Modules
RBAC in code: the adapter whose rules are Elixir modules. A policy module,
use Mediate.Rbac.Policy, declares the role table as data. Per protected
schema it declares the grants that hold a role on its rows and the
predicates every allowed row must satisfy. The predicates are functions in
the same modules. The adapter takes no options (Mediate.Config), so
its configuration entry is the bare module. It finds the policy and the
repo through the binding Mediate.Rbac.Binding.bind/1 makes at boot
beside the configuration.
What Mediate.Rbac needs beyond the configuration: the policy module
and the mediated repo its rules read through. bind/1 validates the pair
and keeps it for the life of the VM, as Mediate.Config.boot!/1 keeps
the configuration. override/1 puts a binding in the current process for
the rest of its life. resolve/0 reads it from the caller and from its
$callers chain. So a test binds its own policy and repo and leaves the
boot binding alone.
Declared-fact coverage for a policy: every column its rules read is a
declared fact. check/1 builds the rule of every protected schema for
every operation the role table names, and applies it to the schema. Then
it walks the query the rule became, subqueries among them, and collects
every field reference by source schema. A column counts as declared in
one of these cases
The policy module: the role table as data and, per protected schema, the clauses of its rule.
One clause of a protected schema's rule.
A protected schema and the clauses of its rule.
One row of the role table: a role and the operations it permits.
The policy version of RBAC in code. Its identifier is the version: the
policy module gave, or the content hash. The content hash is a digest of
the policy module and every module a predicate or a hop filter lives in.
So a change to a rule is a new version whether or not anyone said so. The
content is the role table and the module list as text when under the
configured cap, and a pointer to the modules otherwise.
the events document under
"Policy version" has the event and the cap.