rbac

Documentation

Index

• Variables
• func AllowGlobalScope(ctx context.Context, endpoint string, operation openapi.AclOperation) error
• func AllowOrganizationScope(ctx context.Context, endpoint string, operation openapi.AclOperation, ...) error
• func AllowProjectScope(ctx context.Context, endpoint string, operation openapi.AclOperation, ...) error
• func AllowRole(ctx context.Context, role *unikornv1.Role, organizationID string) error
• func FromContext(ctx context.Context) *openapi.Acl
• func NewContext(ctx context.Context, acl *openapi.Acl) context.Context
• type RBAC
  • func New(client client.Client, namespace string) *RBAC
  • func (r *RBAC) GetACL(ctx context.Context, organizationID, subject string) (*openapi.Acl, error)
  • func (r *RBAC) GetActiveSubjects(ctx context.Context, subject string) (*unikornv1.UserList, error)
  • func (r *RBAC) UserExists(ctx context.Context, subject string) (bool, error)

Variables

var (
	ErrResourceReference = errors.New("resource reference error")
)

Functions

func AllowGlobalScope

func AllowGlobalScope(ctx context.Context, endpoint string, operation openapi.AclOperation) error

AllowGlobalScope tries to allow the requested operation at the global scope.

func AllowOrganizationScope

func AllowOrganizationScope(ctx context.Context, endpoint string, operation openapi.AclOperation, organizationID string) error

AllowOrganizationScope tries to allow the requested operation at the global scope, then the organization scope.

func AllowProjectScope

func AllowProjectScope(ctx context.Context, endpoint string, operation openapi.AclOperation, organizationID, projectID string) error

AllowProjectScope tries to allow the requested operation at the global scope, then the organization scope, and finally at the project scope.

func AllowRole

func AllowRole(ctx context.Context, role *unikornv1.Role, organizationID string) error

AllowRole determines whether your ACL contains the same or higher privileges than the role, which is then used to determine role visibility and limit privilege escalation.

func FromContext

func FromContext(ctx context.Context) *openapi.Acl

func NewContext

func NewContext(ctx context.Context, acl *openapi.Acl) context.Context

Types

type RBAC

type RBAC struct {
	// contains filtered or unexported fields
}

RBAC contains all the scoping rules for services across the platform.

func New

func New(client client.Client, namespace string) *RBAC

New creates a new RBAC client.

func (*RBAC) GetACL

func (r *RBAC) GetACL(ctx context.Context, organizationID, subject string) (*openapi.Acl, error)

GetACL returns a granular set of permissions for a user based on their scope. This is used for API level access control and UX.

func (*RBAC) GetActiveSubjects

func (r *RBAC) GetActiveSubjects(ctx context.Context, subject string) (*unikornv1.UserList, error)

GetActiveSubjects returns all users who match the subject across all organizations.

func (*RBAC) UserExists

func (r *RBAC) UserExists(ctx context.Context, subject string) (bool, error)

UserExists tells us whether the user is active in any organization.