Documentation
¶
Overview ¶
Package tablesource is the registrar's view of the two kinds of stored file a table is built over: how a managed resource and a portal asset are resolved into a tableregister.Source, and under which rule.
Three resolutions serve three questions, and they are kept together because they read the same two stores and build the same Source from the same record. Subjects decides whether THIS caller may act on the file, which is what the register and unregister routes and the manage_table tool ask. RefLookup resolves a page of records at once for the cross-source listing, where authority is a field on the answer rather than the answer itself. Locator resolves a record with no caller at all, for the follow a content write triggers (#1536): the write was authorized by the surface that made it, and the follow acts for the registrant.
It is its own package rather than part of the HTTP composition root because nothing in it composes anything: it is the rule for who may register a file and the shape of a file as the registrar sees it, applied identically by every door.
Index ¶
- func AssetSubject(store portal.AssetStore, adminRoles []string) tableregister.Subject
- func AssetVisibleTo(asset portal.Asset, caller tableregister.Caller, adminRoles []string) bool
- func HasAnyRole(held, want []string) bool
- func Locator(resources resource.Store, resourceBucket string, assets portal.AssetStore) tableregister.Locator
- func RefLookup(resources resource.Store, bucket string, assets portal.AssetStore, ...) tableregister.Sources
- func ResourceSubject(store resource.Store, bucket string) tableregister.Subject
- func Subjects(resources resource.Store, resourceBucket string, assets portal.AssetStore, ...) map[string]tableregister.Subject
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AssetSubject ¶
func AssetSubject(store portal.AssetStore, adminRoles []string) tableregister.Subject
AssetSubject resolves a portal asset for the table surfaces.
func AssetVisibleTo ¶
AssetVisibleTo reports whether this caller may act on an asset through the table surfaces.
An asset belongs to one person, so the owner and an administrator reach it and nobody else does; an editor share does not carry it, because registering publishes the file's contents into a schema everyone with the connection can read, which is owner authority the way sharing is.
Ownership is the portal's own judgment (assetOwnerOf), so a table over a managed script's output is registered, listed and dropped by the same person the portal calls its owner, and by nobody else.
The administrator arm is checked twice on purpose: a caller assembled by a surface that does not resolve IsAdmin still carries the roles it was authenticated with, and an administrator is unrestricted whichever door they came through.
func HasAnyRole ¶
HasAnyRole reports whether held contains any of want.
func Locator ¶
func Locator(resources resource.Store, resourceBucket string, assets portal.AssetStore) tableregister.Locator
Locator resolves a source by kind and id with no authority check. It is what a follow reads the source's new head through (#1536): the write that moved the head was authorized by the surface that made it, and the follow acts for the registrant, not for the caller of the write. A kind whose store is absent, a record that is gone, and a deleted asset all answer ok=false.
func RefLookup ¶
func RefLookup( resources resource.Store, bucket string, assets portal.AssetStore, adminRoles []string, ) tableregister.Sources
RefLookup dispatches a listing's source resolution to the store that holds that kind, the way Subjects does for the per-source routes.
func ResourceSubject ¶
func ResourceSubject(store resource.Store, bucket string) tableregister.Subject
ResourceSubject resolves a managed resource for the table surfaces.
The rule is authority to CHANGE the resource, not authority to read it: resource.CanModifyResource, which is the uploader, a platform administrator, or an administrator of the scope the resource lives in -- the same rule that governs updating and deleting it. Registering publishes the file's contents into a schema everyone granted the connection can read, and resource scopes are not carried into Trino (docs/security/threat-model.md), so a read rule here would let anyone who can see a persona-scoped file widen its audience. This matches the asset rule below, so one sentence describes both kinds.
func Subjects ¶
func Subjects( resources resource.Store, resourceBucket string, assets portal.AssetStore, adminRoles []string, ) map[string]tableregister.Subject
Subjects is the one place a stored file is resolved and the caller's authority over it is decided, per kind. Both surfaces take their resolvers from here: the REST routes convert their authenticated portal user into a Caller, and the tool reads one from the platform context.
A kind whose store is absent has no entry, which leaves that kind unregisterable on both surfaces rather than half-served on one.
Types ¶
This section is empty.
Source Files