iamauthz

Documentation

Overview

Package iamauthz provides primitives for performing IAM request authorization.

Index

• func Authorize(ctx context.Context)
• func RequireStreamAuthorization(_ interface{}, _ grpc.ServerStream, _ *grpc.StreamServerInfo, ...) error
• func RequireUnaryAuthorization(ctx context.Context, req interface{}, _ *grpc.UnaryServerInfo, ...) (interface{}, error)
• func ResolvePermissionForResource(options *iamv1.MethodAuthorizationOptions, resource string) (string, error)
• func WithAuthorization(ctx context.Context) context.Context
• type AfterMethodAuthorization
  • func NewAfterMethodAuthorization(method protoreflect.MethodDescriptor, permissionTester PermissionTester, ...) (*AfterMethodAuthorization, error)
  • func (a *AfterMethodAuthorization) AuthorizeRequestAndResponse(ctx context.Context, request proto.Message, response proto.Message) (context.Context, error)
• type BeforeMethodAuthorization
  • func NewBeforeMethodAuthorization(method protoreflect.MethodDescriptor, permissionTester PermissionTester, ...) (*BeforeMethodAuthorization, error)
  • func (a *BeforeMethodAuthorization) AuthorizeRequest(ctx context.Context, request proto.Message) (context.Context, error)
• type Functions
  • func NewFunctions(options *iamv1.MethodAuthorizationOptions, tester PermissionTester) *Functions
  • func (f *Functions) Declarations() []*expr.Decl
  • func (f *Functions) Functions() []*functions.Overload
• type PermissionTester

Functions

func Authorize

func Authorize(ctx context.Context)

Authorize marks the current request as processed by an authorization check. WithAuthorization must have been called on the context for the call to be effective.

Authorize should be called at the start of an authorization check, to ensure that any errors resulting from the authorization check itself are forwarded to the caller.

func RequireStreamAuthorization

func RequireStreamAuthorization(
	_ interface{},
	_ grpc.ServerStream,
	_ *grpc.StreamServerInfo,
	_ grpc.StreamHandler,
) error

RequireStreamAuthorization is a grpc.StreamServerInterceptor that aborts all incoming streams, pending implementation of stream support in this package.

func RequireUnaryAuthorization

func RequireUnaryAuthorization(
	ctx context.Context,
	req interface{},
	_ *grpc.UnaryServerInfo,
	handler grpc.UnaryHandler,
) (interface{}, error)

RequireUnaryAuthorization is a grpc.UnaryServerInterceptor that requires authorization to be performed on all incoming requests.

To mark the request as processed by authorization checks, the method implementing authorization should call Authorize on the request context as soon as authorization starts.

func ResolvePermissionForResource

func ResolvePermissionForResource(options *iamv1.MethodAuthorizationOptions, resource string) (string, error)

func WithAuthorization

func WithAuthorization(ctx context.Context) context.Context

WithAuthorization adds authorization to the current request context.

Types

type AfterMethodAuthorization

type AfterMethodAuthorization struct {
	// contains filtered or unexported fields
}

func NewAfterMethodAuthorization

func NewAfterMethodAuthorization(
	method protoreflect.MethodDescriptor,
	permissionTester PermissionTester,
	memberResolver iammember.Resolver,
) (*AfterMethodAuthorization, error)

func (*AfterMethodAuthorization) AuthorizeRequestAndResponse

func (a *AfterMethodAuthorization) AuthorizeRequestAndResponse(
	ctx context.Context,
	request proto.Message,
	response proto.Message,
) (context.Context, error)

type BeforeMethodAuthorization

type BeforeMethodAuthorization struct {
	// contains filtered or unexported fields
}

func NewBeforeMethodAuthorization

func NewBeforeMethodAuthorization(
	method protoreflect.MethodDescriptor,
	permissionTester PermissionTester,
	memberResolver iammember.Resolver,
) (*BeforeMethodAuthorization, error)

func (*BeforeMethodAuthorization) AuthorizeRequest

func (a *BeforeMethodAuthorization) AuthorizeRequest(
	ctx context.Context,
	request proto.Message,
) (context.Context, error)

type Functions

type Functions struct {
	// contains filtered or unexported fields
}

func NewFunctions

func NewFunctions(options *iamv1.MethodAuthorizationOptions, tester PermissionTester) *Functions

func (*Functions) Declarations

func (f *Functions) Declarations() []*expr.Decl

func (*Functions) Functions

func (f *Functions) Functions() []*functions.Overload

type PermissionTester

type PermissionTester interface {
	TestResourcePermission(context.Context, []string, string, string) (bool, error)
	TestResourcePermissions(context.Context, []string, map[string]string) (map[string]bool, error)
}