The highest tagged major version is
Documentation
¶
Overview ¶
Package static provides an authorization.PolicyResolver whose policy is fixed at construction.
This is the default backend, and the one to reach for until something forces otherwise: it needs no database, no migrations, and no configuration, and it resolves without I/O. Policy lives wherever the caller declares its roles — as Go constants, or as YAML loaded into a config struct.
Graduate to authorization/database when roles themselves must become editable data: when an operator has to define a new role, or change what an existing one grants, without shipping a release. Reassigning a principal's roles does not require it — role assignments belong to the consumer either way.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶
type Option func(*Resolver)
Option configures a Resolver.
func WithLogger ¶
WithLogger attaches a logger, which the Resolver uses only to warn about a policy that will deny everything.
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver resolves role names against a policy fixed at construction.
func NewResolver ¶
func NewResolver(roles []authorization.Role, opts ...Option) (*Resolver, error)
NewResolver builds a Resolver over roles, expanding inheritance once.
It returns an error for a malformed policy — an unnamed role, a duplicate, a parent that is not defined, or an inheritance cycle — so that a policy mistake fails at startup rather than as a puzzling denial later.
Zero roles is valid and produces a resolver that denies everything. That is deliberate: the zero-value configuration has to build, or the default provider would not be usable without setup. It logs a warning, because a service that denies every request is more likely to be a missing configuration than an intent.
func (*Resolver) PermissionsForRoles ¶
func (r *Resolver) PermissionsForRoles(_ context.Context, roles ...string) (*authorization.PermissionSet, error)
PermissionsForRoles returns the union of the effective permissions of the named roles. It never returns an error: the policy is already validated and resolution touches nothing outside this process.
Source Files