Kitto.AccessControl.DB

Defines the DB access controller, an implementation of RBAC that uses roles and permissions stored in two database tables.

TKUserPermissionStorage class

Utility class used by TKDBAccessController. Encapsulates the permission storage for a user and all the roles granted to him.

procedure AfterConstruction;

Creates the in-memory permission store and its column header.

destructor Destroy;

Frees the in-memory permission store.

property UserId: string read FUserId write SetUserId;

Name of the user whose this object is holding permissions. Set this property to have all permissions for a given user and all his roles loaded into memory.

function GetAccessGrantValue(const AResourceURI, AMode: string): Variant;

Returns the grant value for the specified resource URI and access mode, fetching it from the in-memory data.

Call this method only after setting UserId. If several permission records are found, the value of the last one is returned; the search sequence is: first user permissions, then roles permissions in role name alphabetical order.

Standard modes (which are all Boolean) are treated slightly differently:

• If True is found, then the search continues until False is found (in which case the method returns False) or all records are processed (in which case the method returns True). This allows to selectively deny permissions.
• If no matching permission record is found, then Null is returned.

property ReadPermissionsCommandText: string read FReadPermissionsCommandText write FReadPermissionsCommandText;

See the same-named param in <see cref= "TKDBAccessController" />.

property ReadRolesCommandText: string read FReadRolesCommandText write FReadRolesCommandText;

See the same-named param in <see cref= "TKDBAccessController" />.

property Permissions: TKStore read FPermissions;

Read-only access to the loaded permission rows for the configured UserId. Each record exposes the three columns RESOURCE_URI_PATTERN, ACCESS_MODES, GRANT_VALUE that the access controller iterates to resolve a grant. Used by the JWT engine (TKJWTEngine, Kitto.Auth.JWT) at login time to snapshot the permissions into the kx_acl JWT claim, so the same matching logic can be replayed in TKJWTAccessController without re-hitting the DB.

TKDBAccessController class

The DB access controller uses a set of tables in the database to store user permissions. The tables have fixed structures; to use different table names or structures, you either create a descendant or set parameters.

In order for this access controller to work, it is required that the database contains the following tables:

KITTO_USER_ROLESThis table holds the roles that are assigned to each user.

• USER_NAME Unique user identifier.
• ROLE_NAME Unique role identifier.

The USER_NAME + ROLE_NAME combination must be unique.

KITTO_PERMISSIONSThis table holds the permissions granted to each user or role.

• RESOURCE_URI_PATTERN Unique resource URI; may contain the wildcards * and ?; may begin with ~, which has the effect of negating the rest of the pattern; may contain macros, which are expanded before evaluation; may contain a regular expression, if prefixed with 'REGEX:', or a negated regular expression ('~REGEX:').
• GRANTEE_NAME User or role name.
• ACCESS_MODES Comma-separated list of access modes for which the permission is granted; no spaces allowed.
• GRANT_VALUE Granted value; use '0' and '1' for Boolean values.

The first three fields are unique. The first time an access control method is called, the access controller fetches all permission data for the specified user and all the roles granted to him, and then checks how access is granted and returns the result.

Config parameters:

• ReadPermissionsCommandText A SQL select statement that selects all permission records for a grantee, with the first three fields representing the first tree fields in KITTO_PERMISSIONS and a single string parameter that will be filled in with the grantee name. Example (this is also the default setting):select RESOURCE_URI_PATTERN, ACCESS_MODES, GRANT_VALUEfrom KITTO_PERMISSIONS where GRANTEE_NAME = :GRANTEE_NAMEorder by RESOURCE_URI_PATTERN, ACCESS_MODES
• ReadRolesCommandText A SQL select statement that selects all roles granted to a user, with a single field representing the role name and a single string parameter that will be filled in with the user name. Example (this is also the default setting): select ROLE_NAME from KITTO_USER_ROLES where USER_NAME = :USER_NAME order by ROLE_NAME

procedure AfterConstruction;

Creates the per-user permission cache.

destructor Destroy;

Frees the cached per-user permission storages.