Documentation
¶
Overview ¶
Package graphstate decides which relationships of the authorization graph the identity tables call for.
The identity services ask it before writing a relationship a committed change granted, inside a transaction holding the graph locks (graphlock.Grant), and the graph reconciler (authz/mode) builds its desired set from the same predicates. A grant written after its commit and a repair therefore agree on what access a principal holds, and neither writes access a revocation has removed in the meantime.
The rules:
- Only an active principal holds access. A deactivated principal's memberships, application roles, resource grants, platform administration and manager relations stay in the tables but call for no relationship until the principal is reactivated.
- A membership calls for organization:{org}#{role} while it is active and its organization is active.
- An application role calls for {app}_org:{org}#{role} while the principal holds an active owner, admin or member membership of the organization. Collaborators hold no application roles.
- A resource grant calls for {type}:{id}#{role} while the principal holds an active membership, of any role, of the grant's organization.
- Platform administration calls for platform:global#admin.
- A manager relationship calls for principal:{managed}#{role}@principal:{manager} while it is active and the manager is active.
Index ¶
- Constants
- func AppRole(ctx context.Context, c *ent.Client, orgID, principalID uuid.UUID, ...) (bool, error)
- func AppRoleHolders() []string
- func CanHoldAppRoles(role string) bool
- func HoldingAdmins() []predicate.Human
- func HoldingManagerRelationships() []predicate.ManagerRelationship
- func HoldingMemberships(roles ...string) []predicate.PrincipalMembership
- func Manager(ctx context.Context, c *ent.Client, managedID, managerID uuid.UUID, ...) (bool, error)
- func Membership(ctx context.Context, c *ent.Client, orgID, principalID uuid.UUID, ...) (bool, error)
- func OrgRoles() []string
- func PlatformAdmin(ctx context.Context, c *ent.Client, principalID uuid.UUID) (bool, error)
- func ResourceGrant(ctx context.Context, c *ent.Client, orgID, principalID uuid.UUID, ...) (bool, error)
Constants ¶
const ( RoleOwner = "owner" RoleAdmin = "admin" RoleMember = "member" RoleCollaborator = "collaborator" )
Membership roles.
Variables ¶
This section is empty.
Functions ¶
func AppRole ¶
func AppRole(ctx context.Context, c *ent.Client, orgID, principalID uuid.UUID, application, role string) (bool, error)
AppRole reports whether the tables call for principalID holding role in application for orgID: the stored role, held through a membership that may hold application roles.
func AppRoleHolders ¶
func AppRoleHolders() []string
AppRoleHolders returns the membership roles that may hold application roles.
func CanHoldAppRoles ¶
CanHoldAppRoles reports whether a membership role may hold application roles.
func HoldingAdmins ¶
HoldingAdmins returns the predicates of the humans whose platform administration calls for access.
func HoldingManagerRelationships ¶
func HoldingManagerRelationships() []predicate.ManagerRelationship
HoldingManagerRelationships returns the predicates of the manager relationships that call for access.
func HoldingMemberships ¶
func HoldingMemberships(roles ...string) []predicate.PrincipalMembership
HoldingMemberships returns the predicates of the memberships that call for access with one of roles, every organization role when none is given: active, of an active organization, held by an active principal.
func Manager ¶
func Manager(ctx context.Context, c *ent.Client, managedID, managerID uuid.UUID, role string) (bool, error)
Manager reports whether the tables call for managerID managing managedID with role.
func Membership ¶
func Membership(ctx context.Context, c *ent.Client, orgID, principalID uuid.UUID, roles ...string) (bool, error)
Membership reports whether principalID's membership of orgID calls for access with one of roles (any organization role when none is given).
func OrgRoles ¶
func OrgRoles() []string
OrgRoles returns the membership roles that hold a relation on the organization.
func PlatformAdmin ¶
PlatformAdmin reports whether the tables call for principalID's platform administration.
func ResourceGrant ¶
func ResourceGrant(ctx context.Context, c *ent.Client, orgID, principalID uuid.UUID, resourceType, resourceID, role string) (bool, error)
ResourceGrant reports whether the tables call for principalID holding role on the resource: a grant of that role in orgID, held through a membership of orgID.
Types ¶
This section is empty.
Source Files