View Source Rolex.DSL (Rolex v0.5.3)

Implements a small domain-specific language ("DSL") for scoping permissions.

The DSL is defined by a handful of keyword options:

:role - a plain atom naming the role
:to - specifies the subject scope; i.e. "who holds the role?"
:on - specifics the object scope; i.e. "on which resources does the role apply?

When revoking permissions, from is used in place of to, because it reads more naturally.

Subject and object scopes are specified using any of these values:

:all - a special atom for granting or denying ALL of something
any Ecto schema module; e.g. MyApp.Users.User
any Ecto schema record; e.g. %MyApp.Users.User{id: 123}

Summary

Types

action()

any_from_opt()

any_on_opt()

any_role()

any_role_opt()

any_scope()

any_to_opt()

changeset()

filter_option()

from_opt()

on_opt()

record()

revoke_option()

role()

role_opt()

schema()

scope()

t()

to_opt()

Functions

changeset(action, opts)

Returns a changeset for DSL options used to perform action.

changeset_for_filter(opts)

Returns a changeset for options used when filtering permissions.

changeset_for_grant_or_deny(opts)

Returns a changeset for DSL options used when granting or denying permissions.

changeset_for_revoke(opts)

Returns a changeset for options used when revoking permissions.

new(input \\ [])

Returns a new Rolex.DSL initialized from input on success, or {:error, reason} otherwise.

to_permission_params(input)

Converts input from external DSL options to internal Rolex.Permission schema params.

Types

action()

@type action() :: :grant | :deny | :revoke | :filter

any_from_opt()

@type any_from_opt() :: {:from, any_scope()}

any_on_opt()

@type any_on_opt() :: {:on, any_scope()}

any_role()

@type any_role() :: :any | role()

any_role_opt()

@type any_role_opt() :: {:role, any_role()}

any_scope()

@type any_scope() :: :any | {:any, schema()} | scope()

any_to_opt()

@type any_to_opt() :: {:to, any_scope()}

changeset()

@type changeset() :: Ecto.Changeset.t(t())

from_opt()

@type from_opt() :: {:from, scope()}

on_opt()

@type on_opt() :: {:on, scope()}

record()

@type record() :: Ecto.Schema.t()

revoke_option()

@type revoke_option() ::
  {:role, :any | role()} | {:from, :any | scope()} | {:on, :any | scope()}

role()

@type role() :: atom()

role_opt()

@type role_opt() :: {:role, role()}

schema()

@type schema() :: module()

scope()

@type scope() :: :all | schema() | record()

t()

@type t() :: %Rolex.DSL{from: scope(), on: scope(), role: role(), to: scope()}

to_opt()

@type to_opt() :: {:to, scope()}

Functions

changeset(action, opts)

@spec changeset(
  action(),
  keyword()
) :: changeset()

Returns a changeset for DSL options used to perform action.

Action may be any of :grant, :deny, :revoke, :filter.

changeset_for_filter(opts)

@spec changeset_for_filter([any_role_opt() | any_to_opt() | any_on_opt()]) ::
  changeset()

Returns a changeset for options used when filtering permissions.

Options:

:role - a plain atom naming a role, or:
- :any - will match any permission role
- a list of plain atoms naming all roles of interest
:to - :all, schema, record, or:
- :any - will match any permission subject
- {:any, <schema>} - will match any permission subject of the named schema
:on - :all, schema, record, or:
- :any - will match any permission object
- {:any, <schema>} - will match any permission object of the named schema

changeset_for_grant_or_deny(opts)

@spec changeset_for_grant_or_deny([role_opt() | to_opt() | on_opt()]) :: changeset()

Returns a changeset for DSL options used when granting or denying permissions.

Options:

:role - a plain atom naming a role
:to - :all, schema, or record
:on - :all, schema, or record

changeset_for_revoke(opts)

@spec changeset_for_revoke([any_role_opt() | any_from_opt() | any_on_opt()]) ::
  changeset()

Returns a changeset for options used when revoking permissions.

Options:

:role - a plain atom naming a role, or:
- :any - will match any permission role
:from - :all, schema, record, or:
- :any - will match any permission subject
- {:any, <schema>} - will match any permission subject of the named schema
:on - :all, schema, record, or:
- :any - will match any permission object
- {:any, <schema>} - will match any permission object of the named schema

new(input \\ [])

Returns a new Rolex.DSL initialized from input on success, or {:error, reason} otherwise.

to_permission_params(input)

@spec to_permission_params(t() | Enumerable.t()) :: map() | {:error, term()}

Converts input from external DSL options to internal Rolex.Permission schema params.

Returns an atom-keyed map on success, or an {:error, reason} tuple otherwise.