struct

KemalIdentity::Authz::Resource

Inherits KemalIdentity::Authz::Authorizable < Struct < Value < Object

The implementation this shard ships, for an application that will not add an include to its models.

env.auth.authorize!(
  "invoices:edit",
  resource: KemalIdentity::Authz::Resource.new("invoice", invoice.id, {"owner_id" => invoice.owner_id}),
)

The route decides which attributes the policy needs, and that cost is deliberately visible: a route that passes the wrong ones gets a denial rather than a wrong answer, because a policy reading an attribute that is not there denies.

Constructors

new(authz_type : String, authz_id : String, attributes : Hash(String, String) | Nil = nil)

Source

Instance methods

[](key : String) : String | Nil

One attribute, or nil. A policy reading a missing attribute should deny rather than assume, which is why this returns nil instead of raising.

Source

attributes

Whatever the policy needs and cannot derive from the type and the id: an owner, a state, a classification. Strings, so that this serialises to a remote policy engine unchanged.

Source

authz_id

Which one, as a string. The application's own identifier.

Source

authz_type

What kind of thing this is: "invoice", "document", "repository".

Source