mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 21:52:54 +00:00
Tim MöhlmannandGitHub
fcb05fd561
# Which Problems Are Solved There is no implementation of the permission framework in the new command pattern. We risk forgetting permission options as we are already migrating the service layer to the new pattern. # How the Problems Are Solved Use an permission checker interface, which will be a sub-interface of the Permission Repository. The permission checker is passed in the command executor and invoker as part of the command options. From here the implementation can call the correct permission method. This PR proposes a check method for each [level](https://github.com/zitadel/zitadel/wiki/Internal-AuthZ#levels). # Additional Changes - none # Additional Context - Draft design: https://github.com/zitadel/zitadel/wiki/Internal-AuthZ#enforcement - Related for queries: https://github.com/zitadel/zitadel/pull/10756
49 lines
1.7 KiB
Go
49 lines
1.7 KiB
Go
package domain
|
|
|
|
import "context"
|
|
|
|
// PermissionRepository is the interface that manages and checks Zitadel permissions.
|
|
//
|
|
// TODO(muhlemmer): This just defines the checker methods, rest to be done later.
|
|
type PermissionRepository interface {
|
|
PermissionChecker
|
|
}
|
|
|
|
// PermissionChecker defines the methods needed to check permissions.
|
|
type PermissionChecker interface {
|
|
// Check if the authenticated user has the given permission on instance level.
|
|
CheckInstancePermission(ctx context.Context, permission string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given organization.
|
|
// A permission may be inherited from the instance level.
|
|
CheckOrganizationPermission(ctx context.Context, permission, orgID string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given project.
|
|
// A permission may be inherited from the instance or organization level.
|
|
CheckProjectPermission(ctx context.Context, permission, projectID string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given project grant.
|
|
// A permission may be inherited from the instance or granted organization level.
|
|
CheckProjectGrantPermission(ctx context.Context, permission, projectGrantID string) error
|
|
}
|
|
|
|
type noopPermissionChecker struct{}
|
|
|
|
var _ PermissionChecker = (*noopPermissionChecker)(nil)
|
|
|
|
func (*noopPermissionChecker) CheckInstancePermission(context.Context, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckOrganizationPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckProjectPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckProjectGrantPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|