146 lines
6.1 KiB
Go
146 lines
6.1 KiB
Go
package extension
|
|
|
|
import "context"
|
|
|
|
const RolePolicySchemaVersion = 1
|
|
|
|
type RolePermission struct {
|
|
Allowed bool `json:"allowed"`
|
|
CapAllowed bool `json:"capAllowed"`
|
|
}
|
|
|
|
// RolePolicySnapshot contains authorization metadata only. It intentionally
|
|
// excludes profile contact fields and credentials.
|
|
type RolePolicySnapshot struct {
|
|
SchemaVersion int `json:"schemaVersion"`
|
|
UserID string `json:"userId"`
|
|
Owner string `json:"owner"`
|
|
AccountEnabled bool `json:"accountEnabled"`
|
|
BindingID string `json:"bindingId,omitempty"`
|
|
RoleID string `json:"roleId,omitempty"`
|
|
RoleName string `json:"roleName,omitempty"`
|
|
RoleDescription string `json:"roleDescription,omitempty"`
|
|
RoleEnabled bool `json:"roleEnabled"`
|
|
RoleVersion int64 `json:"roleVersion,omitempty"`
|
|
AuthorityEpoch int64 `json:"authorityEpoch"`
|
|
Permissions map[string]RolePermission `json:"permissions"`
|
|
Linked LinkedCapabilities `json:"linked"`
|
|
}
|
|
|
|
// LinkedCapabilities is the Backend-computed project.create link for one
|
|
// account. Actions apply only to projects the account created; Source names
|
|
// where project.create comes from (bootstrap-admin, system-grant or role) and
|
|
// Conflicts lists linked actions that the account's enabled role caps off.
|
|
type LinkedCapabilities struct {
|
|
ProjectCreate bool `json:"projectCreate"`
|
|
Source string `json:"source,omitempty"`
|
|
Actions []string `json:"actions"`
|
|
Conflicts []string `json:"conflicts,omitempty"`
|
|
}
|
|
|
|
type RoleActionDecision struct {
|
|
ActionID string `json:"actionId"`
|
|
RoleID string `json:"roleId,omitempty"`
|
|
Allowed bool `json:"allowed"`
|
|
CapAllowed bool `json:"capAllowed"`
|
|
AuthorityEpoch int64 `json:"authorityEpoch"`
|
|
Reason string `json:"reason,omitempty"`
|
|
}
|
|
|
|
// RolePolicyProvider is optional on a trusted dispatch Host. Its actor is
|
|
// bound by the Backend; callers cannot supply or replace that actor.
|
|
type RolePolicyProvider interface {
|
|
CurrentRolePolicy(context.Context) (RolePolicySnapshot, error)
|
|
RolePolicyForUser(context.Context, string) (RolePolicySnapshot, error)
|
|
RolePolicyForOwner(context.Context, string) (RolePolicySnapshot, error)
|
|
CheckRoleAction(context.Context, string, string) (RoleActionDecision, error)
|
|
}
|
|
|
|
// RoleOption is the public directory projection of one enabled role: a stable
|
|
// identifier and its display name only. It never carries permissions,
|
|
// bindings or counts, so a non-admin caller learns nothing about authority.
|
|
type RoleOption struct {
|
|
RoleID string `json:"roleId"`
|
|
Name string `json:"name"`
|
|
}
|
|
|
|
// RoleOptionsProvider is optional on a trusted dispatch Host. The Host binds
|
|
// the actor; callers still authorize their own domain action before offering
|
|
// the options.
|
|
type RoleOptionsProvider interface {
|
|
ListRoleOptions(context.Context) ([]RoleOption, error)
|
|
}
|
|
|
|
type SystemActionDecision struct {
|
|
ActionID string `json:"actionId"`
|
|
Allowed bool `json:"allowed"`
|
|
AuthorityEpoch int64 `json:"authorityEpoch"`
|
|
Reason string `json:"reason,omitempty"`
|
|
}
|
|
|
|
// SystemActionProvider exposes only the current Host-bound actor's effective
|
|
// system action. It never accepts a caller-supplied actor.
|
|
type SystemActionProvider interface {
|
|
CheckCurrentSystemAction(context.Context, string) (SystemActionDecision, error)
|
|
}
|
|
|
|
type RoleAdminRecord struct {
|
|
RoleID string `json:"roleId"`
|
|
Name string `json:"name"`
|
|
Description string `json:"description"`
|
|
Enabled bool `json:"enabled"`
|
|
RoleVersion int64 `json:"roleVersion"`
|
|
BindingCount int `json:"bindingCount"`
|
|
Permissions map[string]RolePermission `json:"permissions"`
|
|
}
|
|
|
|
type RoleBindingResult struct {
|
|
BindingID string `json:"bindingId"`
|
|
UserID string `json:"userId"`
|
|
RoleID string `json:"roleId"`
|
|
UserStateVersion int64 `json:"userStateVersion"`
|
|
AuthorityEpoch int64 `json:"authorityEpoch"`
|
|
}
|
|
|
|
type RoleAuthorityImportRole struct {
|
|
RoleID string `json:"roleId"`
|
|
Name string `json:"name"`
|
|
Description string `json:"description,omitempty"`
|
|
Enabled bool `json:"enabled"`
|
|
RoleVersion int64 `json:"roleVersion"`
|
|
Permissions map[string]RolePermission `json:"permissions"`
|
|
Owners []string `json:"owners"`
|
|
}
|
|
|
|
type RoleAuthorityImport struct {
|
|
SourceSchemaVersion int `json:"sourceSchemaVersion"`
|
|
SourceSHA256 string `json:"sourceSha256"`
|
|
Roles []RoleAuthorityImportRole `json:"roles"`
|
|
}
|
|
|
|
type RoleAuthorityImportResult struct {
|
|
AuthorityEpoch int64 `json:"authorityEpoch"`
|
|
ImportedRoles int `json:"importedRoles"`
|
|
ImportedUsers int `json:"importedUsers"`
|
|
}
|
|
|
|
type RoleAuthorityImportProjection struct {
|
|
SourceSHA256 string `json:"sourceSha256"`
|
|
AuthorityEpoch int64 `json:"authorityEpoch"`
|
|
Roles []RoleAdminRecord `json:"roles"`
|
|
Bindings map[string]string `json:"bindings"` // stable owner -> roleId
|
|
}
|
|
|
|
// RolePolicyAdmin is a temporary compatibility surface for trusted RDM
|
|
// commands while the UI moves to Backend HTTP APIs. The Host binds the actor.
|
|
type RolePolicyAdmin interface {
|
|
ListRoles(context.Context) ([]RoleAdminRecord, error)
|
|
CreateRole(context.Context, string, string) (RoleAdminRecord, error)
|
|
SetRolePermission(context.Context, string, string, bool, bool, string) (RoleAdminRecord, error)
|
|
AssignRoleByOwner(context.Context, string, string, string) (RoleBindingResult, error)
|
|
SetRoleEnabled(context.Context, string, bool) (RoleAdminRecord, error)
|
|
ImportRoleAuthority(context.Context, RoleAuthorityImport, string) (RoleAuthorityImportResult, error)
|
|
ReadRoleAuthorityImport(context.Context, string) (RoleAuthorityImportProjection, error)
|
|
ActivateRoleAuthorityImport(context.Context, string, int64) (RoleAuthorityImportResult, error)
|
|
}
|