Documentation
¶
Index ¶
- Constants
- Variables
- func CasbinAliases(collection, alias string) string
- func CasbinBackups(class string) string
- func CasbinClusters() string
- func CasbinData(collection, shard string) string
- func CasbinGroups(group string, groupType string) string
- func CasbinMcp() string
- func CasbinNamespaces(name string) string
- func CasbinNodes(verbosity, class string) string
- func CasbinPolicies(logger logrus.FieldLogger, namespacesEnabled bool, ...) (map[string][]authorization.Policy, error)
- func CasbinReplicate(collection, shard string) string
- func CasbinRoles(role string) string
- func CasbinSchema(collection, shard string) string
- func CasbinUsers(user string) string
- func ContainsNamespaceSeparator(resource string) bool
- func GetUserAndPrefix(name string) (string, string, error)
- func IsOpaqueIDResource(resource string) bool
- func NameHasPrefix(name string) bool
- func PathToPermission(verb, path string) (*models.Permission, error)
- func PermissionToPolicies(permissions ...*models.Permission) ([]*authorization.Policy, error)
- func PoliciesToPermission(logger logrus.FieldLogger, policies ...authorization.Policy) ([]*models.Permission, error)
- func PrefixGroupName(name string) string
- func PrefixRoleName(name string) string
- func RolesToPolicies(roles ...*models.Role) (map[string][]authorization.Policy, error)
- func SubjectNamespace(subject string) (user string, authType authentication.AuthType, namespace string, err error)
- func TrimRoleNamePrefix(name string) string
- func UserNameWithTypeFromId(username string, authType authentication.AuthType) string
- func UserNameWithTypeFromPrincipal(principal *models.Principal) string
- func ValidateStorableCharacters(value string) error
- func ValidateStorableRow(row ...string) error
- func ValidateStorableValue(value string) error
Constants ¶
const ( // https://casbin.org/docs/rbac/#how-to-distinguish-role-from-user // ROLE_NAME_PREFIX to prefix role to help casbin to distinguish on Enforcing ROLE_NAME_PREFIX = "role" + PREFIX_SEPARATOR // OIDC_GROUP_NAME_PREFIX to prefix role to help casbin to distinguish on Enforcing OIDC_GROUP_NAME_PREFIX = "group" + PREFIX_SEPARATOR PREFIX_SEPARATOR = ":" // CRUD allow all actions on a resource // this is internal for casbin to handle admin actions CRUD = "(C)|(R)|(U)|(D)" // CRU allow all actions on a resource except DELETE // this is internal for casbin to handle editor actions CRU = "(C)|(R)|(U)" VALID_VERBS = "(C)|(R)|(U)|(D)|(A)" // InternalPlaceHolder is a place holder to mark empty roles InternalPlaceHolder = "wv_internal_empty" )
Variables ¶
var BuiltInWildcardVerb = map[string]string{ authorization.Admin: VALID_VERBS, authorization.Root: VALID_VERBS, authorization.Viewer: authorization.READ, authorization.ReadOnly: authorization.READ, }
BuiltInWildcardVerb is the wildcard verb pattern Casbin registers for each built-in role: Admin/Root get full CRUD, Viewer/ReadOnly get READ. The matcher specializes namespace-bearing resources at enforce time.
Functions ¶
func CasbinAliases ¶ added in v1.32.0
func CasbinBackups ¶
func CasbinClusters ¶
func CasbinClusters() string
func CasbinData ¶
func CasbinGroups ¶ added in v1.32.5
func CasbinNamespaces ¶ added in v1.38.0
CasbinNamespaces returns the casbin resource string for a namespace name. An empty name expands to the wildcard pattern.
func CasbinNodes ¶
func CasbinPolicies ¶
func CasbinPolicies(logger logrus.FieldLogger, namespacesEnabled bool, casbinPolicies ...[][]string) (map[string][]authorization.Policy, error)
func CasbinReplicate ¶ added in v1.31.0
func CasbinRoles ¶
func CasbinSchema ¶
func CasbinUsers ¶
func ContainsNamespaceSeparator ¶ added in v1.38.0
ContainsNamespaceSeparator reports whether a casbin resource path contains the namespace separator. A hit means qualification only for the collection shapes (schema/data/aliases); for users/<id> and groups/<...>, whose ids may contain ':' (e.g. OIDC usernames), callers must shape-check first.
func GetUserAndPrefix ¶ added in v1.30.0
GetUserAndPrefix splits an internal casbin user key into the user identifier and its prefix and returns them as (user, prefix). The key is `<prefix>:<user>` where prefix is "db", "oidc", or "group" and `<user>` is itself either a bare name or a namespace-qualified `<namespace>:<name>`. Splitting on the first ":" only is what keeps namespaced principals (e.g. `oidc:customer1:alice`) from being mistaken for malformed input.
func IsOpaqueIDResource ¶ added in v1.38.3
IsOpaqueIDResource reports whether resource addresses a users/<id> or groups/<type>/<name> shape, whose id may legitimately contain ':' (e.g. an OIDC username) as part of the id rather than a namespace qualifier.
func NameHasPrefix ¶ added in v1.30.0
func PathToPermission ¶
func PathToPermission(verb, path string) (*models.Permission, error)
func PermissionToPolicies ¶
func PermissionToPolicies(permissions ...*models.Permission) ([]*authorization.Policy, error)
func PoliciesToPermission ¶
func PoliciesToPermission(logger logrus.FieldLogger, policies ...authorization.Policy) ([]*models.Permission, error)
func PrefixGroupName ¶ added in v1.28.5
func PrefixRoleName ¶
func RolesToPolicies ¶
func SubjectNamespace ¶ added in v1.38.3
func SubjectNamespace(subject string) (user string, authType authentication.AuthType, namespace string, err error)
SubjectNamespace returns a grouping subject's user identifier, auth type, and namespace (e.g. "db:customer1:bob" -> "customer1"). A global principal ("db:bob") and a group subject both yield no namespace; a group additionally yields a zero auth type. An unparseable key returns an error so callers can fail closed rather than treat it as global.
func TrimRoleNamePrefix ¶
func UserNameWithTypeFromId ¶ added in v1.30.0
func UserNameWithTypeFromId(username string, authType authentication.AuthType) string
func UserNameWithTypeFromPrincipal ¶ added in v1.30.0
func ValidateStorableCharacters ¶
ValidateStorableCharacters rejects ',' and '"', the policy file's field separator and quote, and any control character, such as the '\n' ending a row. ValidateStorableRow accepts a tab, so rows already stored with one still load. It also rejects invalid UTF-8, which a path parameter can carry and the RAFT log would store as U+FFFD.
func ValidateStorableRow ¶
ValidateStorableRow reports whether a policy row, ptype first, survives a save and load through casbin's file adapter, which writes fields unquoted. A row that does not can keep the node from starting, or read back as an admin grant. Each step below repeats one of the adapter's, since casbin accepts any value and runs the full load only on a file. The rbac package's TestValidateStorableRowMatchesFileAdapter fails if casbin changes a step.
func ValidateStorableValue ¶
ValidateStorableValue rejects user input longer than maxStorableValueLength or with a character ValidateStorableCharacters refuses.
Types ¶
This section is empty.
Source Files