Arc.Authorization (cratis_arc v0.1.0)

Copy Markdown View Source

Authorization declarations and checks for commands and queries.

Declare requirements on the artifact:

authorize roles: ["admin"]      # at least one role
authorize :authenticated        # any signed-in caller
authorize policy: :can_publish  # a named `Arc.Policy`
allow_anonymous()

With no declaration an artifact is open. A query declaration (@query authorize: [...]) replaces the module-level declaration for that query.

Summary

Types

requirement()

Functions

check(req, ctx, subject)

Checks a requirement against the caller. Returns :ok, {:error, :unauthenticated} or {:error, {:forbidden, reason}}.

open()

An empty requirement.

Types

requirement()

@type requirement() :: %{
  roles: [String.t()],
  policy: atom() | nil,
  allow_anonymous: boolean(),
  authenticated?: boolean()
}

Functions

check(req, ctx, subject)

@spec check(requirement(), Arc.Context.t(), term()) ::
  :ok | {:error, :unauthenticated | {:forbidden, String.t()}}

Checks a requirement against the caller. Returns :ok, {:error, :unauthenticated} or {:error, {:forbidden, reason}}.

open()

@spec open() :: requirement()

An empty requirement.