a344b3225b
Attribute Based Access Control - Base * MM-63662 * MM-63919 * MM-63954 * MM-63955 * MM-63425 * MM-63426 * MM-63458 * MM-63459 * MM-63603 * MM-63845 * MM-64146 * MM-64199 * MM-64201 * MM-64233 * MM-64247 * MM-64268 --------- Co-authored-by: Harshil Sharma <harshilsharma63@gmail.com> Co-authored-by: Pablo Andrés Vélez Vidal <pablovv2012@gmail.com> Co-authored-by: abhijit-singh <abhijitsingh0702@gmail.com> Co-authored-by: Harrison Healey <harrisonmhealey@gmail.com>
71 строка
2.6 KiB
Go
71 строка
2.6 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package model
|
|
|
|
// Subject represents the user or a virtual entity for which the Authorization
|
|
// API is called.
|
|
type Subject struct {
|
|
// ID is the unique identifier of the Subject.
|
|
// it can be a user ID, bot ID, etc and it is scoped to the Type.
|
|
ID string `json:"id"`
|
|
// Type specifies the type of the Subject, eg. user, bot, etc.
|
|
Type string `json:"type"`
|
|
// Attributes are the key-value pairs assicuated with the subject.
|
|
// An attribute may be single-valued or multi-valued and can be a primitive type
|
|
// (string, boolean, number) or a complex type like a JSON object or array.
|
|
Attributes map[string]any `json:"attributes"`
|
|
}
|
|
|
|
type SubjectSearchOptions struct {
|
|
Term string `json:"term"`
|
|
TeamID string `json:"team_id"`
|
|
// Query and Args should be generated within the Access Control Service
|
|
// and passed here wrt database driver
|
|
Query string `json:"query"`
|
|
Args []any `json:"args"`
|
|
Limit int `json:"limit"`
|
|
Cursor SubjectCursor `json:"cursor"`
|
|
AllowInactive bool `json:"allow_inactive"`
|
|
IgnoreCount bool `json:"ignore_count"`
|
|
// ExcludeChannelMembers is used to exclude members from the search results
|
|
// specifically used when syncing channel members
|
|
ExcludeChannelMembers string `json:"exclude_members"`
|
|
}
|
|
|
|
type SubjectCursor struct {
|
|
TargetID string `json:"target_id"`
|
|
}
|
|
|
|
// Resource is the target of an access request.
|
|
type Resource struct {
|
|
// ID is the unique identifier of the Resource.
|
|
// It can be a channel ID, post ID, etc and it is scoped to the Type.
|
|
ID string `json:"id"`
|
|
// Type specifies the type of the Resource, eg. channel, post, etc.
|
|
Type string `json:"type"`
|
|
}
|
|
|
|
// AccessRequest represents the input to the Policy Decision Point (PDP).
|
|
// It contains the Subject, Resource, Action and optional Context attributes.
|
|
type AccessRequest struct {
|
|
Subject Subject `json:"subject"`
|
|
Resource Resource `json:"resource"`
|
|
Action string `json:"action"`
|
|
Context map[string]any `json:"context,omitempty"`
|
|
}
|
|
|
|
// The PDP evaluates the request and returns an AccessDecision.
|
|
// The Decision field is a boolean indicating whether the request is allowed or not.
|
|
type AccessDecision struct {
|
|
Decision bool `json:"decision"`
|
|
Context map[string]any `json:"context,omitempty"`
|
|
}
|
|
|
|
type QueryExpressionParams struct {
|
|
Expression string `json:"expression"`
|
|
Term string `json:"term"`
|
|
Limit int `json:"limit"`
|
|
After string `json:"after"`
|
|
}
|