mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-29 10:32:15 +00:00
b339a3e696
# Which Problems Are Solved This PR implements the endpoints listed in https://github.com/zitadel/zitadel/issues/10444 . # How the Problems Are Solved The implementation follows the same pattern as the Instance one. The `Add` and `Remove` are implementing the `Commander` interface, while `List` Domains endpoints are implementing the `Querier` interace. The PR adds also some forgotten calls to the relational logic for the Instance API. The commits are identifiable by the label `instance:` prepended to them. This is the complete list: bafce01b0 , 6fe7257ab , e27bc9c34 , 8133ede73 , fde667953 , a3e1135ed , ee1a6f9c1 # Additional Context - Closes #10444 --------- Co-authored-by: Elio Bischof <[email protected]> Co-authored-by: Lebogang Phoshoko <[email protected]> Co-authored-by: Wim Van Laer <[email protected]> Co-authored-by: Max Peintner <[email protected]> Co-authored-by: Gayathri Vijayan <[email protected]>
60 lines
2.1 KiB
Go
60 lines
2.1 KiB
Go
package domain
|
|
|
|
import "context"
|
|
|
|
const (
|
|
InstanceReadPermission = "instance.read"
|
|
InstanceWritePermission = "instance.write"
|
|
DomainReadPermission = "domain.read"
|
|
DomainWritePermission = "domain.write"
|
|
OrganizationReadPermission = "organization.read"
|
|
OrganizationWritePermission = "organization.write"
|
|
)
|
|
|
|
// PermissionRepository is the interface that manages and checks Zitadel permissions.
|
|
//
|
|
// TODO(muhlemmer): This just defines the checker methods, rest to be done later.
|
|
type PermissionRepository interface {
|
|
PermissionChecker
|
|
}
|
|
|
|
// PermissionChecker defines the methods needed to check permissions.
|
|
//
|
|
//go:generate mockgen -typed -package domainmock -destination ./mock/permission.mock.go . PermissionChecker
|
|
type PermissionChecker interface {
|
|
// Check if the authenticated user has the given permission on instance level.
|
|
CheckInstancePermission(ctx context.Context, permission string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given organization.
|
|
// A permission may be inherited from the instance level.
|
|
CheckOrganizationPermission(ctx context.Context, permission, orgID string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given project.
|
|
// A permission may be inherited from the instance or organization level.
|
|
CheckProjectPermission(ctx context.Context, permission, projectID string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given project grant.
|
|
// A permission may be inherited from the instance or granted organization level.
|
|
CheckProjectGrantPermission(ctx context.Context, permission, projectGrantID string) error
|
|
}
|
|
|
|
type noopPermissionChecker struct{}
|
|
|
|
var _ PermissionChecker = (*noopPermissionChecker)(nil)
|
|
|
|
func (*noopPermissionChecker) CheckInstancePermission(context.Context, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckOrganizationPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckProjectPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckProjectGrantPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|