@@ -51,13 +51,15 @@ func LogNotAuthorizedError(ctx context.Context, logger slog.Logger, err error) e
51
51
}
52
52
53
53
// insert is the same as insertWithReturn, but does not return the inserted object.
54
- func insert [ArgumentType any ,
55
- Insert func (ctx context.Context , arg ArgumentType ) error ](
56
- // Arguments
54
+ func insert [
55
+ ArgumentType any ,
56
+ Insert func (ctx context.Context , arg ArgumentType ) error ,
57
+ ](
57
58
logger slog.Logger ,
58
59
authorizer rbac.Authorizer ,
59
60
object rbac.Objecter ,
60
- insertFunc Insert ) Insert {
61
+ insertFunc Insert ,
62
+ ) Insert {
61
63
return func (ctx context.Context , arg ArgumentType ) error {
62
64
_ , err := insertWithReturn (logger , authorizer , object , func (ctx context.Context , arg ArgumentType ) (rbac.Objecter , error ) {
63
65
return rbac.Object {}, insertFunc (ctx , arg )
@@ -69,13 +71,16 @@ func insert[ArgumentType any,
69
71
// insertWithReturn runs an rbac.ActionCreate on the rbac object argument before
70
72
// running the insertFunc. The insertFunc is expected to return the object that
71
73
// was inserted.
72
- func insertWithReturn [ObjectType any , ArgumentType any ,
73
- Insert func (ctx context.Context , arg ArgumentType ) (ObjectType , error )](
74
- // Arguments
74
+ func insertWithReturn [
75
+ ObjectType any ,
76
+ ArgumentType any ,
77
+ Insert func (ctx context.Context , arg ArgumentType ) (ObjectType , error ),
78
+ ](
75
79
logger slog.Logger ,
76
80
authorizer rbac.Authorizer ,
77
81
object rbac.Objecter ,
78
- insertFunc Insert ) Insert {
82
+ insertFunc Insert ,
83
+ ) Insert {
79
84
return func (ctx context.Context , arg ArgumentType ) (empty ObjectType , err error ) {
80
85
// Fetch the rbac subject
81
86
act , ok := ActorFromContext (ctx )
@@ -94,39 +99,49 @@ func insertWithReturn[ObjectType any, ArgumentType any,
94
99
}
95
100
}
96
101
97
- func deleteQ [ObjectType rbac.Objecter , ArgumentType any ,
102
+ func deleteQ [
103
+ ObjectType rbac.Objecter ,
104
+ ArgumentType any ,
98
105
Fetch func (ctx context.Context , arg ArgumentType ) (ObjectType , error ),
99
- Delete func (ctx context.Context , arg ArgumentType ) error ](
106
+ Delete func (ctx context.Context , arg ArgumentType ) error ,
107
+ ](
100
108
// Arguments
101
109
logger slog.Logger ,
102
110
authorizer rbac.Authorizer ,
103
111
fetchFunc Fetch ,
104
- deleteFunc Delete ) Delete {
112
+ deleteFunc Delete ,
113
+ ) Delete {
105
114
return fetchAndExec (logger , authorizer ,
106
115
rbac .ActionDelete , fetchFunc , deleteFunc )
107
116
}
108
117
109
- func updateWithReturn [ObjectType rbac.Objecter ,
118
+ func updateWithReturn [
119
+ ObjectType rbac.Objecter ,
110
120
ArgumentType any ,
111
121
Fetch func (ctx context.Context , arg ArgumentType ) (ObjectType , error ),
112
- UpdateQuery func (ctx context.Context , arg ArgumentType ) (ObjectType , error )](
122
+ UpdateQuery func (ctx context.Context , arg ArgumentType ) (ObjectType , error ),
123
+ ](
113
124
// Arguments
114
125
logger slog.Logger ,
115
126
authorizer rbac.Authorizer ,
116
127
fetchFunc Fetch ,
117
- updateQuery UpdateQuery ) UpdateQuery {
128
+ updateQuery UpdateQuery ,
129
+ ) UpdateQuery {
118
130
return fetchAndQuery (logger , authorizer , rbac .ActionUpdate , fetchFunc , updateQuery )
119
131
}
120
132
121
- func update [ObjectType rbac.Objecter ,
133
+ func update [
134
+ ObjectType rbac.Objecter ,
122
135
ArgumentType any ,
123
136
Fetch func (ctx context.Context , arg ArgumentType ) (ObjectType , error ),
124
- Exec func (ctx context.Context , arg ArgumentType ) error ](
137
+ Exec func (ctx context.Context , arg ArgumentType ) error ,
138
+ ](
125
139
// Arguments
126
140
logger slog.Logger ,
127
141
authorizer rbac.Authorizer ,
128
142
fetchFunc Fetch ,
129
- updateExec Exec ) Exec {
143
+ updateExec Exec ,
144
+ ) Exec {
130
145
return fetchAndExec (logger , authorizer , rbac .ActionUpdate , fetchFunc , updateExec )
131
146
}
132
147
@@ -137,12 +152,16 @@ func update[ObjectType rbac.Objecter,
137
152
// The database query function will **ALWAYS** hit the database, even if the
138
153
// user cannot read the resource. This is because the resource details are
139
154
// required to run a proper authorization check.
140
- func fetch [ArgumentType any , ObjectType rbac.Objecter ,
141
- DatabaseFunc func (ctx context.Context , arg ArgumentType ) (ObjectType , error )](
155
+ func fetch [
156
+ ArgumentType any ,
157
+ ObjectType rbac.Objecter ,
158
+ DatabaseFunc func (ctx context.Context , arg ArgumentType ) (ObjectType , error ),
159
+ ](
142
160
// Arguments
143
161
logger slog.Logger ,
144
162
authorizer rbac.Authorizer ,
145
- f DatabaseFunc ) DatabaseFunc {
163
+ f DatabaseFunc ,
164
+ ) DatabaseFunc {
146
165
return func (ctx context.Context , arg ArgumentType ) (empty ObjectType , err error ) {
147
166
// Fetch the rbac subject
148
167
act , ok := ActorFromContext (ctx )
@@ -169,16 +188,19 @@ func fetch[ArgumentType any, ObjectType rbac.Objecter,
169
188
// fetchAndExec uses fetchAndQuery but only returns the error. The naming comes
170
189
// from SQL 'exec' functions which only return an error.
171
190
// See fetchAndQuery for more information.
172
- func fetchAndExec [ObjectType rbac.Objecter ,
191
+ func fetchAndExec [
192
+ ObjectType rbac.Objecter ,
173
193
ArgumentType any ,
174
194
Fetch func (ctx context.Context , arg ArgumentType ) (ObjectType , error ),
175
- Exec func (ctx context.Context , arg ArgumentType ) error ](
195
+ Exec func (ctx context.Context , arg ArgumentType ) error ,
196
+ ](
176
197
// Arguments
177
198
logger slog.Logger ,
178
199
authorizer rbac.Authorizer ,
179
200
action rbac.Action ,
180
201
fetchFunc Fetch ,
181
- execFunc Exec ) Exec {
202
+ execFunc Exec ,
203
+ ) Exec {
182
204
f := fetchAndQuery (logger , authorizer , action , fetchFunc , func (ctx context.Context , arg ArgumentType ) (empty ObjectType , err error ) {
183
205
return empty , execFunc (ctx , arg )
184
206
})
@@ -192,15 +214,19 @@ func fetchAndExec[ObjectType rbac.Objecter,
192
214
// The fetch is used to know which rbac object the action should be asserted on
193
215
// **before** the query runs. The returns from the fetch are only used to
194
216
// assert rbac. The final return of this function comes from the Query function.
195
- func fetchAndQuery [ObjectType rbac.Objecter , ArgumentType any ,
217
+ func fetchAndQuery [
218
+ ObjectType rbac.Objecter ,
219
+ ArgumentType any ,
196
220
Fetch func (ctx context.Context , arg ArgumentType ) (ObjectType , error ),
197
- Query func (ctx context.Context , arg ArgumentType ) (ObjectType , error )](
221
+ Query func (ctx context.Context , arg ArgumentType ) (ObjectType , error ),
222
+ ](
198
223
// Arguments
199
224
logger slog.Logger ,
200
225
authorizer rbac.Authorizer ,
201
226
action rbac.Action ,
202
227
fetchFunc Fetch ,
203
- queryFunc Query ) Query {
228
+ queryFunc Query ,
229
+ ) Query {
204
230
return func (ctx context.Context , arg ArgumentType ) (empty ObjectType , err error ) {
205
231
// Fetch the rbac subject
206
232
act , ok := ActorFromContext (ctx )
@@ -226,11 +252,15 @@ func fetchAndQuery[ObjectType rbac.Objecter, ArgumentType any,
226
252
227
253
// fetchWithPostFilter is like fetch, but works with lists of objects.
228
254
// SQL filters are much more optimal.
229
- func fetchWithPostFilter [ArgumentType any , ObjectType rbac.Objecter ,
230
- DatabaseFunc func (ctx context.Context , arg ArgumentType ) ([]ObjectType , error )](
255
+ func fetchWithPostFilter [
256
+ ArgumentType any ,
257
+ ObjectType rbac.Objecter ,
258
+ DatabaseFunc func (ctx context.Context , arg ArgumentType ) ([]ObjectType , error ),
259
+ ](
231
260
// Arguments
232
261
authorizer rbac.Authorizer ,
233
- f DatabaseFunc ) DatabaseFunc {
262
+ f DatabaseFunc ,
263
+ ) DatabaseFunc {
234
264
return func (ctx context.Context , arg ArgumentType ) (empty []ObjectType , err error ) {
235
265
// Fetch the rbac subject
236
266
act , ok := ActorFromContext (ctx )
0 commit comments