77 lines
2.8 KiB
Go
77 lines
2.8 KiB
Go
// Copyright (c) 2025-2026 Probo Inc <hello@probo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package iam
|
|
|
|
import "go.probo.inc/probo/pkg/iam/policy"
|
|
|
|
// PolicySet holds organization-scoped (role) policies and identity-scoped policies.
|
|
// Services create their own PolicySet and combine them when creating the Authorizer.
|
|
type PolicySet struct {
|
|
// RolePolicies maps role names to policies.
|
|
RolePolicies map[string][]*policy.Policy
|
|
|
|
// IdentityScopedPolicies are applied to all authenticated users, independent of organization membership.
|
|
IdentityScopedPolicies []*policy.Policy
|
|
}
|
|
|
|
// NewPolicySet creates an empty PolicySet.
|
|
func NewPolicySet() *PolicySet {
|
|
return &PolicySet{
|
|
RolePolicies: make(map[string][]*policy.Policy),
|
|
IdentityScopedPolicies: make([]*policy.Policy, 0),
|
|
}
|
|
}
|
|
|
|
// AddRolePolicy adds a policy for a specific role.
|
|
func (ps *PolicySet) AddRolePolicy(role string, policies ...*policy.Policy) *PolicySet {
|
|
ps.RolePolicies[role] = append(ps.RolePolicies[role], policies...)
|
|
return ps
|
|
}
|
|
|
|
// AddIdentityScopedPolicy adds policies applied to all authenticated users (identity-scoped).
|
|
func (ps *PolicySet) AddIdentityScopedPolicy(policies ...*policy.Policy) *PolicySet {
|
|
ps.IdentityScopedPolicies = append(ps.IdentityScopedPolicies, policies...)
|
|
return ps
|
|
}
|
|
|
|
// Merge combines another PolicySet into this one.
|
|
func (ps *PolicySet) Merge(other *PolicySet) *PolicySet {
|
|
for role, policies := range other.RolePolicies {
|
|
ps.RolePolicies[role] = append(ps.RolePolicies[role], policies...)
|
|
}
|
|
|
|
ps.IdentityScopedPolicies = append(ps.IdentityScopedPolicies, other.IdentityScopedPolicies...)
|
|
|
|
return ps
|
|
}
|
|
|
|
func IAMPolicySet() *PolicySet {
|
|
return NewPolicySet().
|
|
AddRolePolicy("OWNER", IAMOwnerPolicy).
|
|
AddRolePolicy("ADMIN", IAMAdminPolicy).
|
|
AddRolePolicy("VIEWER", IAMViewerPolicy).
|
|
AddRolePolicy("EMPLOYEE", IAMViewerPolicy).
|
|
AddRolePolicy("AUDITOR", IAMViewerPolicy).
|
|
AddIdentityScopedPolicy(
|
|
IAMSelfManageIdentityPolicy,
|
|
IAMSelfManageSessionPolicy,
|
|
IAMSelfManageInvitationPolicy,
|
|
IAMSelfManageProfilePolicy,
|
|
IAMSelfManageMembershipPolicy,
|
|
IAMSelfManagePersonalAPIKeyPolicy,
|
|
IAMSelfManageOAuth2ConsentPolicy,
|
|
)
|
|
}
|