var (// ResourceWildcard// Valid ActionsResourceWildcard =Object{Type: "*",}// ResourceApiKey// Valid Actions//  - "ActionCreate" :: create an api key//  - "ActionDelete" :: delete an api key//  - "ActionRead" :: read api key details (secrets are not stored)//  - "ActionUpdate" :: update an api key, eg expiresResourceApiKey =Object{Type: "api_key",}// ResourceAssignOrgRole// Valid Actions//  - "ActionAssign" :: assign org scoped roles//  - "ActionCreate" :: create/delete custom roles within an organization//  - "ActionDelete" :: delete roles within an organization//  - "ActionRead" :: view what roles are assignable within an organization//  - "ActionUnassign" :: unassign org scoped roles//  - "ActionUpdate" :: edit custom roles within an organizationResourceAssignOrgRole =Object{Type: "assign_org_role",}// ResourceAssignRole// Valid Actions//  - "ActionAssign" :: assign user roles//  - "ActionRead" :: view what roles are assignable//  - "ActionUnassign" :: unassign user rolesResourceAssignRole =Object{Type: "assign_role",}// ResourceAuditLog// Valid Actions//  - "ActionCreate" :: create new audit log entries//  - "ActionRead" :: read audit logsResourceAuditLog =Object{Type: "audit_log",}// ResourceChat// Valid Actions//  - "ActionCreate" :: create a chat//  - "ActionDelete" :: delete a chat//  - "ActionRead" :: read a chat//  - "ActionUpdate" :: update a chatResourceChat =Object{Type: "chat",}// ResourceCryptoKey// Valid Actions//  - "ActionCreate" :: create crypto keys//  - "ActionDelete" :: delete crypto keys//  - "ActionRead" :: read crypto keys//  - "ActionUpdate" :: update crypto keysResourceCryptoKey =Object{Type: "crypto_key",}// ResourceDebugInfo// Valid Actions//  - "ActionRead" :: access to debug routesResourceDebugInfo =Object{Type: "debug_info",}// ResourceDeploymentConfig// Valid Actions//  - "ActionRead" :: read deployment config//  - "ActionUpdate" :: updating health informationResourceDeploymentConfig =Object{Type: "deployment_config",}// ResourceDeploymentStats// Valid Actions//  - "ActionRead" :: read deployment statsResourceDeploymentStats =Object{Type: "deployment_stats",}// ResourceFile// Valid Actions//  - "ActionCreate" :: create a file//  - "ActionRead" :: read filesResourceFile =Object{Type: "file",}// ResourceGroup// Valid Actions//  - "ActionCreate" :: create a group//  - "ActionDelete" :: delete a group//  - "ActionRead" :: read groups//  - "ActionUpdate" :: update a groupResourceGroup =Object{Type: "group",}// ResourceGroupMember// Valid Actions//  - "ActionRead" :: read group membersResourceGroupMember =Object{Type: "group_member",}// ResourceIdpsyncSettings// Valid Actions//  - "ActionRead" :: read IdP sync settings//  - "ActionUpdate" :: update IdP sync settingsResourceIdpsyncSettings =Object{Type: "idpsync_settings",}// ResourceInboxNotification// Valid Actions//  - "ActionCreate" :: create inbox notifications//  - "ActionRead" :: read inbox notifications//  - "ActionUpdate" :: update inbox notificationsResourceInboxNotification =Object{Type: "inbox_notification",}// ResourceLicense// Valid Actions//  - "ActionCreate" :: create a license//  - "ActionDelete" :: delete license//  - "ActionRead" :: read licensesResourceLicense =Object{Type: "license",}// ResourceNotificationMessage// Valid Actions//  - "ActionCreate" :: create notification messages//  - "ActionDelete" :: delete notification messages//  - "ActionRead" :: read notification messages//  - "ActionUpdate" :: update notification messagesResourceNotificationMessage =Object{Type: "notification_message",}// ResourceNotificationPreference// Valid Actions//  - "ActionRead" :: read notification preferences//  - "ActionUpdate" :: update notification preferencesResourceNotificationPreference =Object{Type: "notification_preference",}// ResourceNotificationTemplate// Valid Actions//  - "ActionRead" :: read notification templates//  - "ActionUpdate" :: update notification templatesResourceNotificationTemplate =Object{Type: "notification_template",}// ResourceOauth2App// Valid Actions//  - "ActionCreate" :: make an OAuth2 app//  - "ActionDelete" :: delete an OAuth2 app//  - "ActionRead" :: read OAuth2 apps//  - "ActionUpdate" :: update the properties of the OAuth2 appResourceOauth2App =Object{Type: "oauth2_app",}// ResourceOauth2AppCodeToken// Valid Actions//  - "ActionCreate" :: create an OAuth2 app code token//  - "ActionDelete" :: delete an OAuth2 app code token//  - "ActionRead" :: read an OAuth2 app code tokenResourceOauth2AppCodeToken =Object{Type: "oauth2_app_code_token",}// ResourceOauth2AppSecret// Valid Actions//  - "ActionCreate" :: create an OAuth2 app secret//  - "ActionDelete" :: delete an OAuth2 app secret//  - "ActionRead" :: read an OAuth2 app secret//  - "ActionUpdate" :: update an OAuth2 app secretResourceOauth2AppSecret =Object{Type: "oauth2_app_secret",}// ResourceOrganization// Valid Actions//  - "ActionCreate" :: create an organization//  - "ActionDelete" :: delete an organization//  - "ActionRead" :: read organizations//  - "ActionUpdate" :: update an organizationResourceOrganization =Object{Type: "organization",}// ResourceOrganizationMember// Valid Actions//  - "ActionCreate" :: create an organization member//  - "ActionDelete" :: delete member//  - "ActionRead" :: read member//  - "ActionUpdate" :: update an organization memberResourceOrganizationMember =Object{Type: "organization_member",}// ResourceProvisionerDaemon// Valid Actions//  - "ActionCreate" :: create a provisioner daemon/key//  - "ActionDelete" :: delete a provisioner daemon/key//  - "ActionRead" :: read provisioner daemon//  - "ActionUpdate" :: update a provisioner daemonResourceProvisionerDaemon =Object{Type: "provisioner_daemon",}// ResourceProvisionerJobs// Valid Actions//  - "ActionCreate" :: create provisioner jobs//  - "ActionRead" :: read provisioner jobs//  - "ActionUpdate" :: update provisioner jobsResourceProvisionerJobs =Object{Type: "provisioner_jobs",}// ResourceReplicas// Valid Actions//  - "ActionRead" :: read replicasResourceReplicas =Object{Type: "replicas",}// ResourceSystem// Valid Actions//  - "ActionCreate" :: create system resources//  - "ActionDelete" :: delete system resources//  - "ActionRead" :: view system resources//  - "ActionUpdate" :: update system resources// DEPRECATED: New resources should be created for new things, rather than adding them to System, which has become//             an unmanaged collection of things that don't relate to one another. We can't effectively enforce//             least privilege access control when unrelated resources are grouped together.ResourceSystem =Object{Type: "system",}// ResourceTailnetCoordinator// Valid Actions//  - "ActionCreate" :: create a Tailnet coordinator//  - "ActionDelete" :: delete a Tailnet coordinator//  - "ActionRead" :: view info about a Tailnet coordinator//  - "ActionUpdate" :: update a Tailnet coordinatorResourceTailnetCoordinator =Object{Type: "tailnet_coordinator",}// ResourceTemplate// Valid Actions//  - "ActionCreate" :: create a template//  - "ActionDelete" :: delete a template//  - "ActionRead" :: read template//  - "ActionUpdate" :: update a template//  - "ActionUse" :: use the template to initially create a workspace, then workspace lifecycle permissions take over//  - "ActionViewInsights" :: view insightsResourceTemplate =Object{Type: "template",}// ResourceUser// Valid Actions//  - "ActionCreate" :: create a new user//  - "ActionDelete" :: delete an existing user//  - "ActionRead" :: read user data//  - "ActionReadPersonal" :: read personal user data like user settings and auth links//  - "ActionUpdate" :: update an existing user//  - "ActionUpdatePersonal" :: update personal dataResourceUser =Object{Type: "user",}// ResourceWebpushSubscription// Valid Actions//  - "ActionCreate" :: create webpush subscriptions//  - "ActionDelete" :: delete webpush subscriptions//  - "ActionRead" :: read webpush subscriptionsResourceWebpushSubscription =Object{Type: "webpush_subscription",}// ResourceWorkspace// Valid Actions//  - "ActionApplicationConnect" :: connect to workspace apps via browser//  - "ActionCreate" :: create a new workspace//  - "ActionCreateAgent" :: create a new workspace agent//  - "ActionDelete" :: delete workspace//  - "ActionDeleteAgent" :: delete an existing workspace agent//  - "ActionRead" :: read workspace data to view on the UI//  - "ActionSSH" :: ssh into a given workspace//  - "ActionWorkspaceStart" :: allows starting a workspace//  - "ActionWorkspaceStop" :: allows stopping a workspace//  - "ActionUpdate" :: edit workspace settings (scheduling, permissions, parameters)ResourceWorkspace =Object{Type: "workspace",}// ResourceWorkspaceAgentDevcontainers// Valid Actions//  - "ActionCreate" :: create workspace agent devcontainersResourceWorkspaceAgentDevcontainers =Object{Type: "workspace_agent_devcontainers",}// ResourceWorkspaceAgentResourceMonitor// Valid Actions//  - "ActionCreate" :: create workspace agent resource monitor//  - "ActionRead" :: read workspace agent resource monitor//  - "ActionUpdate" :: update workspace agent resource monitorResourceWorkspaceAgentResourceMonitor =Object{Type: "workspace_agent_resource_monitor",}// ResourceWorkspaceDormant// Valid Actions//  - "ActionApplicationConnect" :: connect to workspace apps via browser//  - "ActionCreate" :: create a new workspace//  - "ActionCreateAgent" :: create a new workspace agent//  - "ActionDelete" :: delete workspace//  - "ActionDeleteAgent" :: delete an existing workspace agent//  - "ActionRead" :: read workspace data to view on the UI//  - "ActionSSH" :: ssh into a given workspace//  - "ActionWorkspaceStart" :: allows starting a workspace//  - "ActionWorkspaceStop" :: allows stopping a workspace//  - "ActionUpdate" :: edit workspace settings (scheduling, permissions, parameters)ResourceWorkspaceDormant =Object{Type: "workspace_dormant",}// ResourceWorkspaceProxy// Valid Actions//  - "ActionCreate" :: create a workspace proxy//  - "ActionDelete" :: delete a workspace proxy//  - "ActionRead" :: read and use a workspace proxy//  - "ActionUpdate" :: update a workspace proxyResourceWorkspaceProxy =Object{Type: "workspace_proxy",})

funcAllActions¶

func AllActions() []policy.Action

funcCanAssignRole¶

func CanAssignRole(subjectHasRolesExpandableRoles, assignedRoleRoleIdentifier)bool

CanAssignRole is a helper function that returns true if the user can assignthe specified role. This also can be used for removing a role.This is a simple implementation for now.

funcChangeRoleSet¶

func ChangeRoleSet(from []RoleIdentifier, to []RoleIdentifier) (added []RoleIdentifier, removed []RoleIdentifier)

ChangeRoleSet is a helper function that finds the difference of 2 sets ofroles. When setting a user's new roles, it is equivalent to adding andremoving roles. This set determines the changes, so that the appropriateRBAC checks can be applied using "ActionCreate" and "ActionDelete" for"added" and "removed" roles respectively.

funcConfigWithACL¶

func ConfigWithACL()regosql.ConvertConfig

ConfigWithACL is the basic configuration for converting rego to SQL whenthe object has group and user ACL fields.

funcConfigWithoutACL¶

func ConfigWithoutACL()regosql.ConvertConfig

ConfigWithoutACL is the basic configuration for converting rego to SQL whenthe object has no ACL fields.

funcConfigWorkspaces¶added inv2.8.0

func ConfigWorkspaces()regosql.ConvertConfig

funcFilter¶

func Filter[OObjecter](ctxcontext.Context, authAuthorizer, subjectSubject, actionpolicy.Action, objects []O) ([]O,error)

Filter takes in a list of objects, and will filter the list removing allthe elements the subject does not have permission for. All objects must beof the same type.

Ideally the 'CompileToSQL' is used instead for large sets. This cost scaleslinearly with the number of objects passed in.

funcIsUnauthorizedError¶

func IsUnauthorizedError(errerror)bool

IsUnauthorizedError is a convenience function to check if err is UnauthorizedError.It is equivalent to errors.As(err, &UnauthorizedError{}).

funcReloadBuiltinRoles¶

func ReloadBuiltinRoles(opts *RoleOptions)

ReloadBuiltinRoles loads the static roles into the builtInRoles map.This can be called again with a different config to change the behavior.

TODO: @emyrk This would be great if it was instanced to a coderd ratherthan a global. But that is a much larger refactor right now.Essentially we did not foresee different deployments needing slightlydifferent role permissions.

funcReservedRoleName¶added inv2.13.0

func ReservedRoleName(namestring)bool

ReservedRoleName exists because the database should only allow unique rolenames, but some roles are built in. So these names are reserved

funcRoleOrgAdmin¶

func RoleOrgAdmin()string

funcRoleOrgAuditor¶added inv2.14.0

func RoleOrgAuditor()string

funcRoleOrgMember¶

func RoleOrgMember()string

funcRoleOrgTemplateAdmin¶added inv2.14.0

func RoleOrgTemplateAdmin()string

funcRoleOrgUserAdmin¶added inv2.14.0

func RoleOrgUserAdmin()string

funcRoleOrgWorkspaceCreationBan¶added inv2.20.0

func RoleOrgWorkspaceCreationBan()string

funcWithAuthzCheckRecorder¶added inv2.22.0

func WithAuthzCheckRecorder(ctxcontext.Context)context.Context

typeAuthCall¶

type AuthCall struct {ActorSubjectActionpolicy.ActionObjectObject}

typeAuthorizeFilter¶

type AuthorizeFilter interface {SQLString()string}

AuthorizeFilter is a compiled partial query that can be converted to SQL.This allows enforcing the policy on the database side in a WHERE clause.

func Compile(cfgregosql.ConvertConfig, pa *PartialAuthorizer) (AuthorizeFilter,error)

typeAuthorizer¶

type Authorizer interface {// Authorize will authorize the given subject to perform the given action// on the given object. Authorize is pure and deterministic with respect to// its arguments and the surrounding object.Authorize(ctxcontext.Context, subjectSubject, actionpolicy.Action, objectObject)errorPrepare(ctxcontext.Context, subjectSubject, actionpolicy.Action, objectTypestring) (PreparedAuthorized,error)}

func Cacher(authzAuthorizer)Authorizer

func NewCachingAuthorizer(registryprometheus.Registerer)Authorizer

func NewStrictCachingAuthorizer(registryprometheus.Registerer)Authorizer

func Recorder(authzAuthorizer)Authorizer

typeAuthzCheckRecorder¶added inv2.22.0

type AuthzCheckRecorder struct {// contains filtered or unexported fields}

func GetAuthzCheckRecorder(ctxcontext.Context) (*AuthzCheckRecorder,bool)

func (r *AuthzCheckRecorder) String()string

typeExpandableRoles¶

type ExpandableRoles interface {Expand() ([]Role,error)// Names is for logging and tracing purposes, we want to know the human// names of the expanded roles.Names() []RoleIdentifier}

ExpandableRoles is any type that can be expanded into a []Role. This is implementedas an interface so we can have RoleIdentifiers for user defined roles, and implementcustom ExpandableRoles for system type users (eg autostart/autostop system role).We want a clear divide between the two types of roles so users have no codepathto interact or assign system roles.

Note: We may also want to do the same thing with scopes to allow custom scopesupport unavailable to the user. Eg: Scope to a single resource.

typeExpandableScope¶

type ExpandableScope interface {Expand() (Scope,error)// Name is for logging and tracing purposes, we want to know the human// name of the scope.Name()RoleIdentifier}

typeObject¶

type Object struct {// ID is the resource's uuidIDstring `json:"id"`Ownerstring `json:"owner"`// OrgID specifies which org the object is a part of.OrgIDstring `json:"org_owner"`// AnyOrgOwner will disregard the org_owner when checking for permissions// Use this to ask, "Can the actor do this action on any org?" when// the exact organization is not important or known.// E.g: The UI should show a "create template" button if the user// can create a template in any org.AnyOrgOwnerbool `json:"any_org"`// Type is "workspace", "project", "app", etcTypestring `json:"type"`ACLUserList  map[string][]policy.Action ` json:"acl_user_list"`ACLGroupList map[string][]policy.Action ` json:"acl_group_list"`}

Object is used to create objects for authz checks when you have none inhand to run the check on.An example is if you want to list all workspaces, you can create a Objectthat represents the set of workspaces you are trying to get access too.Do not export this type, as it can be created from a resource type constant.

func ResourceUserObject(userIDuuid.UUID)Object

func (zObject) All()Object

func (zObject) AnyOrganization()Object

func (zObject) AvailableActions() []policy.Action

func (zObject) Equal(bObject)bool

func (zObject) InOrg(orgIDuuid.UUID)Object

func (zObject) RBACObject()Object

func (zObject) String()string

func (zObject) ValidAction(actionpolicy.Action)error

func (zObject) WithACLUserList(acl map[string][]policy.Action)Object

func (zObject) WithGroupACL(groups map[string][]policy.Action)Object

func (zObject) WithID(iduuid.UUID)Object

func (zObject) WithIDString(idstring)Object

func (zObject) WithOwner(ownerIDstring)Object

typeObjecter¶

type Objecter interface {RBACObject()Object}

Objecter returns the RBAC object for itself.

func AllResources() []Objecter

typePartialAuthorizer¶

type PartialAuthorizer struct {// contains filtered or unexported fields}

PartialAuthorizer is a prepared authorizer with the subject, action, andresource type fields already filled in. This speeds up authorizationwhen authorizing the same type of object numerous times.See rbac.Filter for example usage.

func (pa *PartialAuthorizer) Authorize(ctxcontext.Context, objectObject)error

func (pa *PartialAuthorizer) CompileToSQL(ctxcontext.Context, cfgregosql.ConvertConfig) (string,error)

typePermission¶

type Permission struct {// Negate makes this a negative permissionNegatebool          `json:"negate"`ResourceTypestring        `json:"resource_type"`Actionpolicy.Action `json:"action"`}

Permission is the format passed into the rego.

func Permissions(perms map[string][]policy.Action) []Permission

func (permPermission) Valid()error

typePreparedAuthorized¶

type PreparedAuthorized interface {Authorize(ctxcontext.Context, objectObject)errorCompileToSQL(ctxcontext.Context, cfgregosql.ConvertConfig) (string,error)}

typeRegoAuthorizer¶

type RegoAuthorizer struct {// contains filtered or unexported fields}

RegoAuthorizer will use a prepared rego query for performing authorize()

func NewAuthorizer(registryprometheus.Registerer) *RegoAuthorizer

func (aRegoAuthorizer) Authorize(ctxcontext.Context, subjectSubject, actionpolicy.Action, objectObject)error

func (aRegoAuthorizer) Prepare(ctxcontext.Context, subjectSubject, actionpolicy.Action, objectTypestring) (PreparedAuthorized,error)

typeRole¶

type Role struct {IdentifierRoleIdentifier `json:"name"`// DisplayName is used for UI purposes. If the role has no display name,// that means the UI should never display it.DisplayNamestring       `json:"display_name"`Site        []Permission `json:"site"`// Org is a map of orgid to permissions. We represent orgid as a string.// We scope the organizations in the role so we can easily combine all the// roles.Org  map[string][]Permission `json:"org"`User []Permission            `json:"user"`// contains filtered or unexported fields}

Role is a set of permissions at multiple levels:- Site level permissions apply EVERYWHERE- Org level permissions apply to EVERYTHING in a given ORG- User level permissions are the lowestThis is the type passed into the rego as a json payload.Users of this package should instead **only** use the role names, andthis package will expand the role names into their json payloads.

func OrganizationRoles(organizationIDuuid.UUID) []Role

func RoleByName(nameRoleIdentifier) (Role,error)

func SiteBuiltInRoles() []Role

func (roleRole) Valid()error

typeRoleIdentifier¶added inv2.13.0

type RoleIdentifier struct {Namestring// OrganizationID is uuid.Nil for unscoped roles (aka deployment wide)OrganizationIDuuid.UUID}

RoleIdentifier contains both the name of the role, and any organizational scope.Both fields are required to be globally unique and identifiable.

func CustomOrganizationRole(orgIDuuid.UUID)RoleIdentifier

func CustomSiteRole()RoleIdentifier

func RoleAuditor()RoleIdentifier

func RoleMember()RoleIdentifier

func RoleNameFromString(inputstring) (RoleIdentifier,error)

func RoleOwner()RoleIdentifier

func RoleTemplateAdmin()RoleIdentifier

func RoleUserAdmin()RoleIdentifier

func ScopedRoleOrgAdmin(organizationIDuuid.UUID)RoleIdentifier

func ScopedRoleOrgAuditor(organizationIDuuid.UUID)RoleIdentifier

func ScopedRoleOrgMember(organizationIDuuid.UUID)RoleIdentifier

func ScopedRoleOrgTemplateAdmin(organizationIDuuid.UUID)RoleIdentifier

func ScopedRoleOrgUserAdmin(organizationIDuuid.UUID)RoleIdentifier

func ScopedRoleOrgWorkspaceCreationBan(organizationIDuuid.UUID)RoleIdentifier

func (rRoleIdentifier) IsOrgRole()bool

func (r *RoleIdentifier) MarshalJSON() ([]byte,error)

func (rRoleIdentifier) String()string

func (rRoleIdentifier) UniqueName()string

func (r *RoleIdentifier) UnmarshalJSON(data []byte)error

typeRoleIdentifiers¶added inv2.13.0

type RoleIdentifiers []RoleIdentifier

RoleIdentifiers is a list of user assignable role names. The role names must bein the builtInRoles map. Any non-user assignable roles will generate anerror on Expand.

func (namesRoleIdentifiers) Expand() ([]Role,error)

func (namesRoleIdentifiers) Names() []RoleIdentifier

typeRoleOptions¶

type RoleOptions struct {NoOwnerWorkspaceExecbool}

typeRoles¶

type Roles []Role

func (rolesRoles) Expand() ([]Role,error)

func (rolesRoles) Names() []RoleIdentifier

typeScope¶

type Scope struct {RoleAllowIDList []string `json:"allow_list"`}

Scope acts the exact same as a Role with the addition that is can alsoapply an AllowIDList. Any resource being checked against a Scope willreject any resource that is not in the AllowIDList.To not use an AllowIDList to reject authorization, use a wildcard for theAllowIDList. Eg: 'AllowIDList: []string{WildcardSymbol}'

func ExpandScope(scopeScopeName) (Scope,error)

func WorkspaceAgentScope(paramsWorkspaceAgentScopeParams)Scope

func (sScope) Expand() (Scope,error)

func (sScope) Name()RoleIdentifier

typeScopeName¶

type ScopeNamestring

const (ScopeAllScopeName = "all"ScopeApplicationConnectScopeName = "application_connect"ScopeNoUserDataScopeName = "no_user_data")

func (nameScopeName) Expand() (Scope,error)

func (nameScopeName) Name()RoleIdentifier

typeSubject¶

type Subject struct {// FriendlyName is entirely optional and is used for logging and debugging// It is not used in any functional way.// It is usually the "username" of the user, but it can be the name of the// external workspace proxy or other service type actor.FriendlyNamestring// Email is entirely optional and is used for logging and debugging// It is not used in any functional way.Emailstring// Type indicates what kind of subject this is (user, system, provisioner, etc.)// It is not used in any functional way, only for logging.TypeSubjectTypeIDstringRolesExpandableRolesGroups []stringScopeExpandableScope// contains filtered or unexported fields}

Subject is a struct that contains all the elements of a subject in an rbacauthorize.

func (sSubject) Equal(bSubject)bool

func (sSubject) RegoValueOk()error

func (sSubject) SafeRoleNames() []RoleIdentifier

func (sSubject) SafeScopeName()string

func (sSubject) WithCachedASTValue()Subject

typeSubjectType¶added inv2.19.2

type SubjectTypestring

SubjectType represents the type of subject in the RBAC system.

const (SubjectTypeUserSubjectType = "user"SubjectTypeProvisionerdSubjectType = "provisionerd"SubjectTypeAutostartSubjectType = "autostart"SubjectTypeJobReaperSubjectType = "job_reaper"SubjectTypeResourceMonitorSubjectType = "resource_monitor"SubjectTypeCryptoKeyRotatorSubjectType = "crypto_key_rotator"SubjectTypeCryptoKeyReaderSubjectType = "crypto_key_reader"SubjectTypePrebuildsOrchestratorSubjectType = "prebuilds_orchestrator"SubjectTypeSystemReadProvisionerDaemonsSubjectType = "system_read_provisioner_daemons"SubjectTypeSystemRestrictedSubjectType = "system_restricted"SubjectTypeNotifierSubjectType = "notifier")

typeUnauthorizedError¶

type UnauthorizedError struct {// contains filtered or unexported fields}

UnauthorizedError is the error type for authorization errors

func ForbiddenWithInternal(internalerror, subjectSubject, actionpolicy.Action, objectObject, outputrego.ResultSet) *UnauthorizedError

func (*UnauthorizedError) As(target interface{})bool

func (eUnauthorizedError) Error()string

func (e *UnauthorizedError) Input() map[string]interface{}

func (e *UnauthorizedError) Internal()error

func (UnauthorizedError) IsUnauthorized()bool

func (e *UnauthorizedError) Output()rego.ResultSet

func (e *UnauthorizedError) SetInternal(errerror)

func (eUnauthorizedError) Unwrap()error

typeWorkspaceAgentScopeParams¶added inv2.6.0

type WorkspaceAgentScopeParams struct {WorkspaceIDuuid.UUIDOwnerIDuuid.UUIDTemplateIDuuid.UUIDVersionIDuuid.UUIDBlockUserDatabool}