Who may act on a request, and the 403 a refused caller gets, without the
HTTP stack (BOU-930). wagoe.platform.core.http.access delegates to these.
Who may act on a request, and the 403 a refused caller gets, without the HTTP stack (BOU-930). `wagoe.platform.core.http.access` delegates to these.
(admin-reach request)tenant-reach for an admin by role, who is one only where they are a tenant
admin: a member of the resolved tenant who administers another gets none.
`tenant-reach` for an admin by role, who is one only where they are a tenant admin: a member of the resolved tenant who administers another gets none.
(admin? request)Whether the signed-in user has the global admin role.
Whether the signed-in user has the global admin role.
(correlation-id request fresh)The caller's X-Correlation-ID, or fresh when it sent none.
The caller's X-Correlation-ID, or `fresh` when it sent none.
(forbidden-response message _request correlation-id)403 for a signed-in caller who may not do this, as refusal-response
answers.
403 for a signed-in caller who may not do this, as `refusal-response` answers.
(in-tenant-scope? request)Whether the caller may use the schema the request runs in. With a tenant resolved: a member of it, a user of it, or a platform admin. Without one, the public schema: only a user of no tenant.
Whether the caller may use the schema the request runs in. With a tenant resolved: a member of it, a user of it, or a platform admin. Without one, the public schema: only a user of no tenant.
(platform-admin? user)Whether user is an admin outside any tenant, whom platform-wide pages such
as the audit trail admit. The role may be a string in an older session.
Whether `user` is an admin outside any tenant, whom platform-wide pages such as the audit trail admit. The role may be a string in an older session.
(refusal-response status error message correlation-id)status for a signed-in caller who may not do this: the error body, which
the router shows a browser on /web as the app's error page. Not the login
redirect, which would send them back here.
`status` for a signed-in caller who may not do this: the error body, which the router shows a browser on /web as the app's error page. Not the login redirect, which would send them back here.
(require-platform-admin handler fresh-id)Ring middleware: a platform admin, or 403. fresh-id makes the
correlation id for a caller who sent none; the shell supplies it, so core
reads no randomness.
Ring middleware: a platform admin, or 403. `fresh-id` makes the correlation id for a caller who sent none; the shell supplies it, so core reads no randomness.
(same-id? a b)Whether a names the same id as b, a UUID or its string; never for nil a.
Whether `a` names the same id as `b`, a UUID or its string; never for nil `a`.
(tenant-admin? request)Whether the caller is an admin where the request runs. In a tenant: a
platform admin, an admin by membership of it, or an admin user of it; an
admin of another tenant is not one here. Without a tenant, admin?.
Whether the caller is an admin where the request runs. In a tenant: a platform admin, an admin by membership of it, or an admin user of it; an admin of another tenant is not one here. Without a tenant, `admin?`.
(tenant-reach request)Whose data request may reach: {} for every tenant's (a platform admin with
no tenant resolved), {:tenant-id t} for one tenant's, t nil for no tenant's,
or nil for none (a caller outside the resolved tenant).
Whose data `request` may reach: `{}` for every tenant's (a platform admin with
no tenant resolved), `{:tenant-id t}` for one tenant's, t nil for no tenant's,
or nil for none (a caller outside the resolved tenant).cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |