provider) ListResourceGrants ¶
func (a *Provider) ListResourceGrants(ctx context.Context, resource authz.ResourceRef) ([]authz.Grant, error)
ListResourceGrants lists the grants on one resource, highest role first.
func (*Provider) ListResources ¶
func (a *Provider) ListResources(ctx context.Context, principalID uuid.UUID, resourceType string, permission authz.Action) (authz.ResourceSet, error)
ListResources returns what the principal may access of resourceType with permission (view, edit or manage), in two parts an application applies as `organization_id IN (OrganizationIDs) OR id IN (IDs)`:
- IDs are the resources the principal holds a direct grant on whose role grants the permission, in organizations where its membership is active;
- OrganizationIDs are the organizations in which the principal's organization role grants "{resourceType}.{permission}" in the provider's permission map, which makes the permission hold on every resource of the type there.
The platform-admin bypass and resource ownership of Can are not part of the answer: an administrator or owner is not enumerated here.
func (*Provider) RevokeResourceRole ¶
func (a *Provider) RevokeResourceRole(ctx context.Context, principalID uuid.UUID, resource authz.ResourceRef) error
RevokeResourceRole removes the principal's grant on the resource; revoking a collaborator's last grant removes the membership.
type ResourceGrants ¶
type ResourceGrants interface {
authz.ResourceGranter
authz.ResourceGrantReader
}
ResourceGrants is the store of resource grants the provider consults and delegates the grant operations to. identity/resourcegrant.Service implements it.
Source Files