Documentation
¶
Overview ¶
Package resourcegrant stores resource grants (ADR-008): a principal's role (viewer, contributor or maintainer) on one resource of an organization, without organization-wide access.
The grants table, sf_resource_grants, is the record in both authorization modes. The role-based provider reads it at check time (rbac.WithResourceGrants); the relationship-based provider reads the relationships this service mirrors into the graph through an authz.ResourceGrantSyncer, so a deployment that switches modes rebuilds its graph from the table.
A grant to a principal with no membership in the resource's organization creates a collaborator membership in the same transaction, and revoking the principal's last grant there removes it. Reducing or removing a grant records an access change (accesschange.GrantReduced), and removing the membership records another (accesschange.MembershipRemoved), so relying parties refuse tokens issued before either.
Index ¶
- Variables
- type Option
- type Service
- func (s *Service) GrantInTx(ctx context.Context, tx *ent.Tx, principalID uuid.UUID, ...) (func(context.Context) error, error)
- func (s *Service) GrantResourceRole(ctx context.Context, principalID uuid.UUID, resource authz.ResourceRef, ...) error
- func (s *Service) ListResourceGrants(ctx context.Context, resource authz.ResourceRef) ([]authz.Grant, error)
- func (s *Service) ListResources(ctx context.Context, principalID uuid.UUID, resourceType string, ...) (authz.ResourceSet, error)
- func (s *Service) OrganizationRoles(ctx context.Context, principalID uuid.UUID) (map[uuid.UUID]string, error)
- func (s *Service) ResourceRole(ctx context.Context, principalID uuid.UUID, resource authz.ResourceRef) (string, error)
- func (s *Service) RevokeResourceRole(ctx context.Context, principalID uuid.UUID, resource authz.ResourceRef) error
- func (s *Service) Validate(ref authz.ResourceRef, role string) error
Constants ¶
This section is empty.
Variables ¶
var ErrInactiveMembership = errors.New("resourcegrant: the principal's membership in the organization is inactive")
ErrInactiveMembership means the principal has a deactivated membership in the resource's organization that is not a collaborator's. Reactivate the membership, or remove it, before granting.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*Service)
Option configures a Service.
func WithAccessChangeSink ¶
func WithAccessChangeSink(sink accesschange.Sink) Option
WithAccessChangeSink announces the access changes the service records to sink after the transaction that recorded them commits (ADR-010). The records are written whether or not a sink is set.
func WithAuthzSyncer ¶
func WithAuthzSyncer(syncer authz.RelationshipSyncer, mode authz.SyncMode) Option
WithAuthzSyncer mirrors collaborator memberships and grants to the authorization graph. The syncer writes memberships through authz.RelationshipSyncer; grants are written only when it also implements authz.ResourceGrantSyncer. In authz.SyncModeStrict a failed write is returned after the rows were stored; in SyncModeEventual (the default) it is logged.
func WithLogger ¶
WithLogger sets the logger that records sync failures.
func WithVocabularies ¶
func WithVocabularies(registry *authz.VocabularyRegistry) Option
WithVocabularies restricts grants to resource types of the registered applications: the type's "{app}_" prefix must name a vocabulary.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service stores resource grants. It implements authz.ResourceGranter and authz.ResourceGrantReader.
func NewService ¶
NewService returns a Service over client.
func (*Service) GrantInTx ¶
func (s *Service) GrantInTx(ctx context.Context, tx *ent.Tx, principalID uuid.UUID, resource authz.ResourceRef, role string, grantedBy uuid.UUID) (func(context.Context) error, error)
GrantInTx gives the principal a role on the resource inside the caller's transaction, for flows that create a membership and a grant together, such as accepting an invitation. The principal's membership may have been created in tx, uncommitted. It records any access change in tx and returns a function to call after tx commits, which announces the changes and writes the membership and grant to the authorization graph; its error is the sync error GrantResourceRole would return.
func (*Service) GrantResourceRole ¶
func (s *Service) GrantResourceRole(ctx context.Context, principalID uuid.UUID, resource authz.ResourceRef, role string, grantedBy uuid.UUID) error
GrantResourceRole gives the principal a role on the resource, replacing any role it held there. It creates a collaborator membership when the principal has none in the resource's organization.
func (*Service) ListResourceGrants ¶
func (s *Service) ListResourceGrants(ctx context.Context, resource authz.ResourceRef) ([]authz.Grant, error)
ListResourceGrants lists the grants on one resource, highest role first.
func (*Service) ListResources ¶
func (s *Service) ListResources(ctx context.Context, principalID uuid.UUID, resourceType string, permission authz.Action) (authz.ResourceSet, error)
ListResources returns the resources of resourceType on which the principal holds permission through a grant, in organizations where its membership is active. Organization-wide access is the role-based provider's to add (OrganizationIDs): it depends on its permission map.
func (*Service) OrganizationRoles ¶
func (s *Service) OrganizationRoles(ctx context.Context, principalID uuid.UUID) (map[uuid.UUID]string, error)
OrganizationRoles returns the principal's role in each organization where its membership is active.
func (*Service) ResourceRole ¶
func (s *Service) ResourceRole(ctx context.Context, principalID uuid.UUID, resource authz.ResourceRef) (string, error)
ResourceRole returns the principal's role on the resource through a grant, or "" when it has none or its membership in the resource's organization is not active.
func (*Service) RevokeResourceRole ¶
func (s *Service) RevokeResourceRole(ctx context.Context, principalID uuid.UUID, resource authz.ResourceRef) error
RevokeResourceRole removes the principal's grant on the resource, and the principal's collaborator membership when it was their last grant in the organization.
func (*Service) Validate ¶
func (s *Service) Validate(ref authz.ResourceRef, role string) error
Validate checks a grant's role and reference as GrantResourceRole does, without writing: the role is a resource role, the reference is well formed and, with WithVocabularies, its type belongs to a registered application and accepts collaborators. Invitations validate with it when they are created.
Source Files