|
|
**`CoSecPrincipal`** — represents a user/agent with id, roles, policies, and attributes. Extends `java.security.Principal`. Root users bypass all checks.
- **`Authentication<C, P>`** — reactive interface (`Mono`-based) that verifies credentials and returns a `CoSecPrincipal`.
- **`Authorization`** — reactive interface that evaluates a `Request` against a `SecurityContext` and returns `AuthorizeResult` (ALLOW/EXPLICIT_DENY/IMPLICIT_DENY).
- **`Policy`** — collection of `Statement`s with an optional `ConditionMatcher`. Policy evaluation: check condition → DENY statements first → ALLOW statements. Default is implicit deny.
- **`Statement`** — single permission rule with `Effect` (ALLOW/DENY), `ActionMatcher`, and `ConditionMatcher`.
- **`SecurityContext`** — holds the current principal, tenant info, and mutable attributes.
|
|
发表于