Who may do what in the admin, as pure decisions.
Under :wagoe/authorization :mode :off and :report today's rule
decides: the :admin role. Under :enforce the user's rights do
(ADR-041 §6): admin.<entity>/read to see an entity, admin.<entity>/write
to change it, each held in scopes the entity can check. A platform admin
holds everything, everywhere.
The shell puts the request's rights on the user map under ::access
(with-access); a user without it is decided by the role.
Who may do what in the admin, as pure decisions. Under `:wagoe/authorization :mode :off` and `:report` today's rule decides: the `:admin` role. Under `:enforce` the user's rights do (ADR-041 §6): `admin.<entity>/read` to see an entity, `admin.<entity>/write` to change it, each held in scopes the entity can check. A platform admin holds everything, everywhere. The shell puts the request's rights on the user map under `::access` (`with-access`); a user without it is decided by the role.
(can-access-admin? user)(can-access-admin? user entity-configs)Determine if user can access the admin interface at all.
Under :enforce, admin.<entity>/read on one of entity-configs in a
scope that entity can check; else the :admin role.
Args: user: User entity map entity-configs: {entity-name entity-config}, the admin's entities
Returns: Boolean true if user can access admin
Examples: (can-access-admin? {:role :admin} nil) ;=> true (can-access-admin? {:role :user} nil) ;=> false (can-access-admin? nil nil) ;=> false
Determine if user can access the admin interface at all.
Under :enforce, `admin.<entity>/read` on one of `entity-configs` in a
scope that entity can check; else the :admin role.
Args:
user: User entity map
entity-configs: {entity-name entity-config}, the admin's entities
Returns:
Boolean true if user can access admin
Examples:
(can-access-admin? {:role :admin} nil) ;=> true
(can-access-admin? {:role :user} nil) ;=> false
(can-access-admin? nil nil) ;=> false(can-bulk-delete-entity? user entity-name)(can-bulk-delete-entity? user entity-name entity-config)Determine if user can perform bulk delete operations.
Week 1: Any admin can bulk delete (same as single delete). Week 2+: Separate permission for bulk operations due to risk.
Args: user: User entity map entity-name: Keyword entity name entity-config: Optional entity configuration map
Returns: Boolean true if user can bulk delete
Examples: (can-bulk-delete-entity? {:role :admin} :users nil) ;=> true (can-bulk-delete-entity? {:role :user} :users nil) ;=> false
Determine if user can perform bulk delete operations.
Week 1: Any admin can bulk delete (same as single delete).
Week 2+: Separate permission for bulk operations due to risk.
Args:
user: User entity map
entity-name: Keyword entity name
entity-config: Optional entity configuration map
Returns:
Boolean true if user can bulk delete
Examples:
(can-bulk-delete-entity? {:role :admin} :users nil) ;=> true
(can-bulk-delete-entity? {:role :user} :users nil) ;=> false(can-create-entity? user entity-name)(can-create-entity? user entity-name entity-config)Determine if user can create new records for an entity.
admin.<entity>/write under :enforce, else the :admin role.
Args: user: User entity map entity-name: Keyword entity name entity-config: Optional entity configuration map
Returns: Boolean true if user can create records
Examples: (can-create-entity? {:role :admin} :users nil) ;=> true (can-create-entity? {:role :user} :users nil) ;=> false
Determine if user can create new records for an entity.
`admin.<entity>/write` under :enforce, else the :admin role.
Args:
user: User entity map
entity-name: Keyword entity name
entity-config: Optional entity configuration map
Returns:
Boolean true if user can create records
Examples:
(can-create-entity? {:role :admin} :users nil) ;=> true
(can-create-entity? {:role :user} :users nil) ;=> false(can-delete-entity? user entity-name)(can-delete-entity? user entity-name entity-config)(can-delete-entity? user entity-name entity-config _record)Determine if user can delete records from an entity.
admin.<entity>/write under :enforce, else the :admin role.
Args: user: User entity map entity-name: Keyword entity name entity-config: Optional entity configuration map record: Optional specific record being deleted
Returns: Boolean true if user can delete records
Examples: (can-delete-entity? {:role :admin} :users nil nil) ;=> true (can-delete-entity? {:role :user} :users nil nil) ;=> false
Determine if user can delete records from an entity.
`admin.<entity>/write` under :enforce, else the :admin role.
Args:
user: User entity map
entity-name: Keyword entity name
entity-config: Optional entity configuration map
record: Optional specific record being deleted
Returns:
Boolean true if user can delete records
Examples:
(can-delete-entity? {:role :admin} :users nil nil) ;=> true
(can-delete-entity? {:role :user} :users nil nil) ;=> false(can-edit-entity? user entity-name)(can-edit-entity? user entity-name entity-config)(can-edit-entity? user entity-name entity-config _record)Determine if user can edit existing records for an entity.
admin.<entity>/write under :enforce, else the :admin role.
Args: user: User entity map entity-name: Keyword entity name entity-config: Optional entity configuration map record: Optional specific record being edited
Returns: Boolean true if user can edit records
Examples: (can-edit-entity? {:role :admin} :users nil nil) ;=> true (can-edit-entity? {:role :user} :users nil nil) ;=> false
Determine if user can edit existing records for an entity.
`admin.<entity>/write` under :enforce, else the :admin role.
Args:
user: User entity map
entity-name: Keyword entity name
entity-config: Optional entity configuration map
record: Optional specific record being edited
Returns:
Boolean true if user can edit records
Examples:
(can-edit-entity? {:role :admin} :users nil nil) ;=> true
(can-edit-entity? {:role :user} :users nil nil) ;=> false(can-view-entity? user entity-name)(can-view-entity? user entity-name entity-config)Determine if user can view/list records from an entity.
admin.<entity>/read under :enforce, else the :admin role.
Args: user: User entity map entity-name: Keyword entity name (e.g., :users, :orders) entity-config: Optional entity configuration map
Returns: Boolean true if user can view entity
Examples: (can-view-entity? {:role :admin} :users nil) ;=> true (can-view-entity? {:role :user} :users nil) ;=> false
Determine if user can view/list records from an entity.
`admin.<entity>/read` under :enforce, else the :admin role.
Args:
user: User entity map
entity-name: Keyword entity name (e.g., :users, :orders)
entity-config: Optional entity configuration map
Returns:
Boolean true if user can view entity
Examples:
(can-view-entity? {:role :admin} :users nil) ;=> true
(can-view-entity? {:role :user} :users nil) ;=> false(entity-permission entity-name action)admin.<entity>/read or admin.<entity>/write, the one action needs.
`admin.<entity>/read` or `admin.<entity>/write`, the one `action` needs.
(explain-admin-access-denial user)(explain-admin-access-denial user entity-configs)Provide human-readable explanation for why admin access was denied.
Args:
user: User entity map
entity-configs: as can-access-admin?
Returns: Map with denial reason and suggested action: {:denied true :reason "User does not have admin role" :user-role :user :required-role :admin}
Examples: (explain-admin-access-denial {:role :user}) (explain-admin-access-denial nil)
Provide human-readable explanation for why admin access was denied.
Args:
user: User entity map
entity-configs: as `can-access-admin?`
Returns:
Map with denial reason and suggested action:
{:denied true
:reason "User does not have admin role"
:user-role :user
:required-role :admin}
Examples:
(explain-admin-access-denial {:role :user})
(explain-admin-access-denial nil)(filter-visible-entities user entity-names)(filter-visible-entities user entity-names entity-configs)Filter list of entities to only those user can view.
Those can-view-entity? admits, given each one's config.
Args: user: User entity map entity-names: Set or vector of entity name keywords entity-configs: Optional map of entity-name -> entity-config
Returns: Vector of entity names user can access
Examples: (filter-visible-entities {:role :admin} #{:users :orders} nil) ;=> [:users :orders]
(filter-visible-entities {:role :user} #{:users :orders} nil) ;=> []
Filter list of entities to only those user can view.
Those `can-view-entity?` admits, given each one's config.
Args:
user: User entity map
entity-names: Set or vector of entity name keywords
entity-configs: Optional map of entity-name -> entity-config
Returns:
Vector of entity names user can access
Examples:
(filter-visible-entities {:role :admin} #{:users :orders} nil)
;=> [:users :orders]
(filter-visible-entities {:role :user} #{:users :orders} nil)
;=> [](get-accessible-entities-count user entity-names)(get-accessible-entities-count user entity-names entity-configs)Count how many entities user can access.
Args: user: User entity map entity-names: Set or vector of entity names entity-configs: Optional map of entity configs
Returns: Integer count of accessible entities
Examples: (get-accessible-entities-count {:role :admin} #{:users :orders} nil) ;=> 2
(get-accessible-entities-count {:role :user} #{:users :orders} nil) ;=> 0
Count how many entities user can access.
Args:
user: User entity map
entity-names: Set or vector of entity names
entity-configs: Optional map of entity configs
Returns:
Integer count of accessible entities
Examples:
(get-accessible-entities-count {:role :admin} #{:users :orders} nil)
;=> 2
(get-accessible-entities-count {:role :user} #{:users :orders} nil)
;=> 0(get-admin-permissions user)(get-admin-permissions user entity-configs)Get global admin permissions for a user.
Returns what the user can do across the admin interface as a whole.
Args:
user: User entity map
entity-configs: as can-access-admin?
Returns: Map with global permission flags: {:can-access-admin true :can-view-audit-log false ; Week 2+ :can-manage-users false} ; Week 2+
Examples: (get-admin-permissions {:role :admin} nil) ;=> {:can-access-admin true}
Get global admin permissions for a user.
Returns what the user can do across the admin interface as a whole.
Args:
user: User entity map
entity-configs: as `can-access-admin?`
Returns:
Map with global permission flags:
{:can-access-admin true
:can-view-audit-log false ; Week 2+
:can-manage-users false} ; Week 2+
Examples:
(get-admin-permissions {:role :admin} nil)
;=> {:can-access-admin true}(get-entity-permissions user entity-name)(get-entity-permissions user entity-name entity-config)Get all permission flags for an entity for a specific user.
Returns a comprehensive map of what the user can do with the entity, useful for conditionally rendering UI elements (buttons, links, etc.).
Args: user: User entity map entity-name: Keyword entity name entity-config: Optional entity configuration map
Returns: Map with permission flags: {:can-view true :can-create true :can-edit true :can-delete true :can-bulk-delete true :can-export false ; Week 2+ :can-import false} ; Week 2+
Examples: (get-entity-permissions {:role :admin} :users nil) ;=> {:can-view true :can-create true :can-edit true ; :can-delete true :can-bulk-delete true}
Get all permission flags for an entity for a specific user.
Returns a comprehensive map of what the user can do with the entity,
useful for conditionally rendering UI elements (buttons, links, etc.).
Args:
user: User entity map
entity-name: Keyword entity name
entity-config: Optional entity configuration map
Returns:
Map with permission flags:
{:can-view true
:can-create true
:can-edit true
:can-delete true
:can-bulk-delete true
:can-export false ; Week 2+
:can-import false} ; Week 2+
Examples:
(get-entity-permissions {:role :admin} :users nil)
;=> {:can-view true :can-create true :can-edit true
; :can-delete true :can-bulk-delete true}(has-access? user)Whether user already carries their access.
Whether `user` already carries their access.
(has-role? user required-role)Check if user has a specific role.
Args: user: User entity map with :role keyword required-role: Role keyword to check for
Returns: Boolean true if user has the required role
Examples: (has-role? {:role :admin} :admin) ;=> true (has-role? {:role :user} :admin) ;=> false (has-role? nil :admin) ;=> false
Check if user has a specific role.
Args:
user: User entity map with :role keyword
required-role: Role keyword to check for
Returns:
Boolean true if user has the required role
Examples:
(has-role? {:role :admin} :admin) ;=> true
(has-role? {:role :user} :admin) ;=> false
(has-role? nil :admin) ;=> false(is-admin? user)Check if user has admin role.
Args: user: User entity map
Returns: Boolean true if user is an admin
Examples: (is-admin? {:role :admin}) ;=> true (is-admin? {:role :user}) ;=> false (is-admin? nil) ;=> false
Check if user has admin role.
Args:
user: User entity map
Returns:
Boolean true if user is an admin
Examples:
(is-admin? {:role :admin}) ;=> true
(is-admin? {:role :user}) ;=> false
(is-admin? nil) ;=> false(is-authenticated? user)Check if user is authenticated (has any role).
Args: user: User entity map (can be nil)
Returns: Boolean true if user exists and has a role
Examples: (is-authenticated? {:role :admin}) ;=> true (is-authenticated? {:role :user}) ;=> true (is-authenticated? nil) ;=> false (is-authenticated? {}) ;=> false
Check if user is authenticated (has any role).
Args:
user: User entity map (can be nil)
Returns:
Boolean true if user exists and has a role
Examples:
(is-authenticated? {:role :admin}) ;=> true
(is-authenticated? {:role :user}) ;=> true
(is-authenticated? nil) ;=> false
(is-authenticated? {}) ;=> false(mode user)The authorization mode user is decided under, :off without access.
The authorization mode `user` is decided under, `:off` without access.
(record-in-scope? scopes entity-config record)Whether record (or the record a write would leave behind) lies inside
one of scopes. Only fields can be checked on a record: a scope on a key
the entity maps to a relation condition admits none, unless one of
scopes holds everywhere.
Whether `record` (or the record a write would leave behind) lies inside one of `scopes`. Only fields can be checked on a record: a scope on a key the entity maps to a relation condition admits none, unless one of `scopes` holds everywhere.
(report-access-refusal user entity-configs)Under :report, whether :enforce would keep user out of the admin
where the role lets them in. entity-configs as can-access-admin?.
Under `:report`, whether `:enforce` would keep `user` out of the admin where the role lets them in. `entity-configs` as `can-access-admin?`.
(report-refusal user entity-name action entity-config)Under :report, the permission :enforce would refuse user where the
role admits them; else nil.
Under `:report`, the permission `:enforce` would refuse `user` where the role admits them; else nil.
(scope-fields entity-config){scope-key field} for the keys entity-config maps to a field of its own,
not a relation condition.
{scope-key field} for the keys `entity-config` maps to a field of its own,
not a relation condition.(scopes user entity-name action entity-config)The scopes in which user's rights let them take action (:read or :write)
on entity-name, [{}] for everywhere. Only scopes entity-config can
check count: each key mapped under its :scope to a field or a relation
condition. So an entity mapping none admits only unscoped holders.
The scopes in which `user`'s rights let them take `action` (:read or :write)
on `entity-name`, `[{}]` for everywhere. Only scopes `entity-config` can
check count: each key mapped under its `:scope` to a field or a relation
condition. So an entity mapping none admits only unscoped holders.(with-access user access)user carrying access: {:mode :off|:report|:enforce, :platform-admin? bool,
:rights resolved rights [{:permission kw :scope {key #{value}}}]}.
`user` carrying `access`: {:mode :off|:report|:enforce, :platform-admin? bool,
:rights resolved rights [{:permission kw :scope {key #{value}}}]}.cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |