Current behavior is that you need list grant on the parent scope when recursively listing, and this is sufficient. This is good for administrative workflows but can be unintuitive for resources that only exist at a project level. This change allows permissions on the child scope to also be taken into account, so that you can start a recursive list from a parent scope without direct list support on that scope but still get back child scopes for which list access is granted. This also fixes a bug where visibility of a scope for recursive listing would be based on whether the user had list resources for roles within that scope instead of for the resource type in question.
136 lines
3.5 KiB
Go
136 lines
3.5 KiB
Go
package iam
|
|
|
|
import "io"
|
|
|
|
// getOpts - iterate the inbound Options and return a struct
|
|
func getOpts(opt ...Option) options {
|
|
opts := getDefaultOptions()
|
|
for _, o := range opt {
|
|
o(&opts)
|
|
}
|
|
return opts
|
|
}
|
|
|
|
// Option - how Options are passed as arguments
|
|
type Option func(*options)
|
|
|
|
// options = how options are represented
|
|
type options struct {
|
|
withPublicId string
|
|
withName string
|
|
withDescription string
|
|
withLimit int
|
|
withAutoVivify bool
|
|
withGrantScopeId string
|
|
withSkipVetForWrite bool
|
|
withDisassociate bool
|
|
withSkipAdminRoleCreation bool
|
|
withSkipDefaultRoleCreation bool
|
|
withUserId string
|
|
withRandomReader io.Reader
|
|
}
|
|
|
|
func getDefaultOptions() options {
|
|
return options{
|
|
withPublicId: "",
|
|
withName: "",
|
|
withDescription: "",
|
|
withLimit: 0,
|
|
withAutoVivify: false,
|
|
withGrantScopeId: "",
|
|
withSkipVetForWrite: false,
|
|
}
|
|
}
|
|
|
|
// WithPublicId provides an optional public id
|
|
func WithPublicId(id string) Option {
|
|
return func(o *options) {
|
|
o.withPublicId = id
|
|
}
|
|
}
|
|
|
|
// WithDescription provides an optional description
|
|
func WithDescription(desc string) Option {
|
|
return func(o *options) {
|
|
o.withDescription = desc
|
|
}
|
|
}
|
|
|
|
// WithName provides an option to search by a friendly name
|
|
func WithName(name string) Option {
|
|
return func(o *options) {
|
|
o.withName = name
|
|
}
|
|
}
|
|
|
|
// WithLimit provides an option to provide a limit. Intentionally allowing
|
|
// negative integers. If WithLimit < 0, then unlimited results are returned.
|
|
// If WithLimit == 0, then default limits are used for results.
|
|
func WithLimit(limit int) Option {
|
|
return func(o *options) {
|
|
o.withLimit = limit
|
|
}
|
|
}
|
|
|
|
// WithAutoVivify provides an option to enable user auto vivification when
|
|
// calling repo.LookupUserWithLogin().
|
|
func WithAutoVivify(enable bool) Option {
|
|
return func(o *options) {
|
|
o.withAutoVivify = enable
|
|
}
|
|
}
|
|
|
|
// WithGrantScopeId provides an option to specify the scope ID for grants in
|
|
// roles.
|
|
func WithGrantScopeId(id string) Option {
|
|
return func(o *options) {
|
|
o.withGrantScopeId = id
|
|
}
|
|
}
|
|
|
|
// WithSkipVetForWrite provides an option to allow skipping vet checks to allow
|
|
// testing lower-level SQL triggers and constraints
|
|
func WithSkipVetForWrite(enable bool) Option {
|
|
return func(o *options) {
|
|
o.withSkipVetForWrite = enable
|
|
}
|
|
}
|
|
|
|
// WithDisassociate provides an option to allow the combining of disassociating
|
|
// and associating a user in one operation.
|
|
func WithDisassociate(enable bool) Option {
|
|
return func(o *options) {
|
|
o.withDisassociate = enable
|
|
}
|
|
}
|
|
|
|
// WithSkipAdminRoleCreation provides an option to disable the automatic
|
|
// creation of an admin role when a new scope is created.
|
|
func WithSkipAdminRoleCreation(enable bool) Option {
|
|
return func(o *options) {
|
|
o.withSkipAdminRoleCreation = enable
|
|
}
|
|
}
|
|
|
|
// WithSkipDefaultRoleCreation provides an option to disable the automatic
|
|
// creation of a default role when a new scope is created.
|
|
func WithSkipDefaultRoleCreation(enable bool) Option {
|
|
return func(o *options) {
|
|
o.withSkipDefaultRoleCreation = enable
|
|
}
|
|
}
|
|
|
|
// WithUserId provides an option to specify the user ID to use when creating roles with new scopes.
|
|
func WithUserId(id string) Option {
|
|
return func(o *options) {
|
|
o.withUserId = id
|
|
}
|
|
}
|
|
|
|
// WithRandomReader provides and option to specify a random reader.
|
|
func WithRandomReader(reader io.Reader) Option {
|
|
return func(o *options) {
|
|
o.withRandomReader = reader
|
|
}
|
|
}
|