Malachi.Auth.AclRegistry (malachi v0.22.7)

View Source

The pure state of per-topic ACLs (P5, decision 5-1A/2A/3A): allow-only grants of an operation on a topic resource, keyed by username. The deterministic core replicated by Malachi.Auth.AclMachine over a dedicated ra cluster, mirroring Malachi.Auth.UserRegistry.

A grant is {username, operation, resource} where operation is :produce or :consume and resource is {:literal, topic} (an exact topic) or {:prefix, prefix} (any topic starting with prefix, the Kafka prefixed-ACL model). Grants only allow: there are no deny rules; absence is denial (enforced in strict mode by Malachi.Auth.Authorization). Pure: no clock, no config.

Summary

Types

command()
grant()
operation()
resource()
t()

Functions

apply(state, arg2)

Applies a command, returning {new_state, reply}. Deterministic; ACLs need no time input.

authorized?(acl_registry, username, operation, topic)

Whether username has a grant for operation on topic (a matching literal or prefix resource).

command_versions()

Every command shape, mapped to the machine version that introduced it (see Malachi.Cluster.MachineVersion).

list_all(acl_registry)

Every grant across all users as {username, operation, resource}.

list_grants(acl_registry, username)

The grants for username as {operation, resource} (empty if none).

new()

An empty registry.

parse_resource(pattern)

Parses a resource pattern string into a resource: a trailing * marks a prefix ("orders.*" → {:prefix, "orders."}, "*" → {:prefix, ""} = all topics), otherwise a literal exact topic.

render_resource(arg)

Renders a resource back to its pattern string (inverse of parse_resource/1).

Types

command()

@type command() ::
  {:grant, String.t(), operation(), resource()}
  | {:revoke, String.t(), operation(), resource()}
  | {:revoke_user, String.t()}

grant()

@type grant() :: {String.t(), operation(), resource()}

operation()

@type operation() :: :produce | :consume

resource()

@type resource() :: {:literal, String.t()} | {:prefix, String.t()}

t()

@type t() :: %Malachi.Auth.AclRegistry{
  grants: %{required(String.t()) => MapSet.t({operation(), resource()})}
}

Functions

apply(state, arg2)

@spec apply(t(), command()) :: {t(), term()}

Applies a command, returning {new_state, reply}. Deterministic; ACLs need no time input.

authorized?(acl_registry, username, operation, topic)

@spec authorized?(t(), String.t(), operation(), String.t()) :: boolean()

Whether username has a grant for operation on topic (a matching literal or prefix resource).

command_versions()

Every command shape, mapped to the machine version that introduced it (see Malachi.Cluster.MachineVersion).

list_all(acl_registry)

@spec list_all(t()) :: [grant()]

Every grant across all users as {username, operation, resource}.

list_grants(acl_registry, username)

@spec list_grants(t(), String.t()) :: [{operation(), resource()}]

The grants for username as {operation, resource} (empty if none).

new()

@spec new() :: t()

An empty registry.

parse_resource(pattern)

@spec parse_resource(String.t()) :: resource()

Parses a resource pattern string into a resource: a trailing * marks a prefix ("orders.*" → {:prefix, "orders."}, "*" → {:prefix, ""} = all topics), otherwise a literal exact topic.

render_resource(arg)

@spec render_resource(resource()) :: String.t()

Renders a resource back to its pattern string (inverse of parse_resource/1).