iamauthz

Documentation

Overview

Package iamauthz provides primitives for performing IAM request authorization.

Index

• func Authorize(ctx context.Context)
• func RequireAuthorizationStreamInterceptor(_ interface{}, _ grpc.ServerStream, _ *grpc.StreamServerInfo, ...) error
• func RequireAuthorizationUnaryInterceptor(ctx context.Context, req interface{}, _ *grpc.UnaryServerInfo, ...) (interface{}, error)
• func WithAuthorization(ctx context.Context) context.Context
• type AfterMethodAuthorization
  • func NewAfterMethodAuthorization(method protoreflect.MethodDescriptor, permissionTester PermissionTester, ...) (*AfterMethodAuthorization, error)
  • func (a *AfterMethodAuthorization) AuthorizeRequestAndResponse(ctx context.Context, request proto.Message, response proto.Message) (context.Context, error)
• type BeforeLongRunningOperationMethodAuthorization
  • func NewBeforeLongRunningOperationMethodAuthorization(operationsPermissions []*iamv1.LongRunningOperationPermissions, ...) (*BeforeLongRunningOperationMethodAuthorization, error)
  • func (a *BeforeLongRunningOperationMethodAuthorization) AuthorizeRequest(ctx context.Context, request iamreflect.LongRunningOperationRequest) (context.Context, error)
• type BeforeMethodAuthorization
  • func NewBeforeMethodAuthorization(method protoreflect.MethodDescriptor, permissionTester PermissionTester, ...) (*BeforeMethodAuthorization, error)
  • func (a *BeforeMethodAuthorization) AuthorizeRequest(ctx context.Context, request proto.Message) (context.Context, error)
• type PermissionTestFunctions
  • func NewPermissionTestFunctions(options *iamv1.MethodAuthorizationOptions, tester PermissionTester) *PermissionTestFunctions
  • func (f *PermissionTestFunctions) Declarations() []*expr.Decl
  • func (f *PermissionTestFunctions) Functions() []*functions.Overload
• type PermissionTester
• type ResourceNameFunctions
  • func (ResourceNameFunctions) Declarations() []*expr.Decl
  • func (f ResourceNameFunctions) Functions() []*functions.Overload

Functions

func Authorize

func Authorize(ctx context.Context)

Authorize marks the current request as processed by an authorization check. WithAuthorization must have been called on the context for the call to be effective.

Authorize should be called at the start of an authorization check, to ensure that any errors resulting from the authorization check itself are forwarded to the caller.

func RequireAuthorizationStreamInterceptor

func RequireAuthorizationStreamInterceptor(
	_ interface{},
	_ grpc.ServerStream,
	_ *grpc.StreamServerInfo,
	_ grpc.StreamHandler,
) error

RequireAuthorizationStreamInterceptor is a grpc.StreamServerInterceptor that aborts all incoming streams, pending implementation of stream support in this package.

func RequireAuthorizationUnaryInterceptor

func RequireAuthorizationUnaryInterceptor(
	ctx context.Context,
	req interface{},
	_ *grpc.UnaryServerInfo,
	handler grpc.UnaryHandler,
) (interface{}, error)

RequireAuthorizationUnaryInterceptor is a grpc.UnaryServerInterceptor that requires authorization to be performed on all incoming requests.

To mark the request as processed by authorization checks, the method implementing authorization should call Authorize on the request context as soon as authorization starts.

func WithAuthorization

func WithAuthorization(ctx context.Context) context.Context

WithAuthorization adds authorization to the current request context.

Types

type AfterMethodAuthorization

type AfterMethodAuthorization struct {
	// contains filtered or unexported fields
}

func NewAfterMethodAuthorization

func NewAfterMethodAuthorization(
	method protoreflect.MethodDescriptor,
	permissionTester PermissionTester,
	memberResolver iammember.Resolver,
) (*AfterMethodAuthorization, error)

func (*AfterMethodAuthorization) AuthorizeRequestAndResponse

func (a *AfterMethodAuthorization) AuthorizeRequestAndResponse(
	ctx context.Context,
	request proto.Message,
	response proto.Message,
) (context.Context, error)

type BeforeLongRunningOperationMethodAuthorization

type BeforeLongRunningOperationMethodAuthorization struct {
	// contains filtered or unexported fields
}

func NewBeforeLongRunningOperationMethodAuthorization

func NewBeforeLongRunningOperationMethodAuthorization(
	operationsPermissions []*iamv1.LongRunningOperationPermissions,
	permissionTester PermissionTester,
	memberResolver iammember.Resolver,
) (*BeforeLongRunningOperationMethodAuthorization, error)

func (*BeforeLongRunningOperationMethodAuthorization) AuthorizeRequest

func (a *BeforeLongRunningOperationMethodAuthorization) AuthorizeRequest(
	ctx context.Context,
	request iamreflect.LongRunningOperationRequest,
) (context.Context, error)

type BeforeMethodAuthorization

type BeforeMethodAuthorization struct {
	// contains filtered or unexported fields
}

func NewBeforeMethodAuthorization

func NewBeforeMethodAuthorization(
	method protoreflect.MethodDescriptor,
	permissionTester PermissionTester,
	memberResolver iammember.Resolver,
) (*BeforeMethodAuthorization, error)

func (*BeforeMethodAuthorization) AuthorizeRequest

func (a *BeforeMethodAuthorization) AuthorizeRequest(
	ctx context.Context,
	request proto.Message,
) (context.Context, error)

type PermissionTestFunctions

type PermissionTestFunctions struct {
	// contains filtered or unexported fields
}

func NewPermissionTestFunctions

func NewPermissionTestFunctions(
	options *iamv1.MethodAuthorizationOptions,
	tester PermissionTester,
) *PermissionTestFunctions

func (*PermissionTestFunctions) Declarations

func (f *PermissionTestFunctions) Declarations() []*expr.Decl

func (*PermissionTestFunctions) Functions

func (f *PermissionTestFunctions) Functions() []*functions.Overload

type PermissionTester

type PermissionTester interface {
	TestResourcePermission(
		ctx context.Context, members []string, resource string, permission string,
	) (bool, error)
	TestResourcePermissions(
		ctx context.Context, members []string, resourcePermissions map[string]string,
	) (map[string]bool, error)
}

type ResourceNameFunctions

type ResourceNameFunctions struct{}

func (ResourceNameFunctions) Declarations

func (ResourceNameFunctions) Declarations() []*expr.Decl

func (ResourceNameFunctions) Functions

func (f ResourceNameFunctions) Functions() []*functions.Overload