25 lines
1023 B
Go
25 lines
1023 B
Go
package model
|
|
|
|
// OwnerKind describes who owns a scopable resource (ledger account, recipient,
|
|
// payment method, …). It is the single source of truth for the personal-vs-org
|
|
// access model: a resource is either owned by an individual account (personal)
|
|
// or by an organization (org-scoped).
|
|
//
|
|
// The string values are persisted in Mongo and used in policy checks, so they
|
|
// must stay stable. Scopable resources embed model.Owner (which carries an
|
|
// OwnerKind) to keep one canonical vocabulary across the codebase.
|
|
type OwnerKind string
|
|
|
|
const (
|
|
// OwnerKindAccount marks a personal resource. Access is proven by ownership
|
|
// alone: caller is allowed iff ownerRef == caller's account. No policy check.
|
|
OwnerKindAccount OwnerKind = "account"
|
|
// OwnerKindOrganization marks an org-scoped resource. Access is gated by the
|
|
// relevant org policy via the Enforcer.
|
|
OwnerKindOrganization OwnerKind = "organization"
|
|
)
|
|
|
|
func (k OwnerKind) IsValid() bool {
|
|
return k == OwnerKindAccount || k == OwnerKindOrganization
|
|
}
|