Documentation
¶
Overview ¶
Package consoleauthz is the console's authorization rules for a module that runs a console operation on the caller snapshot (consolecall.Caller). They are the rules of the console's own gates (requireRole, requireWorkspace, requireOwner), word for word, so moving an operation into a module changes where the check runs and not what it allows.
A refusal is a modcall.Error with modcall.CodeForbidden (or CodeUnauthenticated for a snapshot naming no one) and a message safe to show the person.
Index ¶
- Constants
- func Actor(id access.Identity) audit.Actor
- func ActorOf(c consolecall.Caller) audit.Actor
- func MayOwned(id access.Identity, want access.Role, owner string) bool
- func OwnerChoices(id access.Identity, dirs []Directory) (refs []*directoryrosterv1.DirectoryRef, mayNone bool)
- func OwnerDomains(dirs []Directory) map[string]string
- func RequireAnywhere(c consolecall.Caller, want access.Role) (access.Identity, error)
- func RequireOrg(c consolecall.Caller, want access.Role, owner, org string) (access.Identity, error)
- func RequireOwner(c consolecall.Caller, want access.Role, owner, subject string) (access.Identity, error)
- func RequireOwnerChange(c consolecall.Caller, owner string, dirs func() ([]Directory, error)) (access.Identity, error)
- func RequireRole(c consolecall.Caller, want access.Role) (access.Identity, error)
- func RequireWorkspace(c consolecall.Caller, want access.Role, workspace string) (access.Identity, error)
- func ResolveOwner(id access.Identity, requested string, dirs []Directory) (string, error)
- type Directory
Constants ¶
const CodeUnauthenticated = "unauthenticated"
CodeUnauthenticated is the code of a snapshot with no actor.
Variables ¶
This section is empty.
Functions ¶
func Actor ¶
Actor is an identity as the trail names it: a workload by its service account, a recovery by the identity it completed as, and a person by their address.
func ActorOf ¶
func ActorOf(c consolecall.Caller) audit.Actor
ActorOf is the caller snapshot as the trail names it, as Actor.
func MayOwned ¶
MayOwned reports whether an identity holds a role over a thing owned by owner: the installation-wide role always does, and the same role held over the owning directory. With no owner only the installation-wide role does.
func OwnerChoices ¶
func OwnerChoices(id access.Identity, dirs []Directory) (refs []*directoryrosterv1.DirectoryRef, mayNone bool)
OwnerChoices are the directories the caller may name as an owner when it connects something, and whether it may name none. The installation-wide operator may name any connected directory, or none; a scoped operator only the connected directories it operates.
func OwnerDomains ¶
OwnerDomains maps a directory id to every domain it is authoritative for, sorted and joined with ", ": the one text a row names its owner by.
func RequireAnywhere ¶
RequireAnywhere is the gate on a page that lists workspaces and shows only the ones the caller may see.
func RequireOrg ¶
RequireOrg is RequireOwner for a GitHub organisation: owner is the directory workspace the organisation's record names, org its login.
func RequireOwner ¶
func RequireOwner(c consolecall.Caller, want access.Role, owner, subject string) (access.Identity, error)
RequireOwner is the gate on something done to a thing another party owns, by the owning directory's workspace id: owner empty, only the installation-wide role passes; owner set, that role passes and so does the role held over that directory. subject names the thing, so the refusal says whose directory the caller was missing.
func RequireOwnerChange ¶
func RequireOwnerChange(c consolecall.Caller, owner string, dirs func() ([]Directory, error)) (access.Identity, error)
RequireOwnerChange is the gate on changing a recorded owner: the installation-wide operator alone, and only to a connected directory or to none. dirs reads the connected directories, and is asked only for an owner that is not empty.
func RequireRole ¶
RequireRole is the gate that needs the installation-wide role.
func RequireWorkspace ¶
func RequireWorkspace(c consolecall.Caller, want access.Role, workspace string) (access.Identity, error)
RequireWorkspace is RequireRole for something done to one workspace: it passes for the installation-wide role and for the role held over that workspace.
func ResolveOwner ¶
ResolveOwner is THE connect-time rule: who the owner of a thing about to be connected is, given who is connecting it and what they asked for.
- The installation-wide operator chooses: any connected directory, or none (an empty request).
- An operator scoped to exactly one connected directory is that directory's operator for this: the owner is it, whether they name it or leave the choice empty.
- An operator scoped to several chooses among them, and must.
- Anything else is refused: a directory the caller does not operate, or one that is not connected, is never recorded.
Types ¶
type Directory ¶
type Directory = consolecall.Directory
Directory is one connected directory as an owner is chosen and shown. The console tells a module the directories it can see (consolecall.DirectoryFacts), because a module reads no directory snapshot of its own.
Source Files