48 lines
1.6 KiB
Go
48 lines
1.6 KiB
Go
package storage
|
|
|
|
import "time"
|
|
|
|
// RoleScope separates application-wide privileges from garden membership roles.
|
|
type RoleScope string
|
|
|
|
// Supported role scopes.
|
|
const (
|
|
RoleScopeApplication RoleScope = "application"
|
|
RoleScopeGarden RoleScope = "garden"
|
|
)
|
|
|
|
// Role is a reusable, globally defined bundle of permissions.
|
|
type Role struct {
|
|
Name string `json:"name"`
|
|
Scope RoleScope `json:"scope"`
|
|
GardenID *int `json:"garden_id,omitempty"`
|
|
Label string `json:"label"`
|
|
System bool `json:"system"`
|
|
Permissions []string `json:"permissions"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
UpdatedAt time.Time `json:"updated_at"`
|
|
}
|
|
|
|
// GardenRolePermissionOverride grants or revokes one role permission in a
|
|
// single garden without modifying the shared role template.
|
|
type GardenRolePermissionOverride struct {
|
|
GardenID int `json:"garden_id"`
|
|
RoleName string `json:"role_name"`
|
|
Permission string `json:"permission"`
|
|
Granted bool `json:"granted"`
|
|
}
|
|
|
|
// RoleModelInterface manages application roles, garden role templates, and
|
|
// garden-specific permission overrides.
|
|
type RoleModelInterface interface {
|
|
List(scope RoleScope) ([]Role, error)
|
|
ListForGarden(gardenID int) ([]Role, error)
|
|
Get(name string) (Role, error)
|
|
GetForGarden(gardenID int, name string) (Role, error)
|
|
Create(role Role) (Role, error)
|
|
Update(role Role) (Role, error)
|
|
Delete(name string) error
|
|
ListGardenOverrides(gardenID int) ([]GardenRolePermissionOverride, error)
|
|
ReplaceGardenOverrides(gardenID int, roleName string, overrides []GardenRolePermissionOverride) error
|
|
}
|