func UseSingleUserRole
UseSingleUserRole configures permissions to only allow one role per user.
This is a gno.land/p/gnoland/boards package extension that provides a custom
Permissions implementation that uses an underlying gno.land/p/nt/groups
group to manage users and roles.
It also supports optionally setting validation functions to be triggered by the
WithPermission() method before a callback is called. Validators allows adding
custom checks and requirements before the callback is called.
Usage Example:
1package permissions
2
3import (
4 "errors"
5
6 "gno.land/p/gnoland/boards"
7)
8
9// Example user account
10const user address = "g1jg8mtutu9khhfwc4nxmuhcpftf0pajdhfvsqf5"
11
12// Define a role
13const RoleExample boards.Role = "example"
14
15// Define a permission
16const PermissionFoo boards.Permission = 42
17
18func ExamplePermission() {
19 // Define a custom foo permission validation function
20 validateFoo := func(_ boards.Permissions, args boards.Args) error {
21 // Check that the first argument is the string "bob"
22 if name, ok := args[0].(string); !ok || name != "bob" {
23 return errors.New("unauthorized")
24 }
25 return nil
26 }
27
28 // Create a permissions instance and assign the custom validator to it
29 perms := New()
30 perms.ValidateFunc(PermissionFoo, validateFoo)
31
32 // Add foo permission to example role
33 perms.AddRole(RoleExample, PermissionFoo)
34
35 // Add a guest user
36 perms.SetUserRoles(user, RoleExample)
37
38 // Call a permissioned callback
39 args := boards.Args{"bob"}
40 perms.WithPermission(user, PermissionFoo, args, func() {
41 println("Hello Bob!")
42 })
43
44 // Output:
45 // Hello Bob!
46}
UseSingleUserRole configures permissions to only allow one role per user.
WithSuperRole configures permissions to have a super role. A super role is the one that have all permissions. This type of role doesn't need to be mapped to any permission.
New creates a new permissions type.
Option configures permissions.
Permissions manages users, roles and permissions.
This type is a default `gno.land/p/gnoland/boards` package `Permissions` implementation that handles boards users, roles and permissions using an underlying groups.Group: the base set holds every user (guests included), and each boards role is a group Role whose member set is kept a subset of the base set, with the role's boards.PermissionSet stored in the role meta (a value type, per the groups meta rule). It also supports optionally setting validation functions to be triggered within `WithPermission()` method before a permissioned callback is called.
No permissions validation is done by default.
Users are allowed to have multiple roles at the same time by default, but permissions can be configured to only allow one role per user.
1func (ps *Permissions) AddRole(r boards.Role, p boards.Permission, extra ...boards.Permission)AddRole adds a role with one or more assigned permissions. If role exists its permissions are overwritten with the new ones.
GetUserRoles returns the list of roles assigned to a user.
HasPermission checks if a user has a specific permission.
HasRole checks if a user has a specific role assigned.
HasUser checks if a user exists.
IterateUsers iterates permissions' users.
RemoveUser removes a user from permissions.
RoleExists checks if a role exists.
SetPublicPermissions assigns permissions that are available to anyone. It removes previous public permissions and assigns the new ones. By default there are no public permissions.
SetUserRoles adds a new user when it doesn't exist and sets its roles. Method can also be called to change the roles of an existing user. It removes any existing user roles before assigning new ones. All user's roles can be removed by calling this method without roles.
UsersCount returns the total number of users the permissioner contains.
ValidateFunc adds a custom permission validator function. If an existing permission function exists it's overwritten by the new one.
1func (ps *Permissions) WithPermission(user address, p boards.Permission, args boards.Args, cb func())WithPermission calls a callback when a user has a specific permission. It panics on error or when a permission validator fails. Callbacks are by default called when there is no validator function registered for the permission. If a permission validation function exists it's called before calling the callback.
ValidatorFunc defines a function type for permissions validators.
SECURITY: validators run inside WithPermission holding the live Permissions value, with full mutation access (SetUserRoles, RemoveUser, AddRole, ...) under the owning realm's authority. Register only functions the owning realm controls, and never expose ValidateFunc or the *Permissions value across a realm boundary.