9226454b85
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
- Add UndeployAll() using label selectors to clean up monorepo components on project deletion (replaces name-based Undeploy in DeleteProject and the direct undeploy handler) - Add ResourceGC background worker that periodically finds K8s resources whose project label has no matching DB record, deletes after 1h safety window - Widen deployer client type from *kubernetes.Clientset to kubernetes.Interface for testability - UndeployAll accumulates errors via errors.Join instead of failing fast - Add checkout/checkin sidecar dev flow: temporary git tokens, branch checkout, review on checkin with cleanup workers - Add interactive sessions: pod binding, command execution, SSE streaming, ephemeral preview URLs with session cleanup workers - Add GET /workers/pool endpoint for aggregate capacity and queue depth - Add sessions:read and sessions:execute auth scopes Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
76 lines
2.4 KiB
Go
76 lines
2.4 KiB
Go
package auth
|
|
|
|
import "github.com/orchard9/rdev/internal/domain"
|
|
|
|
// Scope is an alias for domain.Scope.
|
|
// All scope constants, helpers, and validation live in domain/apikey.go.
|
|
type Scope = domain.Scope
|
|
|
|
// Re-exported scope constants for backward compatibility.
|
|
// Consumers should migrate to domain.ScopeXxx over time.
|
|
const (
|
|
ScopeProjectsRead = domain.ScopeProjectsRead
|
|
ScopeProjectsExecute = domain.ScopeProjectsExecute
|
|
ScopeKeysRead = domain.ScopeKeysRead
|
|
ScopeKeysWrite = domain.ScopeKeysWrite
|
|
ScopeAuditRead = domain.ScopeAuditRead
|
|
ScopeQueueRead = domain.ScopeQueueRead
|
|
ScopeQueueWrite = domain.ScopeQueueWrite
|
|
ScopeWebhookRead = domain.ScopeWebhookRead
|
|
ScopeWebhookWrite = domain.ScopeWebhookWrite
|
|
ScopeWorkersRead = domain.ScopeWorkersRead
|
|
ScopeWorkersWrite = domain.ScopeWorkersWrite
|
|
ScopeBuildRead = domain.ScopeBuildRead
|
|
ScopeBuildWrite = domain.ScopeBuildWrite
|
|
ScopeVerifyRead = domain.ScopeVerifyRead
|
|
ScopeVerifyWrite = domain.ScopeVerifyWrite
|
|
ScopeSessionsRead = domain.ScopeSessionsRead
|
|
ScopeSessionsExecute = domain.ScopeSessionsExecute
|
|
ScopeAdmin = domain.ScopeAdmin
|
|
)
|
|
|
|
// Re-exported scope helpers for backward compatibility.
|
|
var (
|
|
AllScopes = domain.AllScopes
|
|
ScopeDescriptions = domain.ScopeDescriptions
|
|
)
|
|
|
|
// ScopesFromStrings converts string slice to Scope slice.
|
|
func ScopesFromStrings(ss []string) []Scope {
|
|
return domain.ScopesFromStrings(ss)
|
|
}
|
|
|
|
// ScopesToStrings converts Scope slice to string slice.
|
|
func ScopesToStrings(scopes []Scope) []string {
|
|
return domain.ScopesToStrings(scopes)
|
|
}
|
|
|
|
// ValidateScopes checks if all scopes are valid.
|
|
func ValidateScopes(scopes []Scope) bool {
|
|
return domain.ValidateScopes(scopes)
|
|
}
|
|
|
|
// HasScope checks if a scope list contains a required scope.
|
|
func HasScope(scopes []Scope, required Scope) bool {
|
|
return domain.HasScope(scopes, required)
|
|
}
|
|
|
|
// HasAnyScope checks if a scope list contains any of the required scopes.
|
|
func HasAnyScope(scopes []Scope, required ...Scope) bool {
|
|
return domain.HasAnyScope(scopes, required...)
|
|
}
|
|
|
|
// HasProjectAccess checks if the key has access to a specific project.
|
|
// projectIDs nil means access to all projects.
|
|
func HasProjectAccess(allowedProjects []string, projectID string) bool {
|
|
if allowedProjects == nil {
|
|
return true
|
|
}
|
|
for _, p := range allowedProjects {
|
|
if p == projectID {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|