Documentation
¶
Overview ¶
Package rolevisibility decides whether a caller may see another subject's assigned role, given the role's stored name and policies. The rules are shared by every handler that lists a subject's roles so a role is hidden or revealed identically regardless of which endpoint returns it.
Index ¶
- func CallerConfined(namespacesEnabled bool, principal *models.Principal) bool
- func RoleHiddenFromCaller(namespacesEnabled bool, principal *models.Principal, storedRoleName string) bool
- func RoleOperatorReservedFromCaller(namespacesEnabled bool, principal *models.Principal, storedRoleName string) bool
- func RolePoliciesVisibleToPrincipal(ctx context.Context, authorizer authorization.Authorizer, ...) bool
- func RoleVisibleToCaller(ctx context.Context, authorizer authorization.Authorizer, ...) bool
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CallerConfined ¶
CallerConfined reports whether the principal is a namespace-confined caller — its RBAC reads and writes scope to its own namespace. False for global callers and on NS-disabled clusters.
func RoleHiddenFromCaller ¶
func RoleHiddenFromCaller(namespacesEnabled bool, principal *models.Principal, storedRoleName string) bool
RoleHiddenFromCaller reports whether storedRoleName belongs to a namespace other than the caller's, so its very existence must not be revealed. Own-namespace and global roles are visible; only foreign-namespace roles are hidden. Global operators (and NS-disabled clusters) hide nothing.
func RoleOperatorReservedFromCaller ¶
func RoleOperatorReservedFromCaller(namespacesEnabled bool, principal *models.Principal, storedRoleName string) bool
RoleOperatorReservedFromCaller hides an operator-reserved global role from any caller that is not a global operator. Additive to the permission-content gate: it can only hide more, never expose a role that gate would block.
func RolePoliciesVisibleToPrincipal ¶
func RolePoliciesVisibleToPrincipal(ctx context.Context, authorizer authorization.Authorizer, namespacesEnabled bool, principal *models.Principal, policies []authorization.Policy) bool
RolePoliciesVisibleToPrincipal reports whether the caller may see a role with the given policies: it holds ALL-scope on roles, or already holds every permission the role grants (projected into its own namespace when confined).
func RoleVisibleToCaller ¶
func RoleVisibleToCaller(ctx context.Context, authorizer authorization.Authorizer, namespacesEnabled bool, principal *models.Principal, storedRoleName string, policies []authorization.Policy) bool
RoleVisibleToCaller reports whether the caller may see another subject's role given its stored name and policies. A role is hidden when it belongs to another namespace, when it is an operator-reserved global role and the caller is not a global operator, or when the caller does not already hold every permission it grants. A caller's own roles are always visible, so callers skip this check for a self-read.
Types ¶
This section is empty.
Source Files