IUserGroupService: groups, members, roles and assignments through one place, so each change is checked and audited. Reads go to the database every time.
IUserGroupService: groups, members, roles and assignments through one place, so each change is checked and audited. Reads go to the database every time.
(active-users user-repository xf)Every active user, by email, through xf, read a page at a time so only
what xf keeps is held.
Every active user, by email, through `xf`, read a page at a time so only what `xf` keeps is held.
(create-group-service group-repository
user-repository
audit-repository
settings)(create-group-service group-repository
user-repository
audit-repository
settings
{:keys [registry membership explain resolve]})A group service. settings is what prepare-settings returns. opts:
:registry, the permission registry its code roles come from, and
:membership, the hook (fn [user] #{group-name …}) that adds groups an
identity provider names, and :explain and :resolve,
wagoe.platform.shell.authorization/explain and resolve-rights with the
registry applied.
A group service. `settings` is what `prepare-settings` returns. `opts`:
`:registry`, the permission registry its code roles come from, and
`:membership`, the hook `(fn [user] #{group-name …})` that adds groups an
identity provider names, and `:explain` and `:resolve`,
`wagoe.platform.shell.authorization/explain` and `resolve-rights` with the
registry applied.(declared-permissions {:keys [permissions]})The :permissions enum of prepared groups settings, as a declaration for
the permission registry. A schema that is not an enum lists nothing. Read
until 2.0, when modules declare their own.
The `:permissions` enum of prepared `groups` settings, as a declaration for the permission registry. A schema that is not an enum lists nothing. Read until 2.0, when modules declare their own.
(declared-scopes {:keys [scope-schema]})The keys of a :scope map schema in prepared groups settings, as scope
keys for the permission registry, :wagoe/entity read as :entity.
Another schema declares none. Read until 2.0, like :permissions.
The keys of a `:scope` map schema in prepared `groups` settings, as scope keys for the permission registry, `:wagoe/entity` read as `:entity`. Another schema declares none. Read until 2.0, like `:permissions`.
(migrate! {:keys [group-repository registry] :as svc})ADR-041's migration: under :enforce nobody may do less than under :off, and nobody becomes an admin. Idempotent; runs at boot.
The first time, Everyone is created and, when there are users other than
admins, given every module's editor role. Viewers join Readers. Group
grants become assignments of a managed role named after their permission.
migration-plan decides each, so what wagoe upgrade authorization check
prints is what runs.
ADR-041's migration: under :enforce nobody may do less than under :off, and nobody becomes an admin. Idempotent; runs at boot. The first time, Everyone is created and, when there are users other than admins, given every module's editor role. Viewers join Readers. Group grants become assignments of a managed role named after their permission. `migration-plan` decides each, so what `wagoe upgrade authorization check` prints is what runs.
(migration-plan {:keys [group-repository registry settings]})What migrate! changes, read without writing: {:everyone-roles (nil when
Everyone exists or only admins do) :viewers [user-id] :readers-roles
:grants [legacy grant not yet migrated]}, but not one named after a code
role: that stays unmigrated, and migrate! logs it. Neither group gets a
role holding a permission something already checks as a grant
(gated-permissions): that would hand it to every user.
What `migrate!` changes, read without writing: {:everyone-roles (nil when
Everyone exists or only admins do) :viewers [user-id] :readers-roles
:grants [legacy grant not yet migrated]}, but not one named after a code
role: that stays unmigrated, and `migrate!` logs it. Neither group gets a
role holding a permission something already checks as a grant
(`gated-permissions`): that would hand it to every user.(prepare-settings groups):wagoe/user :groups checked and resolved, for the service. Throws
:configuration-error, so a bad declaration fails boot.
`:wagoe/user :groups` checked and resolved, for the service. Throws :configuration-error, so a bad declaration fails boot.
(with-registry-permissions settings registry)settings checking a grant's permission against registry when
:groups :permissions declares none. Without either, any keyword passes.
`settings` checking a grant's permission against `registry` when `:groups :permissions` declares none. Without either, any keyword passes.
(with-registry-scopes settings registry)settings checking a grant's scope against the scope keys in registry
(wagoe.platform.core.scope/scope-schema) when it declares any; else
against the :groups :scope schema, or any map, as before.
`settings` checking a grant's scope against the scope keys in `registry` (`wagoe.platform.core.scope/scope-schema`) when it declares any; else against the `:groups :scope` schema, or any map, as before.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |