What this does

Authorize is the stub function that will be called externally. This is the main entry-point for the package.

#715 , #716, #718, #720, #725

Making a user with given roles

See example_test.go to see how to add multiple roles to a user. SubjectTODO is a placeholder, and roles can be serialized for db storage. Serialization is not implemented until required.

user := authz.SubjectTODO{
	UserID: "alice",
	Roles: []authz.Role{
		authz.RoleOrgAdmin("default"),
		authz.RoleSiteMember,
	},
}

Using Authorize

Authorize is a function on an authorizer. For now, the authorizer just precompiles a builtin rego policy.

For example, to "Read all workspaces in the org Coder", we create a ResourceWorkspace owned by the org Coder

// In practice 'Coder' would be a uuid
authz.Authorize(ctx, user.ID, user.Roles, authz.ActionRead, authz.ResourceWorkspace.InOrg("Coder"))

To read all workspaces across the whole product, we omit the owner id since we want to include the set of all workspaces.

authz.Authorize(ctx, user.ID, user.Roles,  authz.ActionRead, authz.ResourceWorkspace.All())

Making a new Role

Most roles are just * and easy to write. One example of enumerating certain permissions uses a helper function to keep the role as few LoC:

The helper func omits negative permissions, but those can be defined explicitly. Note that no builtin roles require negative permissions, and are only needed for edge cases that we don't need to support in MVP.

Benchmarks

736 permission checks were done in <300ms. I think this is fast enough.
The rego handles role expansion, which is kinda neat.