View Source Rolex.DSL (Rolex v0.4.0)
Implements a small domain-specific language ("DSL") for scoping permissions.
The DSL is defined by a handful of keyword options:
:role
- a plain atom naming the role:to
- specifies the subject scope; i.e. "who holds the role?":on
- specifics the object scope; i.e. "on which resources does the role apply?
When revoking permissions,
from
is used in place ofto
, because it reads more naturally.
Subject and object scopes are specified using any of these values:
:all
- a special atom for granting or denying ALL of something- any Ecto schema module; e.g.
MyApp.Users.User
- any Ecto schema entity; e.g.
%MyApp.Users.User{id: 123}
Summary
Functions
Returns a changeset for DSL options used to perform action
.
Returns a changeset for options used when filtering permissions.
Returns a changeset for DSL options used when granting or denying permissions.
Returns a changeset for options used when revoking permissions.
Returns a new Rolex.DSL
initialized from input
on success, or {:error, reason}
otherwise.
Converts input
from external DSL options to internal Rolex.Permission
schema params.
Functions
Returns a changeset for DSL options used to perform action
.
Action may be any of :grant
, :deny
, :revoke
, :filter
.
Returns a changeset for options used when filtering permissions.
Options:
:role
- a plain atom naming a role, or::any
- will match any permission role
:to
-:all
, schema, entity, or::any
- will match any permission subject{:any, <schema>}
- will match any permission subject of the named type
:on
-:all
, schema, entity, or::any
- will match any permission object{:any, <schema>}
- will match any permission object of the named type
Returns a changeset for DSL options used when granting or denying permissions.
Options:
:role
- a plain atom naming a role:to
-:all
, schema, or entity:on
-:all
, schema, or entity
Returns a changeset for options used when revoking permissions.
Options:
:role
- a plain atom naming a role, or::any
- will match any permission role
:from
-:all
, schema, entity, or::any
- will match any permission subject{:any, <schema>}
- will match any permission subject of the named schema
:on
-:all
, schema, entity, or::any
- will match any permission object{:any, <schema>}
- will match any permission object of the named schema
Returns a new Rolex.DSL
initialized from input
on success, or {:error, reason}
otherwise.
Converts input
from external DSL options to internal Rolex.Permission
schema params.
Returns an atom-keyed map on success, or an {:error, reason}
tuple otherwise.