ktgrants

---

ergonomic permission and authorization library

Warning

Currently only available as a snapshot. Check the snapshot instructions below.

Setup

Note

For a full example, check out the sample submodule.

versions.toml

[versions]
ktgrants = "version"

[libs]
ktgrants-permissions = { module = "dev.stashy.ktgrants:permissions", version.ref = "ktgrants" }
ktgrants-authorization = { module = "dev.stashy.ktgrants:authorization", version.ref = "ktgrants" }

Snapshot versions

settings.gradle.kts or build.gradle.kts

repositories {
    maven("https://central.sonatype.com/repository/maven-snapshots/") {
        name = "Central Portal Snapshots"

        content {
            // only include specific libraries for snapshots here
            includeGroup("dev.stashy.ktgrants")
        }
    }
    mavenCentral()
}

Example

Based on the source available in the sample module.

object PermissionModel : PermissionConfig {
    val Read by Grant
    val Write by Grant
    val Create by Grant
    val Delete by Grant

    val Admin by Grant
    // ...

    override val resolver: PermissionResolver = resolverOf {
        grants {
            Admin provides setOf(Read, Write, Create, Delete)
        }
        wildcard {
            grant = true // enables matching grants against wildcard, e.g. `foo:subject:*` matching any grant
        }
    }
}

context(PermissionModel) {
    // entity we want to authorize for
    val foo = Foo(id = Id("bar"), content = "baz")

    // user model that only stores data
    val user = User(
        id = Id("user-1"), // `Id` implements `SubjectProvider`
        permissions = setOf(permission { Read any Foo }) // gives user "foo:*:read" permission
    )

    // user context expands permission entries
    val userContext = UserContext(user)

    if (userContext.hasPermission { Read on foo }) { // checks if user has "foo:bar:read"
        // do things - succeeds since `user` has `foo:*:read` permission
    } else {
        throw IllegalArgumentException("User ${user.id} does not have permission to read ${foo.id}")
    }
}