AbstractProtected ReadonlycreateList of rules to evaluate for create authorization.
Protected ReadonlydeleteList of rules to evaluate for delete authorization.
Protected ReadonlyreadList of rules to evaluate for read authorization.
Protected ReadonlyupdateList of rules to evaluate for update authorization.
Authorize an entity against creation policy.
viewer context of user creating the entity
query context in which to perform the create authorization
entity to authorize
entity if authorized
Authorize an entity against deletion policy.
viewer context of user deleting the entity
query context in which to perform the delete authorization
context about the reason for this privacy policy evaluation
entity to authorize
adapter for logging metrics about this authorization
entity if authorized
Authorize an entity against read policy.
viewer context of user reading the entity
query context in which to perform the read authorization
context about the reason for this privacy policy evaluation
entity to authorize
adapter for logging metrics about this authorization
entity if authorized
Authorize an entity against update policy.
viewer context of user updating the entity
query context in which to perform the update authorization
context about the reason for this privacy policy evaluation
entity to authorize
adapter for logging metrics about this authorization
entity if authorized
ProtectedgetGet the privacy policy evaluation mode and deny handler for this policy. Defaults to normal enforcing policy.
DRY_RUN mode is useful for testing and logging the effects of a policy without actually enforcing it, such as when first rolling out a new policy. Entities that fail the policy will be allowed so caution should be take when using.
Privacy policy for an entity.
Remarks
A privacy policy declares lists of PrivacyPolicyRule for create, read, update, and delete actions for an entity and provides logic for authorizing an entity against rules.
Evaluation of a list of rules is performed according the following example. This allows constructing of complex yet testable permissioning logic for an entity.
Example