enforcer

Documentation

Index

• Constants
• func ParseProjectRole(roleTemplateString string, project *models.Project) (string, error)
• func ParseProjectRoles(roleTemplateStrings []string, project *models.Project) ([]string, error)
• func ParseRole(role string, templateContext map[string]string) (string, error)
• type AuthorizationUpdateRequest
  • func NewAuthorizationUpdateRequest() AuthorizationUpdateRequest
  • func (a AuthorizationUpdateRequest) AddRolePermissions(role string, permissions []string) AuthorizationUpdateRequest
  • func (a AuthorizationUpdateRequest) SetRoleMembers(role string, members []string) AuthorizationUpdateRequest
• type Builder
  • func NewEnforcerBuilder() *Builder
  • func (b *Builder) Build() (Enforcer, error)
  • func (b *Builder) KetoEndpoints(ketoRemoteRead string, ketoRemoteWrite string) *Builder
  • func (b *Builder) WithCaching(keyExpirySeconds int, cacheCleanUpIntervalSeconds int) *Builder
• type CacheConfig
• type Enforcer
• type InMemoryCache
  • func (c *InMemoryCache) LookUpUserPermission(user string, permission string) (*bool, bool)
  • func (c *InMemoryCache) StoreUserPermission(user string, permission string, result bool)

Constants

const (
	// DefaultKetoRemoteRead default Keto remote read endpoint
	DefaultKetoRemoteRead = "http://localhost:4466"
	// DefaultKetoRemoteWrite default Keto remote write endpoint
	DefaultKetoRemoteWrite = "http://localhost:4467"
)

const (
	MLPAdminRole          = "mlp.administrator"
	MLPProjectsReaderRole = "mlp.projects.reader"
	MLPProjectReaderRole  = "mlp.projects.{{ .ProjectId }}.reader"
	MLPProjectAdminRole   = "mlp.projects.{{ .ProjectId }}.administrator"
)

const MaxKeyExpirySeconds = 600

MaxKeyExpirySeconds is the max allowed value for the KeyExpirySeconds.

Functions

func ParseProjectRole

func ParseProjectRole(roleTemplateString string, project *models.Project) (string, error)

func ParseProjectRoles

func ParseProjectRoles(roleTemplateStrings []string, project *models.Project) ([]string, error)

func ParseRole

func ParseRole(role string, templateContext map[string]string) (string, error)

Types

type AuthorizationUpdateRequest

type AuthorizationUpdateRequest struct {
	RolePermissions map[string][]string
	RoleMembers     map[string][]string
}

func NewAuthorizationUpdateRequest

func NewAuthorizationUpdateRequest() AuthorizationUpdateRequest

NewAuthorizationUpdateRequest create a new AuthorizationUpdateRequest. Multiple operations can be chained together using the AddRolePermissions and SetRoleMembers methods. No changes will be made until the AuthorizationUpdateRequest object is passed to the Enforcer, in which all the previously chained operations will be executed in batch.

func (AuthorizationUpdateRequest) AddRolePermissions

func (a AuthorizationUpdateRequest) AddRolePermissions(role string,
	permissions []string) AuthorizationUpdateRequest

AddRolePermissions add permissions to a role, without duplication. Existing permissions will still be in place.

func (AuthorizationUpdateRequest) SetRoleMembers

func (a AuthorizationUpdateRequest) SetRoleMembers(role string, members []string) AuthorizationUpdateRequest

SetRoleMembers set the members for a role. If the role already has members, they will be replaced.

type Builder

type Builder struct {
	// contains filtered or unexported fields
}

Builder builder of enforcer.Enforcer

func NewEnforcerBuilder

func NewEnforcerBuilder() *Builder

NewEnforcerBuilder create new enforcer builder with all default parameters

func (*Builder) Build

func (b *Builder) Build() (Enforcer, error)

Build build an enforcer.Enforcer instance

func (*Builder) KetoEndpoints

func (b *Builder) KetoEndpoints(ketoRemoteRead string, ketoRemoteWrite string) *Builder

KetoEndpoints set Keto remote read and write endpoint

func (*Builder) WithCaching

func (b *Builder) WithCaching(keyExpirySeconds int, cacheCleanUpIntervalSeconds int) *Builder

type CacheConfig

type CacheConfig struct {
	KeyExpirySeconds            int
	CacheCleanUpIntervalSeconds int
}

CacheConfig holds the configuration for the in-memory cache, if enabled

type Enforcer

type Enforcer interface {
	// IsUserGrantedPermission check whether user has the required permission, both directly and indirectly
	IsUserGrantedPermission(ctx context.Context, user string, permission string) (bool, error)
	// GetUserRoles get all roles directly associated with a user
	GetUserRoles(ctx context.Context, user string) ([]string, error)
	// GetRolePermissions get all permissions directly associated with a role
	GetRolePermissions(ctx context.Context, role string) ([]string, error)
	// GetUserPermissions get all permissions associated with a user
	GetUserPermissions(ctx context.Context, user string) ([]string, error)
	// GetRoleMembers get all members for a role
	GetRoleMembers(ctx context.Context, role string) ([]string, error)
	// UpdateAuthorization update authorization rules in batches
	UpdateAuthorization(ctx context.Context, updateRequest AuthorizationUpdateRequest) error
}

Enforcer interface to enforce authorization

type InMemoryCache

type InMemoryCache struct {
	// contains filtered or unexported fields
}

func (*InMemoryCache) LookUpUserPermission

func (c *InMemoryCache) LookUpUserPermission(user string, permission string) (*bool, bool)

LookUpUserPermission returns the cached permission check result for a user / permission pair. The returned value indicates whether the result is cached.

func (*InMemoryCache) StoreUserPermission

func (c *InMemoryCache) StoreUserPermission(user string, permission string, result bool)

StoreUserPermission stores the permission check result for a user / permission pair.