Wardrik.Authorizer behaviour (wardrik v0.1.0-rc.1)

Copy Markdown

Decides whether a scope may take an action on a resource.

Wardrik.start_link(name: MyApp.AgentRuntime, authorizer: {MyApp.Authorizer, []})

Wardrik asks once per operation, and once per agent for operations over many agents. Wardrik.Statements is used unless set.

authorize/4 returns:

  • :ok - allowed.
  • {:error, :not_found} - the scope can't reach the resource. Callers learn nothing about what they can't see.
  • {:error, :forbidden} - the scope reaches the resource but not the action.

holds?/3 is optional. It stops a scope from making a token wider than itself. Without it, a scope holds a statement if authorize/4 allows each of its actions on each of its patterns.

Summary

Callbacks

authorize(config, t, action, resource)

Decides whether scope may take action, such as "agent.ask", on resource.

holds?(config, t, t)

Returns whether scope holds every action statement allows, on every resource it covers.

Functions

allows?(scope, resource)

Returns whether the operation running in scope may act on resource.

authorize(scope, action, resource)

Returns whether scope may take action on resource. See authorize/4.

holds?(scope, statement)

Returns whether scope holds everything statement allows. See holds?/3.

Callbacks

authorize(config, t, action, resource)

@callback authorize(
  config :: term(),
  Wardrik.Scope.t(),
  action :: String.t(),
  resource :: String.t()
) ::
  :ok | {:error, :forbidden | :not_found}

Decides whether scope may take action, such as "agent.ask", on resource.

holds?(config, t, t)

(optional) 
@callback holds?(config :: term(), Wardrik.Scope.t(), Wardrik.Statement.t()) :: boolean()

Returns whether scope holds every action statement allows, on every resource it covers.

Functions

allows?(scope, resource)

@spec allows?(Wardrik.Scope.t(), String.t()) :: boolean()

Returns whether the operation running in scope may act on resource.

authorize(scope, action, resource)

@spec authorize(Wardrik.Scope.t(), String.t(), String.t()) ::
  :ok | {:error, :forbidden | :not_found}

Returns whether scope may take action on resource. See authorize/4.

holds?(scope, statement)

@spec holds?(Wardrik.Scope.t(), Wardrik.Statement.t()) :: boolean()

Returns whether scope holds everything statement allows. See holds?/3.