What moving an app from :wagoe/authorization :off to :enforce changes
for its users, as data and as text for wagoe upgrade authorization.
Under :off every signed-in user passes every route, and the admin admits
role :admin. A finding is a user, endpoint and permission where
:enforce decides differently. A user here is {:id :email :role :tenant-id
:platform-admin? :rights}, :rights resolved as the interceptor reads them.
What moving an app from `:wagoe/authorization :off` to `:enforce` changes
for its users, as data and as text for `wagoe upgrade authorization`.
Under `:off` every signed-in user passes every route, and the admin admits
role `:admin`. A finding is a user, endpoint and permission where
`:enforce` decides differently. A user here is {:id :email :role :tenant-id
:platform-admin? :rights}, `:rights` resolved as the interceptor reads them.(admin-findings admin-permissions users)Each user and admin.<entity>/read|write permission where :enforce differs
from role :admin: lost or narrowed by an admin outside the platform,
:gained by a user who was no admin.
Each user and `admin.<entity>/read|write` permission where :enforce differs from role `:admin`: lost or narrowed by an admin outside the platform, `:gained` by a user who was no admin.
(blocking? findings)Whether findings hold a refusal or narrowing, which enforce refuses to
switch over. A gain is reported, not blocking.
Whether `findings` hold a refusal or narrowing, which `enforce` refuses to switch over. A gain is reported, not blocking.
(format-findings findings)findings grouped by permission and outcome, the endpoints and users of
each, for a terminal.
`findings` grouped by permission and outcome, the endpoints and users of each, for a terminal.
(format-plan {:keys [everyone-roles viewers readers-roles grants] :as plan}
group-names)What the first start of this version does to rights, from
group-service/migration-plan; group-names {group-id name}.
What the first start of this version does to rights, from
`group-service/migration-plan`; `group-names` {group-id name}.(format-rights users)Users grouped by what they hold, a platform admin apart.
Users grouped by what they hold, a platform admin apart.
(legacy-roles users viewers)users counted by stored role, admins outside the platform apart.
viewers holds the ids stored as :viewer, which the user map reads as no role.
`users` counted by stored role, admins outside the platform apart. `viewers` holds the ids stored as :viewer, which the user map reads as no role.
(plan-pending? {:keys [everyone-roles viewers grants]})Whether plan (group-service/migration-plan) moves anything.
Whether `plan` (`group-service/migration-plan`) moves anything.
(right-str {:keys [permission scope]})A permission or role and its scope, orders/read {:domain-id 1}.
A permission or role and its scope, `orders/read {:domain-id 1}`.
(route-findings report users)Each user, endpoint (route-report) and permission :enforce refuses or
narrows, as {:user :endpoint :permission :access}. :permission is nil on
an endpoint no rule covers. A platform admin passes everything.
Each user, endpoint (`route-report`) and permission :enforce refuses or
narrows, as {:user :endpoint :permission :access}. `:permission` is nil on
an endpoint no rule covers. A platform admin passes everything.cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |