Mediate.Rbac.Policy.Clause (mediate_rbac v0.1.0)

Copy Markdown View Source

One clause of a protected schema's rule.

A grant names a relationship schema whose rows hold a role for the subject on the object:

  • on is the column of the protected schema the relationship's object column names
  • role is the relationship column that holds the role
  • as is a role every row holds, when the relationship has no role column
  • through is the chain of hops a grant crosses when the relationship names a row that is not the protected one

Each hop is a schema, the column of it the inner set matches, and an optional where: capture. The capture is a named function of no arguments that returns a dynamic over the hop's row. The next hop, or the protected row's on column, matches against the hop's primary key.

A predicate is a function of the subject and the environment. It returns a dynamic over the protected row, or a boolean. only names the operations it applies to, every operation when nil.

Summary

Types

hop()

One hop of a grant's chain: the schema, the column the inner set matches, and an optional where: capture.

kind()

Whether the clause reads a relationship row or runs a function.

predicate()

A function of the subject and the environment, returning a rule over the protected row or a yes or no.

t()

One clause. The fields a grant uses and the fields a predicate uses are disjoint.

Types

hop()

@type hop() :: {module(), atom(), [{:where, (-> Ecto.Query.dynamic_expr())}]}

One hop of a grant's chain: the schema, the column the inner set matches, and an optional where: capture.

kind()

@type kind() :: :grant | :predicate

Whether the clause reads a relationship row or runs a function.

predicate()

@type predicate() :: (Mediate.subject(), Mediate.environment() ->
                  Ecto.Query.dynamic_expr() | boolean())

A function of the subject and the environment, returning a rule over the protected row or a yes or no.

t()

@type t() :: %Mediate.Rbac.Policy.Clause{
  as: atom() | nil,
  kind: kind(),
  name: atom(),
  on: atom() | nil,
  only: [atom()] | nil,
  predicate: predicate() | nil,
  role: atom() | nil,
  source: module() | nil,
  through: [hop()]
}

One clause. The fields a grant uses and the fields a predicate uses are disjoint.