Malachi.
View Source
The cluster's per-topic ACL store: a thin facade over the ra-replicated ACL cluster
(Malachi.Auth.AclServer), the counterpart of Malachi.Auth.UserStore. Malachi.Application starts the
ra cluster at boot; this module routes grants/revokes through the log (consensus) and authorization reads
to the local replica (:ra.local_query, fast and eventually consistent).
Summary
Functions
Whether username has a grant for operation on topic, from the local replica. Fails closed: an
unreachable ACL store returns false (deny): authorization must not grant access it cannot verify.
The ACL cluster's ra cluster name.
Grants username an operation on resource. Returns :ok or {:error, reason}.
Every grant across all users as {username, operation, resource} (empty on error).
The grants for username as {operation, resource} (empty on error).
Revokes a single grant (idempotent). Returns :ok or {:error, reason}.
Revokes every grant for username (e.g. on user deletion). Returns :ok or {:error, reason}.
Functions
@spec authorized?(String.t(), Malachi.Auth.AclRegistry.operation(), String.t()) :: boolean()
Whether username has a grant for operation on topic, from the local replica. Fails closed: an
unreachable ACL store returns false (deny): authorization must not grant access it cannot verify.
@spec cluster_name() :: atom()
The ACL cluster's ra cluster name.
@spec grant( String.t(), Malachi.Auth.AclRegistry.operation(), Malachi.Auth.AclRegistry.resource() ) :: :ok | {:error, term()}
Grants username an operation on resource. Returns :ok or {:error, reason}.
@spec list_all() :: [Malachi.Auth.AclRegistry.grant()]
Every grant across all users as {username, operation, resource} (empty on error).
@spec list_grants(String.t()) :: [ {Malachi.Auth.AclRegistry.operation(), Malachi.Auth.AclRegistry.resource()} ]
The grants for username as {operation, resource} (empty on error).
@spec revoke( String.t(), Malachi.Auth.AclRegistry.operation(), Malachi.Auth.AclRegistry.resource() ) :: :ok | {:error, term()}
Revokes a single grant (idempotent). Returns :ok or {:error, reason}.
Revokes every grant for username (e.g. on user deletion). Returns :ok or {:error, reason}.