Documentation
¶
Overview ¶
Package membercmd provides the "org" cobra command a host CLI mounts so an operator can add, remove and list an organization's members and their application roles. It opens the identity database directly and applies the changes through organization.Service and approle.Service, exactly as the HTTP API does, but without an authorization check: it is for recovery and bootstrap, such as restoring an owner who lost access or granting the first role in a product before the product can grant one itself.
Access the commands remove (a membership, an application role) is recorded in the database as access changes, where applications read them. In authorization mode rebac the graph is not written from here: the running server's reconciler applies the change at its next run.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultRoles ¶
func DefaultRoles(registry *authz.VocabularyRegistry, opts ...approle.Option) func(*ent.Client) *approle.Service
DefaultRoles builds the application-role service with the host's role vocabularies and entitlement options (for example marketplace.ApproleOptions or approle.EntitleAll), so --role accepts the host's applications. A nil registry knows no application.
Types ¶
type Member ¶
type Member struct {
PrincipalID string `json:"principal_id"`
Email string `json:"email,omitempty"`
Role string `json:"role"`
Active bool `json:"active"`
AppRoles map[string]string `json:"app_roles,omitempty"`
}
Member is one row of "member list".
type Open ¶
Open opens the identity database for one command, returning its client and the function that closes it.
type Options ¶
type Options struct {
// Roles builds the application-role service over an open client.
// Default: DefaultRoles(nil), which knows no application, so roles
// cannot be granted (memberships can still be managed, and removing a
// member still removes the roles it holds).
Roles func(client *ent.Client) *approle.Service
}
Options configure the command.
Source Files