rbac

package

v0.36.0 Latest Latest Go to latest Published: Jul 8, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/scttfrdmn/prism

Links

Open Source Insights

Documentation ¶

Overview ¶

Package rbac provides role-based access control for Prism. Roles map user identities (profile names) to named permission sets.

Constants ¶

View Source

const (
	RoleAdmin      = "admin"
	RoleResearcher = "researcher"
	RoleStudent    = "student"
	RoleViewer     = "viewer"
)

Built-in role IDs.

View Source

const (
	ActionInstancesLaunch    = "instances:launch"
	ActionInstancesStop      = "instances:stop"
	ActionInstancesStart     = "instances:start"
	ActionInstancesTerminate = "instances:terminate"
	ActionInstancesView      = "instances:view"
	ActionInstancesConnect   = "instances:connect"
	ActionStorageCreate      = "storage:create"
	ActionStorageDelete      = "storage:delete"
	ActionStorageAttach      = "storage:attach"
	ActionStorageDetach      = "storage:detach"
	ActionStorageView        = "storage:view"
	ActionTemplatesView      = "templates:view"
	ActionProfilesView       = "profiles:view"
	ActionProfilesManage     = "profiles:manage"
	ActionPoliciesManage     = "policies:manage"
	ActionAuditView          = "audit:view"
	ActionRBACManage         = "rbac:manage"
)

Well-known action strings used across the daemon for permission checks.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type AssignRoleRequest ¶

type AssignRoleRequest struct {
	UserID string `json:"user_id"`
	RoleID string `json:"role_id"`
}

AssignRoleRequest is the request body for POST /api/v1/rbac/assign.

type Manager ¶

type Manager struct {
	// contains filtered or unexported fields
}

Manager handles role-based access control for Prism. User identities are profile names (as returned by profile.GetCurrentProfile().Name). Assignments are persisted through the seam (design §5) — file-backed on the desktop, and the same logic backs the shared cloud, so role bindings are part of the shared state (§4).

func NewManager ¶

func NewManager() (*Manager, error)

NewManager creates a Manager with built-in default roles and loads any persisted assignments.

func NewManagerForScope ¶ added in v0.36.0

func NewManagerForScope(store seam.Store[State], scope seam.Scope) *Manager

NewManagerForScope builds a Manager over an injected store scoped to a Principal — the cloud/multi-tenant entry point. The role-binding state partitions by scope; logic is unchanged.

func NewManagerWithStore ¶ added in v0.36.0

func NewManagerWithStore(store seam.Store[State]) *Manager

NewManagerWithStore builds a Manager over an injected seam store under the zero Scope (tests / single-tenant callers).

func (*Manager) AssignRole ¶

func (m *Manager) AssignRole(userID, roleID, assignedBy string) error

AssignRole assigns a named role to a user ID, persisting the assignment.

func (*Manager) CanPerformAction ¶

func (m *Manager) CanPerformAction(userID, action string) (bool, string)

CanPerformAction returns (allowed, reason) for the given user and action string. action format: "instances:launch", "storage:delete", etc.

func (*Manager) GetUserRole ¶

func (m *Manager) GetUserRole(userID string) *Role

GetUserRole returns the role for a user. Defaults to the researcher role if no assignment exists.

func (*Manager) ListRoles ¶

func (m *Manager) ListRoles() []*Role

ListRoles returns all available roles (built-in and any custom ones).

func (*Manager) ListUserAssignments ¶

func (m *Manager) ListUserAssignments() map[string]string

ListUserAssignments returns all explicit user→role mappings.

func (*Manager) RemoveRole ¶

func (m *Manager) RemoveRole(userID string) error

RemoveRole removes any role assignment for the user, reverting to the default researcher role.

type Role ¶

type Role struct {
	ID          string    `json:"id"`
	Name        string    `json:"name"`
	Description string    `json:"description"`
	Permissions []string  `json:"permissions"` // e.g., "instances:launch", "storage:delete", "*"
	CreatedAt   time.Time `json:"created_at"`
}

Role represents a named set of permissions.

type State ¶ added in v0.36.0

type State struct {
	UserRoles map[string]string `json:"user_roles"`
}

State is the persisted RBAC record: the single role-binding object stored through the seam. It is exported so seam wiring (e.g. the DynamoDB-backed daemon path) can name the store's type parameter — `seam.Store[rbac.State]`.

type UserRole ¶

type UserRole struct {
	UserID     string    `json:"user_id"`
	RoleID     string    `json:"role_id"`
	AssignedBy string    `json:"assigned_by,omitempty"`
	AssignedAt time.Time `json:"assigned_at"`
}

UserRole records that a user has been assigned a role.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL