/workspace/authorization
The authorization module exports the seam through which workspace composition routes template scope access decisions.
A composing host may register asynchronous authorization providers to answer scope decisions from an external policy store, eg. OpenFGA. Each provider is registered with a key.
A provider is only consulted for a user with a matching authorization_provider property. Without the property the authorizeScope method returns the synchronous checkScope semantics for the user.roles array.
- Source
Requires
Methods
(async, inner) authorizeScope(context) → {Promise.<boolean>}
The method resolves a scope access decision for workspace composition.
The checkScope semantics for the user.roles array apply unless the user has an authorization_provider property.
With the property the decision is routed through the provider registered for the user.authorization_provider key. The provider must resolve true for the scope access to be granted. A missing provider or a provider error fails closed and access is denied.
| Name | Type | Description |
|---|---|---|
context | AuthorizationContext | The scope decision context. |
Whether the user has access to the scope.
- Type:
- Promise.<boolean>
(inner) setAuthorizationProvider(key, provideropt)
The method registers an authorization provider for workspace composition. The provider is only consulted for a user with an authorization_provider property matching the key.
Calling the method without a provider argument clears the registration for the key.
| Name | Type | Attributes | Description |
|---|---|---|---|
key | string | The provider key matched against the user.authorization_provider property. | |
provider | AuthorizationProvider | <optional> | The provider to register. |