fsoauthz

Documentation

Index

• Constants
• Variables
• type InsecureLogAuthz
  • func CreateInsecureLogAuthz(lg Logger) *InsecureLogAuthz
  • func (a *InsecureLogAuthz) Authorize(euid auth.Identity, action auth.Action, opts auth.ActionDetails) error
• type InsecureLogScopeAuthz
  • func CreateInsecureLogScopeAuthz(lg Logger) *InsecureLogScopeAuthz
  • func (a *InsecureLogScopeAuthz) Authorize(euid auth.Identity, action auth.Action, opts auth.ActionDetails) error
• type Logger
• type ScopeAuthz
  • func CreateScopeAuthz(lg Logger) *ScopeAuthz
  • func (a *ScopeAuthz) Authorize(euid auth.Identity, action auth.Action, opts auth.ActionDetails) error
  • func (authz *ScopeAuthz) AuthorizeAny(euid auth.Identity, actions ...auth.ScopedAction) error

Constants

const AABroadcastRead = "bc/read"

details: name

const AABroadcastWrite = "bc/write"

const AAFsoAdminRegistry = "fso/admin-registry"

const AAFsoAdminRepo = "fso/admin-repo"

details: path

const AAFsoAdminRoot = "fso/admin-root"

const AAFsoArchiveRepo = "fso/archive-repo"

const AAFsoConfirmRepo = "fso/confirm-repo"

const AAFsoDeleteRoot = "fso/delete-root"

const AAFsoEnableDiscoveryPath = "fso/enable-discovery-path"

const AAFsoExecArchiveRepo = "fso/exec-archive-repo"

const AAFsoExecDu = "fso/exec-du"

const AAFsoExecFreezeRepo = "fso/exec-freeze-repo"

const AAFsoExecPingRegistry = "fso/exec-ping-registry"

const AAFsoExecRepoFreeze = "fso/exec-repo-freeze"

const AAFsoExecSplitRoot = "fso/exec-split-root"

const AAFsoExecUnarchiveRepo = "fso/exec-unarchive-repo"

const AAFsoExecUnfreezeRepo = "fso/exec-unfreeze-repo"

const AAFsoFind = "fso/find"

const AAFsoFreezeRepo = "fso/freeze-repo"

const AAFsoInitRegistry = "fso/init-registry"

const AAFsoInitRepo = "fso/init-repo"

const AAFsoInitRepoShadowBackup = "fso/init-repo-shadow-backup"

const AAFsoInitRepoTartt = "fso/init-repo-tartt"

const AAFsoInitRoot = "fso/init-root"

const AAFsoReadMain = "fso/read-main"

const AAFsoReadRegistry = "fso/read-registry"

const AAFsoReadRepo = "fso/read-repo"

const AAFsoReadRoot = "fso/read-root"

const AAFsoRefreshRepo = "fso/refresh-repo"

const AAFsoSession = "fso/session"

const AAFsoTestUdo = "fso/test-udo"

const AAFsoTestUdoAs = "fso/test-udo-as"

const AAFsoUnarchiveRepo = "fso/unarchive-repo"

const AAFsoUnfreezeRepo = "fso/unfreeze-repo"

const AAFsoWriteRepo = "fso/write-repo"

const AAInitUnixDomain = "uxd/init-unix-domain"

const AAReadUnixDomain = "uxd/read-unix-domain"

const AAWriteUnixDomain = "uxd/write-unix-domain"

Variables

var (
	ErrNoScope             = errors.New("no scope")
	ErrInsufficientDetails = errors.New(
		"isufficient details: require at least `path` or `name`",
	)
	ErrDefaultDeny          = errors.New("default deny")
	ErrMissingScopedActions = errors.New("no scoped actions")
)

Types

type InsecureLogAuthz

type InsecureLogAuthz struct {
	// contains filtered or unexported fields
}

`InsecureLogAuthz` logs authz requests, without actually checking permission.

func CreateInsecureLogAuthz

func CreateInsecureLogAuthz(lg Logger) *InsecureLogAuthz

func (*InsecureLogAuthz) Authorize

func (a *InsecureLogAuthz) Authorize(
	euid auth.Identity, action auth.Action, opts auth.ActionDetails,
) error

type InsecureLogScopeAuthz

type InsecureLogScopeAuthz struct {
	// contains filtered or unexported fields
}

`InsecureLogScopeAuthz` determines whether an action would be permitted by comparing the action with the `euid` scope. It only logs the decision without actually denying access.

func CreateInsecureLogScopeAuthz

func CreateInsecureLogScopeAuthz(lg Logger) *InsecureLogScopeAuthz

func (*InsecureLogScopeAuthz) Authorize

func (a *InsecureLogScopeAuthz) Authorize(
	euid auth.Identity, action auth.Action, opts auth.ActionDetails,
) error

type Logger

type Logger interface {
	Infow(msg string, kv ...interface{})
}

type ScopeAuthz

type ScopeAuthz struct {
	// contains filtered or unexported fields
}

`ScopeAuthz` determines whether an action is permitted by comparing the action with the `euid` scope. It logs decisions with info level.

func CreateScopeAuthz

func CreateScopeAuthz(lg Logger) *ScopeAuthz

func (*ScopeAuthz) Authorize

func (a *ScopeAuthz) Authorize(
	euid auth.Identity, action auth.Action, opts auth.ActionDetails,
) error

func (*ScopeAuthz) AuthorizeAny

func (authz *ScopeAuthz) AuthorizeAny(
	euid auth.Identity, actions ...auth.ScopedAction,
) error