Affected by 
Documentation
¶
Overview ¶
Package access defines transport-independent resource authorization policies shared by the server's API and HTTP adapters.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type MemoReadClass ¶
type MemoReadClass int
MemoReadClass describes whether the resource is anonymously readable.
const ( // MemoReadClassPrivate is for author, authenticated, member, or share-token reads. MemoReadClassPrivate MemoReadClass = iota // MemoReadClassPublic is for resources currently readable without credentials. MemoReadClassPublic )
type MemoReadContext ¶
type MemoReadContext struct {
Memo *store.Memo
Viewer *store.User
AllowAnonymous bool
CreatorValid bool
SpaceValid bool
ViewerSpaceMember bool
}
MemoReadContext contains the fully resolved authorization context for one memo. Relations never contribute authorization; callers evaluate each relation endpoint independently.
func ResolveMemoReadContext ¶
func ResolveMemoReadContext(ctx context.Context, s MemoReadStore, memo *store.Memo, viewer *store.User, allowAnonymous bool, sharedMemoID *int32) (MemoReadContext, error)
ResolveMemoReadContext resolves a complete read context for one memo and one viewer.
type MemoReadDecision ¶
type MemoReadDecision struct {
Denial MemoReadDenial
Class MemoReadClass
}
MemoReadDecision is the outcome of evaluating memo read access.
func CheckMemoReadContext ¶
func CheckMemoReadContext(ctx MemoReadContext) MemoReadDecision
CheckMemoReadContext evaluates access to exactly one memo. Unknown audience, invalid lifecycle state, and a missing or invalid creator fail closed. A dangling placement only invalidates SPACE reads; other audiences remain memo-local. A share applies only to the exact memo and never to either endpoint of a relation.
func (MemoReadDecision) Allowed ¶
func (d MemoReadDecision) Allowed() bool
Allowed reports whether the read is permitted.
type MemoReadDenial ¶
type MemoReadDenial int
MemoReadDenial describes why a memo read was rejected.
const ( // MemoReadDenialNone means the read is allowed. MemoReadDenialNone MemoReadDenial = iota // MemoReadDenialNotFound hides missing, archived, and invalid memo state. MemoReadDenialNotFound // MemoReadDenialUnauthenticated means the resource requires a signed-in user. MemoReadDenialUnauthenticated // MemoReadDenialPermission means the signed-in user cannot read the resource. MemoReadDenialPermission )
type MemoReadFacts ¶
MemoReadFacts holds the viewer-independent authorization inputs for one memo. They are resolved once and reused across every viewer evaluated against the same memo.
func ResolveMemoReadFacts ¶
func ResolveMemoReadFacts(ctx context.Context, s MemoReadStore, memo *store.Memo) (MemoReadFacts, error)
ResolveMemoReadFacts resolves the memo-local authorization inputs that do not depend on who is reading: whether the memo has a valid creator and, when it is assigned, whether its placement still exists. SpaceValid is authorization input only for SPACE reads and placement-dependent projection and writes; other audiences remain readable through their own memo-local rules.
func (MemoReadFacts) WithViewer ¶
func (f MemoReadFacts) WithViewer(ctx context.Context, s MemoReadStore, viewer *store.User, allowAnonymous bool, sharedMemoID *int32) (MemoReadContext, error)
WithViewer completes the read context for one viewer. Only the membership lookup is viewer-dependent, so evaluating additional viewers against the same memo costs at most one query each.
type MemoReadStore ¶
type MemoReadStore interface {
GetUser(ctx context.Context, find *store.FindUser) (*store.User, error)
GetSpace(ctx context.Context, find *store.FindSpace) (*store.Space, error)
GetSpaceMember(ctx context.Context, find *store.FindSpaceMember) (*store.SpaceMember, error)
}
MemoReadStore is the store subset needed to resolve a memo read context. *store.Store satisfies it.
Source Files