Files
threshold/internal/iam/options.go
T
Jeff Mitchell aa570f4e48 Honor child scope list permissions when recursing (#1016)
Current behavior is that you need list grant on the parent scope when
recursively listing, and this is sufficient. This is good for
administrative workflows but can be unintuitive for resources that only
exist at a project level. This change allows permissions on the child
scope to also be taken into account, so that you can start a recursive
list from a parent scope without direct list support on that scope but
still get back child scopes for which list access is granted.

This also fixes a bug where visibility of a scope for recursive listing
would be based on whether the user had list resources for roles within
that scope instead of for the resource type in question.
2021-03-24 15:33:04 -04:00

136 lines
3.5 KiB
Go

package iam
import "io"
// getOpts - iterate the inbound Options and return a struct
func getOpts(opt ...Option) options {
opts := getDefaultOptions()
for _, o := range opt {
o(&opts)
}
return opts
}
// Option - how Options are passed as arguments
type Option func(*options)
// options = how options are represented
type options struct {
withPublicId string
withName string
withDescription string
withLimit int
withAutoVivify bool
withGrantScopeId string
withSkipVetForWrite bool
withDisassociate bool
withSkipAdminRoleCreation bool
withSkipDefaultRoleCreation bool
withUserId string
withRandomReader io.Reader
}
func getDefaultOptions() options {
return options{
withPublicId: "",
withName: "",
withDescription: "",
withLimit: 0,
withAutoVivify: false,
withGrantScopeId: "",
withSkipVetForWrite: false,
}
}
// WithPublicId provides an optional public id
func WithPublicId(id string) Option {
return func(o *options) {
o.withPublicId = id
}
}
// WithDescription provides an optional description
func WithDescription(desc string) Option {
return func(o *options) {
o.withDescription = desc
}
}
// WithName provides an option to search by a friendly name
func WithName(name string) Option {
return func(o *options) {
o.withName = name
}
}
// WithLimit provides an option to provide a limit. Intentionally allowing
// negative integers. If WithLimit < 0, then unlimited results are returned.
// If WithLimit == 0, then default limits are used for results.
func WithLimit(limit int) Option {
return func(o *options) {
o.withLimit = limit
}
}
// WithAutoVivify provides an option to enable user auto vivification when
// calling repo.LookupUserWithLogin().
func WithAutoVivify(enable bool) Option {
return func(o *options) {
o.withAutoVivify = enable
}
}
// WithGrantScopeId provides an option to specify the scope ID for grants in
// roles.
func WithGrantScopeId(id string) Option {
return func(o *options) {
o.withGrantScopeId = id
}
}
// WithSkipVetForWrite provides an option to allow skipping vet checks to allow
// testing lower-level SQL triggers and constraints
func WithSkipVetForWrite(enable bool) Option {
return func(o *options) {
o.withSkipVetForWrite = enable
}
}
// WithDisassociate provides an option to allow the combining of disassociating
// and associating a user in one operation.
func WithDisassociate(enable bool) Option {
return func(o *options) {
o.withDisassociate = enable
}
}
// WithSkipAdminRoleCreation provides an option to disable the automatic
// creation of an admin role when a new scope is created.
func WithSkipAdminRoleCreation(enable bool) Option {
return func(o *options) {
o.withSkipAdminRoleCreation = enable
}
}
// WithSkipDefaultRoleCreation provides an option to disable the automatic
// creation of a default role when a new scope is created.
func WithSkipDefaultRoleCreation(enable bool) Option {
return func(o *options) {
o.withSkipDefaultRoleCreation = enable
}
}
// WithUserId provides an option to specify the user ID to use when creating roles with new scopes.
func WithUserId(id string) Option {
return func(o *options) {
o.withUserId = id
}
}
// WithRandomReader provides and option to specify a random reader.
func WithRandomReader(reader io.Reader) Option {
return func(o *options) {
o.withRandomReader = reader
}
}