Class: StytchB2B::PolicyCache

Inherits:
Object
  • Object
show all
Defined in:
lib/stytch/rbac_local.rb

Instance Method Summary collapse

Constructor Details

#initialize(rbac_client:) ⇒ PolicyCache

Returns a new instance of PolicyCache.



8
9
10
11
12
 
# File 'lib/stytch/rbac_local.rb', line 8

def initialize(rbac_client:)
  @rbac_client = rbac_client
  @policy_last_update = 0
  @cached_policy = nil
end

Instance Method Details

#get_policy(invalidate: false) ⇒ Object 



19
20
21
22
 
# File 'lib/stytch/rbac_local.rb', line 19

def get_policy(invalidate: false)
  reload_policy if invalidate || @cached_policy.nil? || @policy_last_update < Time.now.to_i - 300
  @cached_policy
end

#perform_authorization_check(subject_roles:, subject_org_id:, authorization_check:) ⇒ Object

Performs an authorization check against the project’s policy and a set of roles. If the check succeeds, this method will return. If the check fails, a PermissionError will be raised. It’s also possible for a TenancyError to be raised if the subject_org_id does not match the authZ request organization_id. authorization_check is an object with keys ‘action’, ‘resource_id’, and ‘organization_id’

Raises:



29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/stytch/rbac_local.rb', line 29

def perform_authorization_check(
  subject_roles:,
  subject_org_id:,
  authorization_check:
)
  request_org_id = authorization_check['organization_id']
  raise Stytch::TenancyError.new(subject_org_id, request_org_id) if request_org_id != subject_org_id

  policy = get_policy

  for role in policy['roles']
    next unless subject_roles.include?(role['role_id'])

    for permission in role['permissions']
      actions = permission['actions']
      resource = permission['resource_id']
      has_matching_action = actions.include?('*') || actions.include?(authorization_check['action'])
      has_matching_resource = resource == authorization_check['resource_id']
      if has_matching_action && has_matching_resource
        # All good
        return
      end
    end
  end

  # If we get here, we didn't find a matching permission
  raise Stytch::PermissionError, authorization_check
end

#reload_policy ⇒ Object 



14
15
16
17
 
# File 'lib/stytch/rbac_local.rb', line 14

def reload_policy
  @cached_policy = @rbac_client.policy['policy']
  @policy_last_update = Time.now.to_i
end