Bendik Aagaard LynghaugandClaude Fable 5.1
eeeb89b217
Who may do what to what was five checks in five files: `qualifies` on
a page, `requires_group`/`public` on a resource, a desk's transition
allow-list, a self_transition's email check, the automation token.
They are now compiled from content on every load into one Cedar
policy set (src/access.rs), and every server entry point asks it: open
and submit a page, read a resource, move a record, fire a self
transition, read a bucket as the automation service, extend an
invite. Each decision names the rules that granted it; refusals and
every mutation are published on portal.access.decided, and
portal.access.<site>.may answers the same question for other apps
over request-reply (proven live against uhhm's content). The policy
validates against a fixed schema, so a content shape the compiler
cannot express fails instead of granting nothing. Identity is still
Kanidm's; the browser keeps is_qualified as a rendering hint only.
`invite: {group}` on an alternative of a gated page onboards a person:
src/people.rs creates the account, records the email, adds the group
and mints a one-time credential link through Kanidm's REST API with a
service-account token (KANIDM_API_TOKEN, in idm_people_on_boarding).
The result is recorded with the answer into the runtime's
portal_invites bucket and announced on portal.people.invited. Validated:
an invite needs a gated page and required name and email fields.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH
37 lines
589 B
Rust
37 lines
589 B
Rust
pub mod answers;
|
|
pub mod app;
|
|
pub mod auth;
|
|
pub mod chain;
|
|
pub mod content;
|
|
pub mod events;
|
|
pub mod i18n;
|
|
pub mod resource;
|
|
|
|
#[cfg(feature = "ssr")]
|
|
pub mod aggregates;
|
|
|
|
#[cfg(feature = "ssr")]
|
|
pub mod announce;
|
|
|
|
#[cfg(feature = "ssr")]
|
|
pub mod http;
|
|
|
|
#[cfg(feature = "ssr")]
|
|
pub mod access;
|
|
|
|
#[cfg(feature = "ssr")]
|
|
pub mod people;
|
|
|
|
#[cfg(feature = "ssr")]
|
|
pub mod server;
|
|
|
|
#[cfg(feature = "ssr")]
|
|
pub mod upload;
|
|
|
|
#[cfg(feature = "hydrate")]
|
|
#[wasm_bindgen::prelude::wasm_bindgen]
|
|
pub fn hydrate() {
|
|
console_error_panic_hook::set_once();
|
|
leptos::mount::hydrate_body(app::App);
|
|
}
|