rbac

Documentation

Index

• func AllowGlobalScope(ctx context.Context, endpoint string, operation openapi.AclOperation) error
• func AllowOrganizationScope(ctx context.Context, endpoint string, operation openapi.AclOperation, ...) error
• func AllowProjectScope(ctx context.Context, endpoint string, operation openapi.AclOperation, ...) error
• func AllowRole(ctx context.Context, role *unikornv1.Role, organizationID string) error
• func FromContext(ctx context.Context) *openapi.Acl
• func NewContext(ctx context.Context, acl *openapi.Acl) context.Context
• type OrganizationMemberships
  • func (o *OrganizationMemberships) GetGroup(groupID string) *unikornv1.Group
• type RBAC
  • func New(client client.Client, namespace string) *RBAC
  • func (r *RBAC) GetACL(ctx context.Context, organizationID, subject string) (*openapi.Acl, error)
  • func (r *RBAC) GetOrganizationMemberships(ctx context.Context, subject string) ([]OrganizationMemberships, error)
  • func (r *RBAC) UserExists(ctx context.Context, subject string) (bool, error)

Functions

func AllowGlobalScope

func AllowGlobalScope(ctx context.Context, endpoint string, operation openapi.AclOperation) error

AllowGlobalScope tries to allow the requested operation at the global scope.

func AllowOrganizationScope

func AllowOrganizationScope(ctx context.Context, endpoint string, operation openapi.AclOperation, organizationID string) error

AllowOrganizationScope tries to allow the requested operation at the global scope, then the organization scope.

func AllowProjectScope

func AllowProjectScope(ctx context.Context, endpoint string, operation openapi.AclOperation, organizationID, projectID string) error

AllowProjectScope tries to allow the requested operation at the global scope, then the organization scope, and finally at the project scope.

func AllowRole

func AllowRole(ctx context.Context, role *unikornv1.Role, organizationID string) error

AllowRole determines whether your ACL contains the same or higher privileges than the role, which is then used to determine role visibility and limit privilege escalation.

func FromContext

func FromContext(ctx context.Context) *openapi.Acl

func NewContext

func NewContext(ctx context.Context, acl *openapi.Acl) context.Context

Types

type OrganizationMemberships

type OrganizationMemberships struct {
	Organization *unikornv1.Organization
	Groups       *unikornv1.GroupList
}

OrganizationMemberships is an organization with groups a user is a member of.

func (*OrganizationMemberships) GetGroup

func (o *OrganizationMemberships) GetGroup(groupID string) *unikornv1.Group

type RBAC

type RBAC struct {
	// contains filtered or unexported fields
}

RBAC contains all the scoping rules for services across the platform.

func New

func New(client client.Client, namespace string) *RBAC

New creates a new RBAC client.

func (*RBAC) GetACL

func (r *RBAC) GetACL(ctx context.Context, organizationID, subject string) (*openapi.Acl, error)

GetACL returns a granular set of permissions for a user based on their scope. This is used for API level access control and UX.

func (*RBAC) GetOrganizationMemberships

func (r *RBAC) GetOrganizationMemberships(ctx context.Context, subject string) ([]OrganizationMemberships, error)

GetOrganizationMemberships returns a list of organizations we have membership of and the groups we are members of.

func (*RBAC) UserExists

func (r *RBAC) UserExists(ctx context.Context, subject string) (bool, error)

UserExists is an optimized version of the permissions builder that is used to authorize authentication requests. Failure here means the user need to signup and register themselves with an organization uing a back-channel.