Documentation
¶
Overview ¶
Package roles wires the ADR-0136 RolesAssignment model to the Cedar PDP: a store-backed WriterLister that feeds the generalized single-writer forbid's `writers` set, and a compile helper that turns RolesAssignments into the synthetic read/query/invoke permits the PolicySource aggregates.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CompilePolicies ¶
CompilePolicies compiles every RolesAssignment in the store into synthetic read/query/invoke Cedar permits (ADR-0136) — appended by the PolicySource alongside user Policies + EgressPolicies. Write grants are NOT compiled here (they gate the forbid via the Lister above). It also returns the max RolesAssignment resourceVersion so the policy cache recompiles on change.
Types ¶
type Lister ¶
type Lister struct {
// contains filtered or unexported fields
}
Lister is a store-backed cedar.WriterLister (ADR-0136): it lists a namespace's RolesAssignments and returns the writer principals whose writer-role grant covers a given blob prefix / kv table.
func NewLister ¶
NewLister builds the store-backed WriterLister. store.Store satisfies cedar.MetaReader (same Get), so it backs the role resolver directly.
func (*Lister) BlobWriters ¶
func (l *Lister) BlobWriters(ctx context.Context, ns v1.NamespaceName, bucket, prefix string) []cedartypes.EntityUID
BlobWriters returns the principals with a writer-role grant covering the (bucket, prefix).
func (*Lister) KVWriters ¶
func (l *Lister) KVWriters(ctx context.Context, ns v1.NamespaceName, kvStore, table string) []cedartypes.EntityUID
KVWriters returns the principals with a writer-role grant covering the (store, table).
Source Files