requestguard

func AssertAnyFieldPermission ¶

func AssertAnyFieldPermission(ctx corectx.Context, perm Perm, fieldNames []string) *ft.ClientErrors

AssertAnyFieldPermission is the action gate of a field-aware operation: granted when the caller holds perm on the whole resource or on at least one of fieldNames. What the caller may then touch is narrowed per field by AssertFieldNamesPermission / ReadableFields. A refusal reports the resource-level expression, which is the one grant that would answer every field.

func AssertFieldNamesPermission ¶

func AssertFieldNamesPermission(ctx corectx.Context, perm Perm, fieldNames []string) *ft.ClientErrors

AssertFieldNamesPermission is AssertFieldsPermission over a list of field names. No name means nothing to authorize beyond an authenticated principal: deciding whether the action itself is allowed is AssertPermission's or AssertAnyFieldPermission's job.

func AssertFieldsPermission ¶

func AssertFieldsPermission(ctx corectx.Context, perm Perm, fields dmodel.DynamicFields) *ft.ClientErrors

AssertFieldsPermission authorizes perm on every key of fields - the field map a caller writes or asks for. perm names the action, resource and scope; its FieldName is ignored. The error lists every missing field expression at once, so one 403 tells an administrator everything to grant.

func AssertPermission ¶

func AssertPermission(ctx corectx.Context, requiredPerm Perm) *ft.ClientErrors

AssertPermission answers whether the caller may perform requiredPerm.

It holds no rules of its own: it asks CandidateExpressions which stored expressions would answer, and checks whether the caller holds any of them. The SQL matcher and the permission probe ask the same function, which is what keeps the three of them from drifting into disagreeing about the same question.

func BuildExpression ¶

func BuildExpression(actionCode string, resourceCode string, scope ResourceScope, scopeId *model.Id) string

An entitlement expression has the shape `{action}:{resource}[.{field}]:{scope}[/{scopeId}]` where action and resource may be the wildcard `*`, the optional field narrows the grant to one field of the resource, and the scope segment carries an optional id for the org / orgunit scopes.

BuildExpression and BuildFieldExpression are the ONLY producers of expressions in the codebase: the entitlement model persists what they return, the guard matches against what they return, and the SQL matcher builds its IN-list from it. Any second implementation is a defect - the two sides silently drift apart (see plan D1/D4).

func BuildFieldExpression ¶

func BuildFieldExpression(
	actionCode string, resourceCode string, fieldName string, scope ResourceScope, scopeId *model.Id,
) string

BuildFieldExpression is BuildExpression for a field-level grant. An empty fieldName builds the resource-level expression. A field-level expression always names its resource: a field of "any resource" means nothing, so the caller must not pass a wildcard resource with a field.

func CandidateExpressions ¶

func CandidateExpressions(required Perm, evalCtx EvalContext) []string

CandidateExpressions returns every stored expression that would satisfy the required permission for this caller. Holding ANY of them means "allowed".

This is the single definition of the evaluation semantics. The in-memory guard tests set membership against it; the SQL matcher turns it into an IN-list; the permission probe range-scans the cache with it. Because all three consume the same slice they cannot disagree - which is the whole point, since a permission system whose "can I?" and "may I?" answers differ is a security defect, not an inconsistency.

A field-level requirement (Perm.FieldName set) is answered by every resource-level candidate - a grant on the whole resource covers each of its fields - plus the field-level grants at the same scopes. Field grants are additive and never widen to other fields or resources, so they carry no resource wildcard.

Scope widening runs tenant > org > orgunit: a wider grant satisfies a narrower requirement. There is deliberately NO inheritance between org units - a grant on a parent unit does not reach its children, which is the documented entitlement semantics and what makes a unit grant auditable.

func HasPermission ¶

func HasPermission(ctx corectx.Context, requiredPerm Perm) bool

HasPermission is AssertPermission as a yes/no answer.

func IsKnownScope ¶

func IsKnownScope(scope ResourceScope) bool

IsKnownScope reports whether the scope is one this system evaluates.

func OmnipotentExpression ¶

func OmnipotentExpression() string

OmnipotentExpression grants everything, everywhere. It is the only expression whose scope segment is a wildcard.

func ReadableFields ¶

func ReadableFields(ctx corectx.Context, perm Perm, fieldNames []string) []string

ReadableFields returns the subset of fieldNames the caller holds perm on, in input order. It is named for reads, its main use, but answers for whatever action perm names.

func ResourceSegment ¶

func ResourceSegment(resourceCode string, fieldName string) string

ResourceSegment is the middle segment of an expression: the resource code, followed by the field name when there is one.