k2safe/orbit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: enforce shared application resource quotas across namespaces

Browse Source
This commit is contained in:
k2safe
2026-09-17 17:57:54 +08:00
parent 5c8825e4bc
commit 993786476e
43 changed files with 1606 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
platform/auth/token.go
View File

@@ -50,7 +50,7 @@ func Parse(value string) (Token, error) {
return Token{NamespaceID: ns, CredentialID: id, Digest: core.Digest(sha256.Sum256(secret))}, nil
}
// Permissions 是凭据的授权快照，动作与队列范围必须同时匹配。
// Permissions 是凭据的授权快照；队列动作同时核验队列范围，显式应用动作作用于整个所属应用。
type Permissions struct {
// Actions 明确授权的动作集合，首版不使用动作通配符。
Actions []string `json:"actions"`
@@ -58,7 +58,7 @@ type Permissions struct {
Queues []string `json:"queues"`
}
var supported = map[string]bool{"tasks:submit": true, "tasks:read": true, "tasks:cancel": true, "queues:read": true, "queues:manage": true, "workers:connect": true, "workers:consume": true, "schedules:read": true, "schedules:manage": true}
var supported = map[string]bool{"application:resources:read": true, "application:resources:manage": true, "tasks:submit": true, "tasks:read": true, "tasks:cancel": true, "queues:read": true, "queues:manage": true, "workers:connect": true, "workers:consume": true, "schedules:read": true, "schedules:manage": true}
func (p Permissions) Validate() error {
if len(p.Actions) == 0 || len(p.Actions) > 32 || len(p.Queues) == 0 || len(p.Queues) > 128 {