WeaviateEx.API.RBAC.Permission (WeaviateEx v0.7.4)

Permission definitions for RBAC.

Permissions define what actions can be taken on what resources, optionally scoped to specific collections, tenants, or shards.

Actions

:create - Create new resources
:read - Read/view resources
:update - Modify existing resources
:delete - Delete resources
:manage - Full control (create, read, update, delete)
:assign_and_revoke - Assign/revoke roles (for users/groups)

Resources

:collections - Collection schema operations
:data - Object CRUD operations
:tenants - Multi-tenancy management
:roles - Role management
:users - User management
:groups - OIDC group management
:cluster - Cluster information
:nodes - Node information
:backups - Backup operations

Examples

# Basic permission
perm = Permission.new(:read, :collections)

# Permission with scope
perm = Permission.new(:read, :data, collection: "Article")

# Convenience constructors
perm = Permission.read_collection("Article")
perm = Permission.manage_data("Article")

# Admin permissions
perms = Permission.admin()

Summary

Types

action()

resource()

t()

Functions

action_from_api(action_str)

Parses an action string from API format.

action_to_api(action, resource)

Converts an action and resource to API string format.

admin()

Returns a list of permissions for full admin access.

create_data(name)

Creates a create permission for data in a collection.

delete_data(name)

Creates a delete permission for data in a collection.

from_api(api)

Parses a permission from API response.

manage_collection(name)

Creates a manage permission for a collection schema.

manage_data(name)

Creates a manage permission for data in a collection.

new(action, resource, opts \\ [])

Creates a new permission.

read_collection(name)

Creates a read permission for a collection schema.

read_data(name)

Creates a read permission for data in a collection.

to_api(permission)

Converts a permission to API format.

update_data(name)

Creates an update permission for data in a collection.

valid_action?(action)

Checks if an action is valid.

valid_resource?(resource)

Checks if a resource is valid.

viewer()

Returns a list of permissions for read-only access.

Types

action()

@type action() :: :create | :read | :update | :delete | :manage | :assign_and_revoke

resource()

@type resource() ::
  :collections
  | :data
  | :tenants
  | :roles
  | :users
  | :groups
  | :cluster
  | :nodes
  | :backups
  | :replicate
  | :alias

t()

@type t() :: %WeaviateEx.API.RBAC.Permission{
  action: action(),
  resource: resource(),
  scope: WeaviateEx.API.RBAC.Scope.t() | nil
}

Functions

action_from_api(action_str)

@spec action_from_api(String.t()) :: {action(), resource()}

Parses an action string from API format.

Examples

action_from_api("read_collections")
# => {:read, :collections}

action_to_api(action, resource)

@spec action_to_api(action(), resource()) :: String.t()

Converts an action and resource to API string format.

Examples

action_to_api(:read, :collections)
# => "read_collections"

admin()

@spec admin() :: [t()]

Returns a list of permissions for full admin access.

create_data(name)

@spec create_data(String.t()) :: t()

Creates a create permission for data in a collection.

delete_data(name)

@spec delete_data(String.t()) :: t()

Creates a delete permission for data in a collection.

from_api(api)

@spec from_api(map()) :: t()

Parses a permission from API response.

manage_collection(name)

@spec manage_collection(String.t()) :: t()

Creates a manage permission for a collection schema.

manage_data(name)

@spec manage_data(String.t()) :: t()

Creates a manage permission for data in a collection.

new(action, resource, opts \\ [])

@spec new(action(), resource(), keyword()) :: t()

Creates a new permission.

Options

:scope - A Scope struct to restrict the permission
:collection - Shorthand to create a collection scope
:tenant - Shorthand to add a tenant to the scope

Examples

Permission.new(:read, :collections)
Permission.new(:read, :data, scope: Scope.collection("Article"))
Permission.new(:read, :data, collection: "Article", tenant: "tenant-a")

read_collection(name)

@spec read_collection(String.t()) :: t()

Creates a read permission for a collection schema.

read_data(name)

@spec read_data(String.t()) :: t()

Creates a read permission for data in a collection.

to_api(permission)

@spec to_api(t()) :: map()

Converts a permission to API format.

Example

Permission.read_collection("Article") |> Permission.to_api()
# => %{"action" => "read_collections", "collection" => "Article"}

update_data(name)

@spec update_data(String.t()) :: t()

Creates an update permission for data in a collection.

valid_action?(action)

@spec valid_action?(atom()) :: boolean()

Checks if an action is valid.

valid_resource?(resource)

@spec valid_resource?(atom()) :: boolean()

Checks if a resource is valid.

viewer()

@spec viewer() :: [t()]

Returns a list of permissions for read-only access.