Affected by 
Documentation
¶
Overview ¶
Package access defines transport-independent resource authorization policies shared by the server's API and HTTP adapters.
Index ¶
- func CanManageAttachment(actor *store.User, attachment *store.Attachment) bool
- func CanManageMemo(actor *store.User, memo *store.Memo) bool
- func IsActiveUser(user *store.User) bool
- func IsInstanceAdmin(user *store.User) bool
- type MemoReadClass
- type MemoReadContext
- type MemoReadDecision
- type MemoReadDenial
- type MemoReadFacts
- type MemoReadStore
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CanManageAttachment ¶
func CanManageAttachment(actor *store.User, attachment *store.Attachment) bool
CanManageAttachment reports whether the actor may mutate an attachment row directly: the active owner, or an instance administrator.
func CanManageMemo ¶
CanManageMemo reports whether the actor may perform author-level operations on the memo: the active author, or an instance administrator.
func IsActiveUser ¶
IsActiveUser reports whether the user exists and is in the normal lifecycle state, which every authenticated authorization decision requires.
func IsInstanceAdmin ¶
IsInstanceAdmin reports whether the user is an active application ADMIN. An instance administrator is the superuser for named memo operations: every memo-local authorization check (authorship, audience, Space membership and participation, attachment and reaction ownership) passes. Structural validity still applies, and collection listings keep the audience predicate so feeds never surface other users' private memos.
Types ¶
type MemoReadClass ¶
type MemoReadClass int
MemoReadClass describes whether the resource is anonymously readable.
const ( // MemoReadClassPrivate is for author, authenticated, member, or share-token reads. MemoReadClassPrivate MemoReadClass = iota // MemoReadClassPublic is for resources currently readable without credentials. MemoReadClassPublic )
type MemoReadContext ¶
type MemoReadContext struct {
Memo *store.Memo
Viewer *store.User
AllowAnonymous bool
CreatorValid bool
SpaceValid bool
ViewerSpaceMember bool
}
MemoReadContext contains the fully resolved authorization context for one memo. Relations never contribute authorization; callers evaluate each relation endpoint independently.
func ResolveMemoReadContext ¶
func ResolveMemoReadContext(ctx context.Context, s MemoReadStore, memo *store.Memo, viewer *store.User, allowAnonymous bool, sharedMemoID *int32) (MemoReadContext, error)
ResolveMemoReadContext resolves a complete read context for one memo and one viewer.
type MemoReadDecision ¶
type MemoReadDecision struct {
Denial MemoReadDenial
Class MemoReadClass
}
MemoReadDecision is the outcome of evaluating memo read access.
func CheckMemoReadContext ¶
func CheckMemoReadContext(ctx MemoReadContext) MemoReadDecision
CheckMemoReadContext evaluates access to exactly one memo. Unknown audience, invalid lifecycle state, and a missing or invalid creator fail closed. A dangling placement only invalidates SPACE reads; other audiences remain memo-local. A share applies only to the exact memo and never to either endpoint of a relation.
func (MemoReadDecision) Allowed ¶
func (d MemoReadDecision) Allowed() bool
Allowed reports whether the read is permitted.
type MemoReadDenial ¶
type MemoReadDenial int
MemoReadDenial describes why a memo read was rejected.
const ( // MemoReadDenialNone means the read is allowed. MemoReadDenialNone MemoReadDenial = iota // MemoReadDenialNotFound hides missing, archived, and invalid memo state. MemoReadDenialNotFound // MemoReadDenialUnauthenticated means the resource requires a signed-in user. MemoReadDenialUnauthenticated // MemoReadDenialPermission means the signed-in user cannot read the resource. MemoReadDenialPermission )
type MemoReadFacts ¶
MemoReadFacts holds the viewer-independent authorization inputs for one memo. They are resolved once and reused across every viewer evaluated against the same memo.
func ResolveMemoReadFacts ¶
func ResolveMemoReadFacts(ctx context.Context, s MemoReadStore, memo *store.Memo) (MemoReadFacts, error)
ResolveMemoReadFacts resolves the memo-local authorization inputs that do not depend on who is reading: whether the memo has a valid creator and, when it is assigned, whether its placement still exists. SpaceValid is authorization input only for SPACE reads and placement-dependent projection and writes; other audiences remain readable through their own memo-local rules.
func (MemoReadFacts) WithViewer ¶
func (f MemoReadFacts) WithViewer(ctx context.Context, s MemoReadStore, viewer *store.User, allowAnonymous bool, sharedMemoID *int32) (MemoReadContext, error)
WithViewer completes the read context for one viewer. Only the membership lookup is viewer-dependent, so evaluating additional viewers against the same memo costs at most one query each.
type MemoReadStore ¶
type MemoReadStore interface {
GetUser(ctx context.Context, find *store.FindUser) (*store.User, error)
GetSpace(ctx context.Context, find *store.FindSpace) (*store.Space, error)
GetSpaceMember(ctx context.Context, find *store.FindSpaceMember) (*store.SpaceMember, error)
}
MemoReadStore is the store subset needed to resolve a memo read context. *store.Store satisfies it.
Source Files