struct

KemalIdentity::Authz::Grants

Inherits Struct < Value < Object

Everything one authorization check needs about one account, in one round trip.

The three fields are kept apart rather than pre-merged into a single role list because the merge is the policy: tenant roles count only for a member, global roles count always, and RBAC is where that is written down. A repository that merged them would be a repository that could get the policy wrong, in a place nobody looks for policy.

Constructors

new(member : Bool = false, global_roles : Array(String) = [] of String, tenant_roles : Array(String) = [] of String)
Source

Instance methods

empty?
Source
global_roles

Roles held with no tenant, which apply everywhere.

Source
member?

Whether the account belongs to the tenant that was asked about. Always false when the check named no tenant, where it has no meaning.

Source
tenant_roles

Roles held inside the tenant that was asked about. Empty when no tenant was named.

Source