Documentation
¶
Index ¶
- func InitShadowMetrics(reg prometheus.Registerer) error
- type Authorizer
- func (a Authorizer) AuthorizeDelete(ctx context.Context, caller Caller, keys []*relationshipspb.RelationshipKey) error
- func (a Authorizer) AuthorizeLookup(ctx context.Context, caller Caller, objects []*relationshipspb.Object) error
- func (a Authorizer) AuthorizeLookupResources(_ context.Context, caller Caller, subject *relationshipspb.Identity) error
- func (a Authorizer) AuthorizeRead(_ context.Context, caller Caller, subject *relationshipspb.Identity) error
- func (a Authorizer) AuthorizeWrite(ctx context.Context, caller Caller, objects []*relationshipspb.Object) error
- type Caller
- type Option
- type ShadowChecker
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func InitShadowMetrics ¶ added in v1.107.0
func InitShadowMetrics(reg prometheus.Registerer) error
InitShadowMetrics registers the shadow check metrics with reg. Call once, from dataaccess.NewComponents, before serving traffic.
Types ¶
type Authorizer ¶
type Authorizer struct {
// contains filtered or unexported fields
}
func (Authorizer) AuthorizeDelete ¶ added in v1.50.0
func (a Authorizer) AuthorizeDelete(ctx context.Context, caller Caller, keys []*relationshipspb.RelationshipKey) error
AuthorizeDelete is AuthorizeWrite plus one exception: a caller may remove their own grant on any object without the owner role or a direct/ancestor grant on it. Removing your own grant can never grant you anything, so this is safe even when the caller's cached organization_role claim is stale (e.g. a just-demoted owner deleting their now-stale org-admin row). Self-owned keys are dropped per key, not all-or-nothing, before AuthorizeWrite ever sees them; only objects tied to someone else's grant go through the normal write authorization.
func (Authorizer) AuthorizeLookup ¶ added in v1.28.0
func (a Authorizer) AuthorizeLookup(ctx context.Context, caller Caller, objects []*relationshipspb.Object) error
func (Authorizer) AuthorizeLookupResources ¶ added in v1.49.0
func (a Authorizer) AuthorizeLookupResources(_ context.Context, caller Caller, subject *relationshipspb.Identity) error
AuthorizeLookupResources allows a caller to look up its own resources, or, if it is the org owner, any subject in the same org. The request names no objects, so there is no grant to check.
func (Authorizer) AuthorizeRead ¶ added in v1.122.4
func (a Authorizer) AuthorizeRead(_ context.Context, caller Caller, subject *relationshipspb.Identity) error
AuthorizeRead allows a caller to read only its own relationships.
func (Authorizer) AuthorizeWrite ¶ added in v1.28.0
func (a Authorizer) AuthorizeWrite(ctx context.Context, caller Caller, objects []*relationshipspb.Object) error
AuthorizeWrite lets the org owner touch anything. A non-owner may never touch the org resource, and everything else needs a direct or ancestor grant.
type Caller ¶ added in v1.98.0
type Caller struct {
OrgID uuid.UUID
// OriginID is the claim as sent, which is also how identities are keyed, so a subject counts
// as a member only when its origin_id matches it byte for byte.
OriginID string
Identity *relationshipspb.Identity
OrgOwner bool
}
Caller is the caller a request's token authenticates, in the organization the token acts for.
func CallerFromContext ¶ added in v1.98.0
CallerFromContext reads the Caller from the token the interceptor put in ctx.
func (Caller) SubjectInOrg ¶ added in v1.122.4
func (c Caller) SubjectInOrg(subject *relationshipspb.Identity) bool
SubjectInOrg reports whether subject is a member of the caller's organization. Relationship rows carry no organization of their own; a grant belongs to an org only through its subject's origin_id, so a foreign subject would plant a grant in another org and hand its user a role.
type Option ¶ added in v1.107.0
type Option func(*Authorizer)
Option configures an Authorizer.
func WithShadow ¶ added in v1.119.0
func WithShadow(s *ShadowChecker) Option
WithShadow turns on the glaz shadow check. A nil checker leaves it off. Checks read through the Authorizer's db after the request returns, so it must stay usable: in production, a pool.
type ShadowChecker ¶ added in v1.119.0
type ShadowChecker struct {
// contains filtered or unexported fields
}
ShadowChecker runs the glaz shadow check off the request path, so a slow engine never holds up a request. Build one per process so the lookup and update services share its concurrency limit. It never closes the engine: a check can still be running in glaz at shutdown, and the OS reclaims it at exit.
func NewShadowChecker ¶ added in v1.119.0
func NewShadowChecker(engine glaz.Engine) *ShadowChecker
NewShadowChecker returns nil for a nil engine, which WithShadow treats as off.
Source Files