nova_auth_policy (nova_auth v0.2.0)

Policy helpers for nova_resource authorization. Returns policy maps with condition functions that can be evaluated against an actor and context.

Summary

policy()

Allow any authenticated (non-undefined) actor.

allow_claim/2

Allow actors who have a specific claim value. Works with both single-valued and list-valued claims (e.g., Authentik groups mapped to roles).

Allow actors who own the record (actor id matches the owner field).

allow_role/1

Allow actors whose role field matches one of the given roles.

deny_all()

Deny all actors unconditionally.

-type policy() :: #{action := atom(), condition := fun()}.

-spec allow_authenticated() -> policy().

Allow any authenticated (non-undefined) actor.

-spec allow_claim(atom(), term() | [term()]) -> policy().

Allow actors who have a specific claim value. Works with both single-valued and list-valued claims (e.g., Authentik groups mapped to roles).

allow_claim(roles, admin)
allow_claim(roles, [admin, editor])

-spec allow_owner(atom()) -> policy().

Allow actors who own the record (actor id matches the owner field).

-spec allow_role(atom() | [atom()]) -> policy().

Allow actors whose role field matches one of the given roles.

-spec deny_all() -> policy().

Deny all actors unconditionally.