The rights a user holds through their groups, and whether a role or an assignment may be made (ADR-041 §2–3).
An assignment is a group, a role and a scope. A user's grants are the
permissions of the roles assigned to their groups, each
{:permission kw :scope map} plus where it came from (:group-id :group-name
:role). holds? and grants-for answer for the permission, and the
application judges the scope.
The rights a user holds through their groups, and whether a role or an
assignment may be made (ADR-041 §2–3).
An assignment is a group, a role and a scope. A user's grants are the
permissions of the roles assigned to their groups, each
{:permission kw :scope map} plus where it came from (:group-id :group-name
:role). `holds?` and `grants-for` answer for the permission, and the
application judges the scope.(assignment-refusal {:keys [role scope]} roles {:keys [scope-schema]})Nil when assignment names one of roles and a scope the scope schema
takes, else a :validation-error naming the field.
Nil when `assignment` names one of `roles` and a scope the `scope` schema takes, else a :validation-error naming the field.
(authorized? grants permission scope-pred)Whether grants hold permission in a scope scope-pred accepts.
Whether `grants` hold `permission` in a scope `scope-pred` accepts.
What a grant may name when the application declares nothing.
What a grant may name when the application declares nothing.
What a scope may be when the application declares nothing.
What a scope may be when the application declares nothing.
(diff-summary diffs focal-id)diffs summed up for a preview: permission-counts, :user, the diff of
the user focal-id names, and the other users whose rights change,
:affected-count and the first preview-page-size as :affected.
`diffs` summed up for a preview: `permission-counts`, `:user`, the diff of the user `focal-id` names, and the other users whose rights change, `:affected-count` and the first `preview-page-size` as `:affected`.
(edn-value? x)Whether x is plain EDN data: written out, it reads back as it was.
Whether `x` is plain EDN data: written out, it reads back as it was.
The built-in group every signed-in user is in without being added.
The built-in group every signed-in user is in without being added.
(expiry-refusal expires-at now)Nil when expires-at, an Instant or nil for never, is after now, else a
:validation-error on :expires-at: an end already passed would give
nothing (BOU-856).
Nil when `expires-at`, an Instant or nil for never, is after `now`, else a :validation-error on :expires-at: an end already passed would give nothing (BOU-856).
(gated-permissions registry-permissions groups-permissions grants)The permissions something already checks as grants: those a module
declares itself, the groups schema's, and those grants hold.
The permissions something already checks as grants: those a module declares itself, the groups schema's, and those `grants` hold.
(grant->assignment {:keys [permission scope]})A grant as the assignment that replaces it: the managed role named after its permission, holding only that permission.
A grant as the assignment that replaces it: the managed role named after its permission, holding only that permission.
(grant-refusal grant settings)(grant-refusal {:keys [permission scope]}
{:keys [permissions scope-schema]}
code-roles)Nil when grant names a permission the permissions schema takes, not
the name of one of code-roles, and a scope the scope schema takes, else
a :validation-error naming the field. A grant becomes the managed role
named after its permission, and a code role of that name would shadow it.
Nil when `grant` names a permission the `permissions` schema takes, not the name of one of `code-roles`, and a scope the `scope` schema takes, else a :validation-error naming the field. A grant becomes the managed role named after its permission, and a code role of that name would shadow it.
(grants-for grants permission)The distinct scopes in which grants hold permission.
The distinct scopes in which `grants` hold `permission`.
(holds? grants permission)Whether grants hold permission, in any scope.
Whether `grants` hold `permission`, in any scope.
(import-changes {:keys [held] present :members}
{:keys [members roles]}
replace?)What importing wanted members and roles (assignments) into a group
holding members and held assignments changes: users to :join, :leave
and :stay, compared by :id, and assignments to :add and :remove. Nothing
leaves unless replace?.
What importing wanted `members` and `roles` (assignments) into a group holding `members` and `held` assignments changes: users to :join, :leave and :stay, compared by :id, and assignments to :add and :remove. Nothing leaves unless `replace?`.
(module-roles code-roles kind gated)The code roles named <module>/<kind> ("editor", "viewer") that hold
none of the gated permissions, and not the admin module's: a migration
that hands them out must widen no check that already reads grants, and make
nobody an admin (the registry lets no other module's role hold an
admin.* permission).
The code roles named `<module>/<kind>` ("editor", "viewer") that hold
none of the `gated` permissions, and not the admin module's: a migration
that hands them out must widen no check that already reads grants, and make
nobody an admin (the registry lets no other module's role hold an
`admin.*` permission).(parse-name s)A permission or role name as typed, invoice/approve or :invoice/approve.
A permission or role name as typed, `invoice/approve` or `:invoice/approve`.
(permission-counts diffs)Per-user diffs, [{:user {:id :email} :added :removed}] as
wagoe.platform.core.scope/rights-diff gives them, counted: :permissions,
per permission how many users gain it and lose it, in some scope, and
:affected-count, the users whose rights change.
Per-user diffs, [{:user {:id :email} :added :removed}] as
`wagoe.platform.core.scope/rights-diff` gives them, counted: `:permissions`,
per permission how many users gain it and lose it, in some scope, and
`:affected-count`, the users whose rights change.(permission-str permission)permission as stored and shown: its namespace kept, no colon.
`permission` as stored and shown: its namespace kept, no colon.
How many of the other users a change affects a preview names.
How many of the other users a change affects a preview names.
(role-refusal {:keys [name permissions]} code-roles known)Nil when managed role may be stored beside code-roles, holding only
known permissions, else a :validation-error naming the field.
Nil when managed `role` may be stored beside `code-roles`, holding only `known` permissions, else a :validation-error naming the field.
(roles-holding roles permission)The names of roles that hold permission.
The names of `roles` that hold `permission`.
(scope-key-label k props)What a scope key declared in :groups :scope is called: its schema's
:title, else its name without -id, :domain-id as "Domain".
What a scope key declared in `:groups :scope` is called: its schema's `:title`, else its name without `-id`, `:domain-id` as "Domain".
(user-grants assignments roles)The grants assignments give through roles, {role {:permissions #{..}}}.
An assignment of a role that no longer exists gives nothing.
The grants `assignments` give through `roles`, {role {:permissions #{..}}}.
An assignment of a role that no longer exists gives nothing.(users-with-permission holders scope-pred)The distinct user ids among holders, as permission-holders returns
them, whose scope scope-pred accepts.
The distinct user ids among `holders`, as `permission-holders` returns them, whose scope `scope-pred` accepts.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |