KemalIdentity::Authz::DenyAll
Inherits KemalIdentity::Authz::Authorizer < Reference < Object
Permits nothing, ever.
The default when an application has configured authorization types but not yet a store, and what a spec uses to prove that a route is actually guarded. Denying everything is the only safe thing an unconfigured authorizer can do — an authorizer that permitted everything would turn a wiring mistake into an open application.
Instance methods
The decision, with the reason or the granting role attached.
context carries the tenant, the resource being acted on, environment attributes and the
credential that proved the request. A Context rather than a longer parameter list
because this method is frozen at v1.0: the last time it needed something new — a resource
— there was nowhere to put it, and an application implementing ownership rules had to
bypass env.auth and lose the audit line, the step-up mapping and the uniform 403 along
with it (blueprints/0022-authorization-context-and-denials.md).
context.tenant_id nil asks the question outside any tenant. That is not "any tenant": a
permission held only inside tenant A is not granted by a check that names no tenant, and
a route that forgets to pass the tenant it is operating on gets a denial rather than a
quiet upgrade to global scope.