Documentation
¶
Overview ¶
Package wardenseed embeds authsome's default warden DSL programs and provides loaders + appliers that materialise them against a warden engine at bootstrap time.
The embedded files under embed/ are the source of truth for authsome's default roles and permission catalog. They're loaded with ${APP_ID} variable substitution so the same DSL applies to every app the engine bootstraps.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var FS embed.FS
FS is the embedded filesystem containing authsome's default .warden files. The layout is:
embed/shared/ — applied to every app (catalog + namespace "app" roles) embed/platform/ — applied only to the platform app (namespace "platform" roles)
Functions ¶
func ApplyForApp ¶
func ApplyForApp(ctx context.Context, eng *warden.Engine, appID id.AppID, isPlatform bool, opts ApplyOptions) (*dsl.ApplyResult, error)
ApplyForApp materialises authsome's default warden DSL programs against the given engine for the given app. When isPlatform is true, the platform-only roles are merged into the same Program before applying so cross-file grant references (platform-* roles granting perms from the shared catalog) resolve in a single pass — important for DryRun, which can only validate against declarations + already-stored entities.
The function is idempotent: calling it twice on a clean engine yields 0 created / 0 updated entries on the second pass.
Types ¶
type ApplyOptions ¶
type ApplyOptions struct {
// Used by extension config (cfg.WardenDir) to let operators ship
// custom .warden files without rebuilding the binary. Applies to
// every app (platform + non-platform).
SharedOverride *Source
// PlatformOverride, when set, replaces the embedded platform
// source. Only consulted when ApplyForApp is called with
// isPlatform=true.
PlatformOverride *Source
// DryRun forwards to dsl.ApplyOptions.DryRun. When true, no writes
// hit the warden store; the result still reports what *would* have
// changed.
DryRun bool
}
ApplyOptions configures ApplyForApp.
type LoadOptions ¶
type LoadOptions struct {
// AppID is substituted for ${APP_ID} placeholders in source files.
// Required when sources contain `tenant ${APP_ID}` headers.
AppID string
// ExtraVars is merged into the variable map after AppID. Lets
// callers add additional substitutions without losing AppID.
ExtraVars map[string]string
}
LoadOptions configures Load.
type Source ¶
type Source struct {
// EmbedRoot uses the package-embedded FS at the given subpath
// (e.g. embedSharedRoot or embedPlatformRoot). Most callers use
// the convenience constructors SharedSource / PlatformSource.
EmbedRoot string
// FS + Root override the embedded FS with a caller-supplied one.
// Useful for tests and custom deployments.
FS fs.FS
Root string
// Dir loads from the local filesystem. Takes precedence over the
// embed FS when set. Used for the operator override path
// (cfg.WardenDir).
Dir string
}
Source identifies where to read .warden files from. Exactly one of EmbedRoot, FS+Root, or Dir must be set.
func FilesystemDir ¶
FilesystemDir is a small convenience that resolves a relative dir against the current working directory. Used by extension.go to build the operator override Source from cfg.WardenDir.
func PlatformSource ¶
func PlatformSource() Source
PlatformSource returns the Source that points at the embedded files applied only to the platform app.
func SharedSource ¶
func SharedSource() Source
SharedSource returns the Source that points at the embedded files applied to every app.