Documentation
¶
Overview ¶
Package roles wires the ADR-0136 RolesAssignment model to the Cedar PDP: a store-backed WriterLister that feeds the generalized single-writer forbid's `writers` set, and a compile helper that turns RolesAssignments into the synthetic read/query/invoke permits the PolicySource aggregates.
Index ¶
- func CompilePolicies(ctx context.Context, s store.Store) ([]v1.Policy, string, error)
- type Lister
- func (l *Lister) BlobWriters(ctx context.Context, ns v1.NamespaceName, bucket, prefix string) []cedartypes.EntityUID
- func (l *Lister) KVWriters(ctx context.Context, ns v1.NamespaceName, kvStore, table string) []cedartypes.EntityUID
- func (l *Lister) SQLWriters(ctx context.Context, ns v1.NamespaceName, database string) []cedartypes.EntityUID
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CompilePolicies ¶
CompilePolicies compiles every RolesAssignment in the store into synthetic read/query/invoke Cedar permits (ADR-0136) — appended by the PolicySource alongside user Policies + EgressPolicies. Write grants are NOT compiled here (they gate the forbid via the Lister above). It also returns its List's collection resourceVersion, the store-wide one, so the policy cache recompiles on change (ADR-0202).
Types ¶
type Lister ¶
type Lister struct {
// contains filtered or unexported fields
}
Lister is a store-backed cedar.WriterLister (ADR-0136): it lists a namespace's RolesAssignments and returns the writer principals whose writer-role grant covers a given blob prefix / kv table.
func NewLister ¶
NewLister builds the store-backed WriterLister. store.Store satisfies cedar.MetaReader (same Get), so it backs the role resolver directly.
func (*Lister) BlobWriters ¶
func (l *Lister) BlobWriters(ctx context.Context, ns v1.NamespaceName, bucket, prefix string) []cedartypes.EntityUID
BlobWriters returns the principals with a writer-role grant covering the (bucket, prefix).
func (*Lister) KVWriters ¶
func (l *Lister) KVWriters(ctx context.Context, ns v1.NamespaceName, kvStore, table string) []cedartypes.EntityUID
KVWriters returns the principals with a writer-role grant covering the (store, table).
func (*Lister) SQLWriters ¶ added in v0.13.0
func (l *Lister) SQLWriters(ctx context.Context, ns v1.NamespaceName, database string) []cedartypes.EntityUID
SQLWriters returns the principals whose grant covering the SQL database holds sql::write (ADR-0233): a role writing only KV or blob, such as Contributor, makes no database writer.
Source Files