Documentation
¶
Overview ¶
Package authz provides authorization primitives for authsome, including resource type schemas and a centralized Warden-backed authorization checker.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrForbidden = errors.New("authsome: forbidden")
ErrForbidden is returned when an authorization check fails.
Functions ¶
This section is empty.
Types ¶
type Checker ¶
type Checker struct {
// contains filtered or unexported fields
}
Checker wraps Warden authorization checks for authsome service methods.
func NewChecker ¶
NewChecker creates a new authorization checker backed by a Warden engine.
func (*Checker) Authorize ¶
Authorize checks if the current user (from context) can perform the given action on the specified resource. Returns nil if allowed, ErrForbidden if denied. If no user is present in the context (internal/system call), the check is skipped.
func (*Checker) AuthorizeOrSelf ¶
func (c *Checker) AuthorizeOrSelf(ctx context.Context, ownerID id.UserID, action, resourceType, resourceID string) error
AuthorizeOrSelf allows the operation if the current user is the resource owner OR has the required permission. This handles the common pattern of "users can manage their own resources".
type ResourceSchema ¶
type ResourceSchema struct {
Name string
Description string
Relations []resourcetype.RelationDef
Permissions []resourcetype.PermissionDef
}
ResourceSchema pairs a resource name with its Warden schema definition.
func DefaultSchemas ¶
func DefaultSchemas() []ResourceSchema
DefaultSchemas returns the authsome resource type schemas with their relations and permissions for Warden's ReBAC model.
Source Files