AbacQueryPolicy
abstract class AbacQueryPolicy(val options: AbacQueryOptions = AbacQueryOptions.DEFAULT) : QueryPolicy
Resolves terminal snapshot access conditions using attribute-based access control (ABAC).
Principal tags from the current context are converted into query conditions and appended to snapshot queries. Other query models are unrestricted by this policy and do not resolve principal tags.
Matching rules
| Principal tags | Resource tags | Result |
|---|---|---|
wildcard (["*"]) | any | match |
["a", "b"] | ["a"] | match |
["a", "b"] | ["c"] | no match |
| any | key absent | match (public resource) |
| no tags | any | match |
The last two rows are the defaults; AbacQueryOptions tightens each.
Functions
Link copied to clipboard
open override fun evaluate(contextView: ContextView, context: QueryContext<*>): Mono<FilterExpression>
Resolves the ABAC condition for the current context.
Link copied to clipboard
Resolves the principal's ABAC tags from the current context.