class

KemalIdentity::Authz::DenyAll

Inherits KemalIdentity::Authz::Authorizer < Reference < Object

Permits nothing, ever.

The default when an application has configured authorization types but not yet a store, and what a spec uses to prove that a route is actually guarded. Denying everything is the only safe thing an unconfigured authorizer can do — an authorizer that permitted everything would turn a wiring mistake into an open application.

Instance methods

decide(principal : Principal, permission : String, context : Context) : Decision

The decision, with the reason or the granting role attached.

context carries the tenant, the resource being acted on, environment attributes and the credential that proved the request. A Context rather than a longer parameter list because this method is frozen at v1.0: the last time it needed something new — a resource — there was nowhere to put it, and an application implementing ownership rules had to bypass env.auth and lose the audit line, the step-up mapping and the uniform 403 along with it (blueprints/0022-authorization-context-and-denials.md).

context.tenant_id nil asks the question outside any tenant. That is not "any tenant": a permission held only inside tenant A is not granted by a check that names no tenant, and a route that forgets to pass the tenant it is operating on gets a denial rather than a quiet upgrade to global scope.

Source