43 lines
1.9 KiB
Text
43 lines
1.9 KiB
Text
# RBAC Base — role skeleton and shared effects
|
|
#
|
|
# Provides the common effect dictionary and the default fallback policy.
|
|
# Feature fragments (features/*.ncl) provide permissions per role.
|
|
# Compose in your site/rbac.ncl using the @ array concatenation operator.
|
|
#
|
|
# Usage:
|
|
# let base = import "rustelo/resources/nickel/rbac/rbac-base.ncl" in
|
|
# let auth = import "rustelo/resources/nickel/rbac/features/auth.ncl" in
|
|
# let content = import "rustelo/resources/nickel/rbac/features/content.ncl" in
|
|
#
|
|
# { groups = [
|
|
# { name = "admin", ..., permissions = auth.admin @ content.admin },
|
|
# { name = "user", ..., permissions = auth.user @ content.user },
|
|
# { name = "guest", ..., permissions = auth.guest @ content.guest },
|
|
# ],
|
|
# defaults = base.defaults & { unauthenticated_allow = [ ...site-specific... ] },
|
|
# } | C.FileRbacConfig | RoleNamesConsistent
|
|
|
|
{
|
|
# Reusable effect sets — import and reference as E.redirect_login, etc.
|
|
effects = {
|
|
redirect_login = [{ type = "redirect", to = "/login?return={request.path}" }],
|
|
audit_deny = [{ type = "audit_log", event = "access_denied", level = "warn" }],
|
|
audit_allow = [{ type = "audit_log", event = "access_granted", level = "info" }],
|
|
api_forbidden = [{ type = "response", status = 403, body.error = "Forbidden" }],
|
|
log_warn = [{ type = "log", level = "warn", message = "Denied: {request.path}" }],
|
|
security_alert = [{
|
|
type = "notify",
|
|
channel = "security",
|
|
message = "Access: {request.path} by {user.email}",
|
|
}],
|
|
},
|
|
|
|
# Minimal defaults — override unauthenticated_allow in your site/rbac.ncl
|
|
defaults = {
|
|
unauthenticated_allow = [],
|
|
unauthenticated_deny = [],
|
|
authenticated_fallback = "deny",
|
|
unauthenticated_fallback = "deny",
|
|
fallback_effects = [{ type = "log", level = "warn", message = "Denied: {request.path}" }],
|
|
},
|
|
}
|