authorization

Documentation

Index

• Constants
• func CheckScopesGlobals(scopes []string, serviceID string) bool
• func ListGranted(scopes []Scope, have Scope, all bool) bool
• func ListGrants(scopes []Scope, want Scope) bool
• func ResourceAccessForScopes(scopes []Scope, minAllAccessScope Scope, requestedResources []string) (bool, []string, error)
• func ScopeServiceGlobal(serviceID string) string
• func ScopesToStrings(scopes []Scope) []string
• type Authorization
• type CasbinAuthorization
  • func NewCasbinAuthorization(modelPath string, policyPath string) *CasbinAuthorization
  • func NewCasbinStringAuthorization(policyPath string) *CasbinAuthorization
  • func (c *CasbinAuthorization) All(values []string, object string, action string) error
  • func (c *CasbinAuthorization) Any(values []string, object string, action string) error
• type CasbinScopeAuthorization
  • func NewCasbinScopeAuthorization(policyPath string, serviceID string) *CasbinScopeAuthorization
  • func (c *CasbinScopeAuthorization) All(values []string, object string, action string) error
  • func (c *CasbinScopeAuthorization) Any(values []string, object string, action string) error
• type Scope
  • func ScopeFromString(scope string) (*Scope, error)
  • func ScopesFromStrings(scopeStrings []string, skipInvalid bool) ([]Scope, error)
  • func (s Scope) AssociatedResources(scopes []Scope, trimResource bool) (bool, []string)
  • func (s Scope) Grants(want Scope) bool
  • func (s Scope) IsGlobal() bool
  • func (s Scope) IsServiceGlobal(serviceID string) bool
  • func (s Scope) IsSub(super Scope) bool
  • func (s Scope) String() string

Constants

const (
	// ScopeAll represents all options of a scope component
	ScopeAll string = "all"
	// ScopeGlobal represents the global scope
	ScopeGlobal string = "all:all:all"
	//ScopeOperationGet indicates a scope may be used for a get operation
	ScopeOperationGet string = "get"
	//ScopeOperationCreate indicates a scope may be used for a create operation
	ScopeOperationCreate string = "create"
	//ScopeOperationUpdate indicates a scope may be used for a update operation
	ScopeOperationUpdate string = "update"
	//ScopeOperationDelete indicates a scope may be used for a delete operation
	ScopeOperationDelete string = "delete"
)

Functions

func CheckScopesGlobals

func CheckScopesGlobals(scopes []string, serviceID string) bool

CheckScopesGlobals checks if the global or service global scope exists in the list of scope strings

func ListGranted

func ListGranted(scopes []Scope, have Scope, all bool) bool

ListGranted returns true if any or all scopes listed are granted by the provided "have" scope

func ListGrants

func ListGrants(scopes []Scope, want Scope) bool

ListGrants returns true if any of the listed scopes grant the provided "want" scope

func ResourceAccessForScopes

func ResourceAccessForScopes(scopes []Scope, minAllAccessScope Scope, requestedResources []string) (bool, []string, error)

ResourceAccessForScopes checks which resources a list of scopes grant access to

 Inputs:
		scopes ([]Scope): list of scopes that have been granted
		minAllAccessScope (Scope): minimum access scope that grants access to all requested resources
		requestedResources: ([]string): list of data keys for which scope access should be checked
 Outputs:
		allAccess (bool): whether any scope in scopes grants access to all requested resources
		accessKeys ([]string): all data keys the provided scopes grant access to in minAllAccessScope context
		err (error): returned if scopes do not grant access to all requested resources

func ScopeServiceGlobal

func ScopeServiceGlobal(serviceID string) string

ScopeServiceGlobal returns the global scope

func ScopesToStrings

func ScopesToStrings(scopes []Scope) []string

ScopesToStrings creates a list of string representations from a list of scope objects

Types

type Authorization

type Authorization interface {
	Any(values []string, object string, action string) error
	All(values []string, object string, action string) error
}

Authorization is a standard authorization interface that can be reused by various auth types.

type CasbinAuthorization

type CasbinAuthorization struct {
	// contains filtered or unexported fields
}

CasbinAuthorization is a Casbin implementation of the authorization interface.

func NewCasbinAuthorization

func NewCasbinAuthorization(modelPath string, policyPath string) *CasbinAuthorization

NewCasbinAuthorization returns a new Casbin enforcer

func NewCasbinStringAuthorization

func NewCasbinStringAuthorization(policyPath string) *CasbinAuthorization

NewCasbinStringAuthorization returns a new Casbin enforcer with the string model

func (*CasbinAuthorization) All

func (c *CasbinAuthorization) All(values []string, object string, action string) error

All will validate that if the casbin enforcer gives access to all the provided values

Returns nil on success and error on failure.

func (*CasbinAuthorization) Any

func (c *CasbinAuthorization) Any(values []string, object string, action string) error

Any will validate that if the casbin enforcer gives access to one or more of the provided values

Returns nil on success and error on failure.

type CasbinScopeAuthorization

type CasbinScopeAuthorization struct {
	// contains filtered or unexported fields
}

CasbinScopeAuthorization is a Casbin implementation of the authorization interface for scope values.

func NewCasbinScopeAuthorization

func NewCasbinScopeAuthorization(policyPath string, serviceID string) *CasbinScopeAuthorization

NewCasbinScopeAuthorization returns a new casbin enforcer

func (*CasbinScopeAuthorization) All

func (c *CasbinScopeAuthorization) All(values []string, object string, action string) error

All will validate that if the Casbin enforcer gives access to all the provided values

Returns nil on success and error on failure.

func (*CasbinScopeAuthorization) Any

func (c *CasbinScopeAuthorization) Any(values []string, object string, action string) error

Any will validate that if the Casbin enforcer gives access to one or more of the provided values

Returns nil on success and error on failure.

type Scope

type Scope struct {
	ServiceID string `json:"service_id" bson:"service_id"`
	Resource  string `json:"resource" bson:"resource"`
	Operation string `json:"operation" bson:"operation"`
}

Scope represents a scope entity

func ScopeFromString

func ScopeFromString(scope string) (*Scope, error)

ScopeFromString creates a scope object from the string representation

func ScopesFromStrings

func ScopesFromStrings(scopeStrings []string, skipInvalid bool) ([]Scope, error)

ScopesFromStrings creates a list of scope objects from a list of string representations.

If skipInvalid is true, invalid scopes will be skipped, if false an error will be returned

func (Scope) AssociatedResources

func (s Scope) AssociatedResources(scopes []Scope, trimResource bool) (bool, []string)

AssociatedResources returns the subset of scope resources that s grants access to or that grant access to s,

and a boolean indicator if a direct asymmetric match is found

Optionally trims the Resource of s from matched scopes' Resources

func (Scope) Grants

func (s Scope) Grants(want Scope) bool

Grants returns true if the scope (we have) grants access to the provided "want" scope

func (Scope) IsGlobal

func (s Scope) IsGlobal() bool

IsGlobal returns true if the scope is the global scope

func (Scope) IsServiceGlobal

func (s Scope) IsServiceGlobal(serviceID string) bool

IsServiceGlobal returns true if the scope is the service-level global scope

func (Scope) IsSub

func (s Scope) IsSub(super Scope) bool

IsSub returns true if the scope is a sub-scope of the provided "super" scope

func (Scope) String

func (s Scope) String() string

String converts the scope to the string representation