authz

Documentation

Index

• type ACL
  • func (acl *ACL) Evaluate(r Request) DecisionType
• type ACLList
• type ActionType
• type DecisionType
• type Grantee
  • func (g Grantee) Match(r Request) bool
• type GranteeType
• type PoliciesType
  • func NewPolicies(data []byte) (policies PoliciesType, err error)
  • func (policies PoliciesType) String() (string, error)
• type Request

Types

type ACL

type ACL struct {
	Id       string       `json:"id"`
	Actions  []ActionType `json:"actions"`
	Grantees []Grantee    `json:"grantees"`
}

ACL defines a ACL object used in the bucket

func (*ACL) Evaluate

func (acl *ACL) Evaluate(r Request) DecisionType

ACL evaluation algorithm: - Check if the request matches the ACL scope and permission - Deny by default Evaluate checks the request r against the current ACL

type ACLList

type ACLList []ACL

ACLList is the array of ACLs

type ActionType

type ActionType string

ActionType define action values in ACLs

const (
	Read  ActionType = "Read"
	Write ActionType = "Write"
)

type DecisionType

type DecisionType string

DecisionType define decision values of ACLs

const (
	DecisionPermit DecisionType = "Permit"
	DecisionDeny   DecisionType = "Deny"
)

type Grantee

type Grantee struct {
	Type  GranteeType `json:"type"`
	Value string      `json:"value"`
}

func (Grantee) Match

func (g Grantee) Match(r Request) bool

Match returns true if the request matches the grantee spec

type GranteeType

type GranteeType string

const (
	UserType  GranteeType = "User"
	GroupType GranteeType = "Group"
)

type PoliciesType

type PoliciesType map[string]ACLList

func NewPolicies

func NewPolicies(data []byte) (policies PoliciesType, err error)

func (PoliciesType) String

func (policies PoliciesType) String() (string, error)

type Request

type Request struct {
	Username string     `json:"username"` // user identifier, i.e. KPN ruisnaam
	Groups   []string   `json:"groups"`   // available groups that the user belongs to
	Action   ActionType `json:"action"`   // action to the bucket
	Target   string     `json:"target"`   // name of bucket
	Customer string     `json:"customer"` // customer that owns the bucket
}

Request represents an authorization request