iamauthz

Documentation

Overview

Package iamauthz provides primitives for performing IAM request authorization.

Index

• func Authorize(ctx context.Context)
• func RequireAuthorizationStreamInterceptor(_ interface{}, _ grpc.ServerStream, _ *grpc.StreamServerInfo, ...) error
• func RequireAuthorizationUnaryInterceptor(ctx context.Context, req interface{}, _ *grpc.UnaryServerInfo, ...) (interface{}, error)
• func WithAuthorization(ctx context.Context) context.Context
• type AfterMethodAuthorization
  • func NewAfterMethodAuthorization(method protoreflect.MethodDescriptor, ...) (*AfterMethodAuthorization, error)
  • func (a *AfterMethodAuthorization) AuthorizeRequestAndResponse(ctx context.Context, request proto.Message, response proto.Message) (context.Context, error)
• type BeforeLongRunningOperationMethodAuthorization
  • func NewBeforeLongRunningOperationMethodAuthorization(options *iamv1.LongRunningOperationsAuthorizationOptions, ...) (*BeforeLongRunningOperationMethodAuthorization, error)
  • func (a *BeforeLongRunningOperationMethodAuthorization) AuthorizeRequest(ctx context.Context, request iampermission.LongRunningOperationRequest) (context.Context, error)
• type BeforeMethodAuthorization
  • func NewBeforeMethodAuthorization(method protoreflect.MethodDescriptor, ...) (*BeforeMethodAuthorization, error)
  • func (a *BeforeMethodAuthorization) AuthorizeRequest(ctx context.Context, request proto.Message) (context.Context, error)

Functions

func Authorize

func Authorize(ctx context.Context)

Authorize marks the current request as processed by an authorization check. WithAuthorization must have been called on the context for the call to be effective.

Authorize should be called at the start of an authorization check, to ensure that any errors resulting from the authorization check itself are forwarded to the caller.

func RequireAuthorizationStreamInterceptor

func RequireAuthorizationStreamInterceptor(
	_ interface{},
	_ grpc.ServerStream,
	_ *grpc.StreamServerInfo,
	_ grpc.StreamHandler,
) error

RequireAuthorizationStreamInterceptor is a grpc.StreamServerInterceptor that aborts all incoming streams, pending implementation of stream support in this package.

func RequireAuthorizationUnaryInterceptor

func RequireAuthorizationUnaryInterceptor(
	ctx context.Context,
	req interface{},
	_ *grpc.UnaryServerInfo,
	handler grpc.UnaryHandler,
) (interface{}, error)

RequireAuthorizationUnaryInterceptor is a grpc.UnaryServerInterceptor that requires authorization to be performed on all incoming requests.

To mark the request as processed by authorization checks, the method implementing authorization should call Authorize on the request context as soon as authorization starts.

func WithAuthorization

func WithAuthorization(ctx context.Context) context.Context

WithAuthorization adds authorization to the current request context.

Types

type AfterMethodAuthorization

type AfterMethodAuthorization struct {
	// contains filtered or unexported fields
}

func NewAfterMethodAuthorization

func NewAfterMethodAuthorization(
	method protoreflect.MethodDescriptor,
	options *iamv1.MethodAuthorizationOptions,
	permissionTester iamcel.PermissionTester,
	memberResolver iammember.Resolver,
) (*AfterMethodAuthorization, error)

func (*AfterMethodAuthorization) AuthorizeRequestAndResponse

func (a *AfterMethodAuthorization) AuthorizeRequestAndResponse(
	ctx context.Context,
	request proto.Message,
	response proto.Message,
) (context.Context, error)

type BeforeLongRunningOperationMethodAuthorization

type BeforeLongRunningOperationMethodAuthorization struct {
	// contains filtered or unexported fields
}

func NewBeforeLongRunningOperationMethodAuthorization

func NewBeforeLongRunningOperationMethodAuthorization(
	options *iamv1.LongRunningOperationsAuthorizationOptions,
	permissionTester iamcel.PermissionTester,
	memberResolver iammember.Resolver,
) (*BeforeLongRunningOperationMethodAuthorization, error)

func (*BeforeLongRunningOperationMethodAuthorization) AuthorizeRequest

func (a *BeforeLongRunningOperationMethodAuthorization) AuthorizeRequest(
	ctx context.Context,
	request iampermission.LongRunningOperationRequest,
) (context.Context, error)

type BeforeMethodAuthorization

type BeforeMethodAuthorization struct {
	// contains filtered or unexported fields
}

func NewBeforeMethodAuthorization

func NewBeforeMethodAuthorization(
	method protoreflect.MethodDescriptor,
	options *iamv1.MethodAuthorizationOptions,
	permissionTester iamcel.PermissionTester,
	memberResolver iammember.Resolver,
) (*BeforeMethodAuthorization, error)

func (*BeforeMethodAuthorization) AuthorizeRequest

func (a *BeforeMethodAuthorization) AuthorizeRequest(
	ctx context.Context,
	request proto.Message,
) (context.Context, error)