buddy.auth.accessrules — net.clojars.savya/buddy-auth 4.0.2

Access rules system for Ring-based applications.

compile-access-rule clj

(compile-access-rule accessrule)

Receive an access rule and return its compiled version.

An uncompiled access rule is a hash map with :uri and :handler keys. :uri uses URL match syntax. :handler is a rule handler.

Example access rules:

[{:uri "/foo"
  :handler user-access}
 {:uris ["/bar" "/baz"]
  :handler admin-access}]

The clout library (https://github.com/weavejester/clout) matches the :uri.

It also supports regular expressions. They match the full request URI:

[{:pattern #"^/foo$"
  :handler user-access}

An access rule can also match HTTP methods with :request-method. :request-method can be a keyword or a set of keywords.

[{:pattern #"^/foo$"
  :handler user-access
  :request-method :get}

Compilation changes the uncompiled access rule to avoid overhead during request processing.

The compiled access rule has a similar format. Its :handler is compiled. A matcher function replaces :pattern or :uri.

Example compiled access rule:

[{:matcher #<accessrules$compile_access_rule$fn__13092$fn__13095...>
  :handler #<accessrules$compile_rule_handler$fn__14040$fn__14043...>

compile-access-rules clj

(compile-access-rules accessrules)

Compile a list of access rules.

See the compile-access-rule docstring for more information.

compile-rule-handler clj

(compile-rule-handler rule)

Receive a rule handler and return its compiled version.

The compiled rule handler is a function. It accepts a request as its first parameter and returns its evaluation result.

The rule can be a function or a logical expression. Use a hash map for a logical expression:

{:or [f1 f2]}
{:and [f1 f2]}

You can nest logical expressions:

{:or [f1 {:and [f2 f3]}]}

A rule handler must return success or error. success marks a handler that passes validation. error marks a rule that does not pass validation.

An error mark can return a Ring response to the HTTP client. It can return a string message to an on-error handler. If no handler exists, it returns a bad-request response with the message as its body.

Example of success marks:

• true
• (success)

Example of error marks:

• nil
• false
• (error "Error msg")
• (error {:status 400 :body "Unauthorized"})

error clj

(error)

(error v)

Return a failure state from an access rule handler.

IRuleHandlerResponse clj protocol

Abstraction for uniform handling of rule handler return values. It has a default implementation for nil and Boolean types.

get-value clj

(get-value _)

Get a handler response value.

success? clj

(success? _)

Check if a response is a success.

restrict clj

(restrict handler rule)

Like wrap-access-rules middleware, but it works as a decorator. Use it with the compojure routing library or a similar library. Example:

(defn login-ctrl [req] ...)
(defn admin-ctrl [req] ...)

(defroutes app
  (ANY "/login" [] login-ctrl)
  (GET "/admin" [] (restrict admin-ctrl {:handler admin-access ;; Mandatory
                                           :on-error my-reject-handler)

This decorator uses the same access rules without a URL matching algorithm. It couples router code with access rules.

success clj

(success)

(success v)

Return a success state from an access rule handler.

wrap-access-rules clj

(wrap-access-rules handler
                   &
                   [{:keys [policy rules] :or {policy :allow} :as opts}])

Ring middleware that defines access rules for a Ring handler.

wrap-access-rules middleware expects an access rules list like this:

[{:uri "/foo/*"
  :handler user-access}
 {:uri "/bar/*"
  :handler {:or [user-access admin-access]}}
 {:uri "/baz/*"
  :handler {:and [user-access {:or [admin-access operator-access]}]}}]

The middleware evaluates access rules in order. It stops when it finds a match.

See the compile-rule-handler docstring for rule handler information.