Malachi.
View Source
The pure per-topic authorization decision (P5, decision 5-1A): composes the coarse global RBAC with the fine-grained ACL grant into a single allow/deny, so the enforcement boundary stays a one-line check.
allow?/4 layers three rules, in order:
- A superuser (
superuser?/1,:admin) is always allowed. - Backward compatibility (default): when strict mode is off, a global operation permission
(
:produce/:consumein the session) grants the operation on any topic, exactly as before ACLs existed, so enabling ACLs breaks no existing deployment. - Otherwise the decision falls to the per-topic ACL grant (
acl_grant?). In strict mode rules 1 and 3 are the only paths: global permissions are ignored and access is deny-by-default, only an explicit ACL (or admin) allows the operation.
The ACL grant is supplied as a thunk (acl_grant_fun), evaluated only in the third rule, so the
produce/consume hot path pays for an ACL lookup only when the decision actually needs it (strict mode, or a
user without the global permission), never when admin or a global permission already settles it. Pure and
total; strict? comes from config, so this module has no dependencies and is exhaustively testable.
Summary
Functions
Whether operation is allowed given the session permissions and strict?. acl_grant_fun is a
zero-arity function returning whether a matching per-topic ACL grant exists; it is called only when the
decision falls through to the ACL (so the caller can skip an ACL store query otherwise).
Whether permissions make a superuser: :admin holds every wire operation and every console role.
This is the one statement of that rule; every other module asks here rather than testing for the atom.
Functions
Whether operation is allowed given the session permissions and strict?. acl_grant_fun is a
zero-arity function returning whether a matching per-topic ACL grant exists; it is called only when the
decision falls through to the ACL (so the caller can skip an ACL store query otherwise).
Whether permissions make a superuser: :admin holds every wire operation and every console role.
This is the one statement of that rule; every other module asks here rather than testing for the atom.