Jeff Mitchell
f41bf6e31e
This adds parsing and validation for grant strings along with the ability to create canonical JSON and text strings from a grant. It also adds an ACL implementation, allowing a collection of grant strings to then be checked against a resource/action tuple and indicate if it's allowed. Note that only specific sets of provided data in grant strings is allowed. This vastly simplifies logic. Test coverage is 100%. A future update will consolidate and migrate types between this and IAM but I didn't want to mix that in with this.
22 lines
767 B
Go
22 lines
767 B
Go
/*
|
|
Package perms provides the watchtower permissions engine using grants which are
|
|
tied to IAM Roles within a Scope.
|
|
|
|
A really useful page to be aware of when looking at ACLs is
|
|
https://hashicorp.atlassian.net/wiki/spaces/ICU/pages/866976600/API+Actions+and+Permissions
|
|
speaking of which: TODO: put that chart in public docs.
|
|
|
|
Anyways, from that page you can see that there are really only a few patterns of
|
|
ACLs that are ever allowed:
|
|
|
|
* type=<resource.type>;actions=<action>
|
|
* id=<resource.id>;actions=<action>
|
|
* id=<pin>;type=<resource.type>;actions=<action>
|
|
|
|
and of course a matching scope.
|
|
|
|
This makes it actually quite simple to perform the ACL checking. Much of ACL
|
|
construction is thus synthesizing something reasonable from a set of Grants.
|
|
*/
|
|
package perms
|