struct

KemalIdentity::Authz::Assignment

Inherits Struct < Value < Object

An account holds a role, either globally or inside one tenant.

tenant_id nil means global — the role applies everywhere, including inside every tenant. That is how an operator role works, and it is the sharpest thing in this file: a global assignment is not gated by membership, so granting one is granting access to every tenant's data at once. Applications should have very few of them, and granted_by exists so that each one can be traced to whoever created it.

Constructors

new(id : String, account_id : String, role : String, granted_at : Time, tenant_id : String | Nil = nil, granted_by : String | Nil = nil)
Source

Instance methods

account_id
Source
global?
Source
granted_at
Source
granted_by

The account id of whoever granted it, when the application records that. Nil for a grant made by a migration or a seed script.

Source
role
Source
tenant_id

nil means global.

Source