dbauthz
package
This package is not in the latest version of its module.
Details
Validgo.mod file
The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
- Redistributable license
Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
- Tagged version
Modules with tagged versions give importers more predictable builds.
- Stable version
When a project reaches major version v1 it is considered stable.
- Learn more about best practices
Repository
Links
Open Source Insights
Documentation¶
Overview¶
Package dbauthz provides an authorization layer on top of the database. Thispackage exposes an interface that is currently a 1:1 mapping withdatabase.Store.
The same cultural rules apply to this package as they do to database.Store.Meaning that each method implemented should keep the number of databasequeries as close to 1 as possible. Each method should do 1 thing, with nounexpected side effects (eg: updating multiple tables in a single method).
Do not implement business logic in this package. Only authorization relatedlogic should be implemented here. In most cases, this should only be a call tothe rbac authorizer.
When a new database method is added to database.Store, it should be added tothis package as well. The unit test "Accounting" will ensure all methods aretested. See other unit tests for examples on how to write these.
Index¶
- Variables
- func ActorFromContext(ctx context.Context) (rbac.Subject, bool)
- func As(ctx context.Context, actor rbac.Subject) context.Context
- func AsAutostart(ctx context.Context) context.Context
- func AsJobReaper(ctx context.Context) context.Context
- func AsKeyReader(ctx context.Context) context.Context
- func AsKeyRotator(ctx context.Context) context.Context
- func AsNotifier(ctx context.Context) context.Context
- func AsPrebuildsOrchestrator(ctx context.Context) context.Context
- func AsProvisionerd(ctx context.Context) context.Context
- func AsResourceMonitor(ctx context.Context) context.Context
- func AsSystemReadProvisionerDaemons(ctx context.Context) context.Context
- func AsSystemRestricted(ctx context.Context) context.Context
- func IsNotAuthorizedError(err error) bool
- func New(db database.Store, authorizer rbac.Authorizer, logger slog.Logger, ...) database.Store
- type AGPLTemplateAccessControlStore
- type AccessControlStore
- type NotAuthorizedError
- type TemplateAccessControl
Constants¶
This section is empty.
Variables¶
var AsRemoveActor =rbac.Subject{ID: "remove-actor",}var ErrNoActor =xerrors.Errorf("no authorization actor in context")ErrNoActor is returned if no actor is present in the context.
Functions¶
funcActorFromContext¶
ActorFromContext returns the authorization subject from the context.All authentication flows should set the authorization subject in the context.If no actor is present, the function returns false.
funcAs¶
As returns a context with the given actor stored in the context.This is used for cases where the actor touching the database is not theactor stored in the context.When you use this function, be sure to add a //nolint commentexplaining why it is necessary.
funcAsAutostart¶
AsAutostart returns a context with an actor that has permissions requiredfor autostart to function.
funcAsJobReaper¶added inv2.23.0
AsJobReaper returns a context with an actor that has permissions requiredfor reaper.Detector to function.
funcAsKeyReader¶added inv2.17.0
AsKeyReader returns a context with an actor that has permissions required for reading crypto keys.
funcAsKeyRotator¶added inv2.17.0
AsKeyRotator returns a context with an actor that has permissions required for rotating crypto keys.
funcAsNotifier¶added inv2.18.0
AsNotifier returns a context with an actor that has permissions required forcreating/reading/updating/deleting notifications.
funcAsPrebuildsOrchestrator¶added inv2.22.0
AsPrebuildsOrchestrator returns a context with an actor that has permissionsto read orchestrator workspace prebuilds.
funcAsProvisionerd¶
AsProvisionerd returns a context with an actor that has permissions requiredfor provisionerd to function.
funcAsResourceMonitor¶added inv2.20.0
AsResourceMonitor returns a context with an actor that has permissions required forupdating resource monitors.
funcAsSystemReadProvisionerDaemons¶added inv2.18.1
AsSystemReadProvisionerDaemons returns a context with an actor that has permissionsto read provisioner daemons.
funcAsSystemRestricted¶
AsSystemRestricted returns a context with an actor that has permissionsrequired for various system operations (login, logout, metrics cache).
Types¶
typeAGPLTemplateAccessControlStore¶added inv2.3.2
type AGPLTemplateAccessControlStore struct{}AGPLTemplateAccessControlStore always returns the defaults for access controlsettings.
func (AGPLTemplateAccessControlStore)GetTemplateAccessControl¶added inv2.3.2
func (AGPLTemplateAccessControlStore) GetTemplateAccessControl(tdatabase.Template)TemplateAccessControl
func (AGPLTemplateAccessControlStore)SetTemplateAccessControl¶added inv2.3.2
func (AGPLTemplateAccessControlStore) SetTemplateAccessControl(ctxcontext.Context, storedatabase.Store, iduuid.UUID, optsTemplateAccessControl)error
typeAccessControlStore¶added inv2.3.2
type AccessControlStore interface {GetTemplateAccessControl(tdatabase.Template)TemplateAccessControlSetTemplateAccessControl(ctxcontext.Context, storedatabase.Store, iduuid.UUID, optsTemplateAccessControl)error}AccessControlStore fetches access control-related configurationthat is used when determining whether an actor is authorizedto interact with an RBAC object.
typeNotAuthorizedError¶
type NotAuthorizedError struct {Errerror}NotAuthorizedError is a sentinel error that unwraps to sql.ErrNoRows.This allows the internal error to be read by the caller if needed. Otherwiseit will be handled as a 404.
func (NotAuthorizedError)Error¶
func (eNotAuthorizedError) Error()string
func (NotAuthorizedError)IsUnauthorized¶added inv2.1.5
func (NotAuthorizedError) IsUnauthorized()bool
IsUnauthorized implements the IsUnauthorized interface.
func (NotAuthorizedError)Unwrap¶
func (eNotAuthorizedError) Unwrap()error
Unwrap will always unwrap to a sql.ErrNoRows so the API returns a 404.So 'errors.Is(err, sql.ErrNoRows)' will always be true.
typeTemplateAccessControl¶added inv2.3.2
func (TemplateAccessControl)IsDeprecated¶added inv2.5.0
func (tTemplateAccessControl) IsDeprecated()bool
Source Files