OxL Справочник OxL
РусскийEnglish

enum Principal

Who calls (§13.2, D-4672). User comes from a verified JWT (cluster { auth { jwt(...) } }; roles from the roles claim, as text), Service / Node from the mTLS certificate of a cluster peer, Anonymous when there is no credential. In the dev profile without authentication the metadata x-oxl-user still makes a User with no roles (stage-3 shortcut, D-4676).

Example:

oxl✓ проверяется в CI
fn describe(p: Principal) -> str {
  match p {
    .User(id: id, ..) => "user {id}"
    .Service(name: n, ..) => "service {n}"
    .Node(id: n) => "node {n.name}"
    .Anonymous => "anonymous"
  }
}

fn main() io {
  print(describe(Principal.User("ann", ["Admin"], Map.new(), false, none)))
  print(describe(Principal.Anonymous))
}
Вывод
user ann
anonymous
@derive(Clone)
pub(api) enum Principal

С версии. 1.0.0-beta

Варианты

User(id: str, roles: List<str>, claims: Map<str, str>, mfa: bool, tenant: str?)

A user with a verified credential: id, roles, token claims, whether multi-factor authentication was used and the tenant.

Service(name: str, role: str)

A service of the cluster, identified by its mTLS certificate: its name and cluster role.

Node(id: NodeId)

A node of the cluster.

Anonymous

No credential.

Методы

dynSpec() -> str
user:<id>:<roles,csv>:<tenant>, service:<name>:<role>, node:<id> or anonymous
dynUser() -> str
The id a flag hashes for by
dynTenantId() -> str
The tenant of a user ("" when there is none).
isUser(id: str?) -> bool
The caller is a user; with id it must be that user (none -> false).
has(role: R) -> bool
caller.has(role
service(name: str) -> bool
The caller is the service of cluster role name (caller.service("billing"), §13.2).
hasRole(role: str) -> bool
The caller is a user who has the role named role (the name of the AppRole variant, e.g.
isService(name: str) -> bool
The caller is the service of cluster role name (or the node of that id).
userId() -> str | AccessDenied
The id of the user; AccessDenied when the caller is not a user.
scoped(keep: List<str>) -> Principal
The same user with only the roles also listed in keep (for asScoped); other principals are unchanged.

Определено в: std/core/rpc.oxl:49

См. также