Module: Hecks::Ports::AccessControl

Defined in:
lib/hecks/ports/access_control.rb

Overview

WHO CAN SIGN IN, AND WHAT ROLE DO THEY HOLD — the domain-specific half of sign-in Ports::Authentication deliberately stays out of (see that port's own header: it only ever talks to the external provider, never this registry's own data). Resolved the same way every other port here resolves its adapter: one adapter registry-wide answers this, since an app has no reason to want a different "who's allowed in" source per aggregate.

Every domain shapes this differently — who its own "a person who can sign in" aggregate is, what admits them, what grants them access — so this port is pure delegation, same as every sibling port. The one piece of this that IS generic (a live Governance grant should win over whatever an aggregate's own role field says) lives on Ports::Authorization#live_role_for instead — a domain's adapter here calls that directly, rather than this port re-deriving Governance-query logic another port already owns.

Constant Summary collapse

NAME = 
"access_control"

Class Method Summary collapse

Class Method Details

.adapter(registry) ⇒ Object 



46
47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/hecks/ports/access_control.rb', line 46

def adapter(registry)
  implementations = registry.adapters.values.select { |a| a.port == NAME }

  case implementations.size
  when 1 then Adapters.const_get(implementations.first.name)
  when 0
    raise Runtime::WiringError,
          "no adapter implements the #{NAME} port — nothing can answer who's allowed in"
  else
    raise Runtime::WiringError,
          "#{implementations.size} adapters implement the #{NAME} port " \
          "(#{implementations.map(&:name).sort.join(', ')}) — the runtime will not choose for you"
  end
end

.all_people(registry) ⇒ Object 



42
43
44
 
# File 'lib/hecks/ports/access_control.rb', line 42

def all_people(registry)
  adapter(registry).all_people(registry)
end

.available_roles(registry) ⇒ Object 



34
35
36
 
# File 'lib/hecks/ports/access_control.rb', line 34

def available_roles(registry)
  adapter(registry).available_roles(registry)
end

.grant(registry, email:, role:) ⇒ Object 



38
39
40
 
# File 'lib/hecks/ports/access_control.rb', line 38

def grant(registry, email:, role:)
  adapter(registry).grant(registry, email: email, role: role)
end

.provision(registry, email:, issuer:, subject:) ⇒ Object 



30
31
32
 
# File 'lib/hecks/ports/access_control.rb', line 30

def provision(registry, email:, issuer:, subject:)
  adapter(registry).provision(registry, email: email, issuer: issuer, subject: subject)
end

.session_for_identity(registry, identity_id:) ⇒ Object 



26
27
28
 
# File 'lib/hecks/ports/access_control.rb', line 26

def session_for_identity(registry, identity_id:)
  adapter(registry).session_for_identity(registry, identity_id: identity_id)
end