RoleBinding
in package
One role bound to a subject — a group or a service account — in one of the two shapes §27.6.1 addition 2 allows (contract 1.51).
A bare role key normalizes to a plain binding via self::from(), so
->group('eng', 'Engineering', 'desc', roleKeys: ['auditor']) keeps reading exactly as
it did before this class existed.
A subject holds a role at most once
The server keys an assignment on (subject, role) with no resource component, and a
second assignment of the same role to the same subject is a 409 — whatever the
resource and whatever the flag. So a subject's bindings name each role ONCE: two scoped
bindings of one role, or a plain one and a scoped one, describe a state the server
cannot hold, and ManifestValidation refuses the manifest before any request,
naming the subject and the role.
Changing a binding
The binding's natural key is (subject, role); its resource and inherit are fields.
When either differs from the server, the action is an Update, performed as
unassign, then assign — there is no update endpoint — so between the two calls the
subject does not hold the role. If the assign fails, apply() assigns the previous
binding again and reports both results (BindingRebindFailed). The server
binding's tenant_scope (§5.2.3), which a manifest does not state, is carried across
unchanged.
Table of Contents
Properties
Methods
- at() : self
- `$roleKey` at `$resourceKey`, reaching its descendants.
- atOnly() : self
- `$roleKey` at `$resourceKey` ONLY — "here and no further". Refused by the server (`400`) for a role with `is_global: true`; {@see ManifestValidation} refuses it first when that role is in the manifest.
- from() : self
- Normalizes a builder-supplied entry: a bare role key becomes a plain {@see self::role()} binding; an already-built binding passes through unchanged.
- role() : self
- The role, with no resource — tenant-wide, and so with no inheritance question.
Properties
$inherit read-only
public
bool
$inherit
$resource read-only
public
string|null
$resource
$role read-only
public
string
$role
Methods
at()
`$roleKey` at `$resourceKey`, reaching its descendants.
public
static at(string $roleKey, string $resourceKey) : self
Parameters
- $roleKey : string
- $resourceKey : string
Return values
selfatOnly()
`$roleKey` at `$resourceKey` ONLY — "here and no further". Refused by the server (`400`) for a role with `is_global: true`; {@see ManifestValidation} refuses it first when that role is in the manifest.
public
static atOnly(string $roleKey, string $resourceKey) : self
Parameters
- $roleKey : string
- $resourceKey : string
Return values
selffrom()
Normalizes a builder-supplied entry: a bare role key becomes a plain {@see self::role()} binding; an already-built binding passes through unchanged.
public
static from(self|string $value) : self
Parameters
- $value : self|string
Return values
selfrole()
The role, with no resource — tenant-wide, and so with no inheritance question.
public
static role(string $roleKey) : self
Parameters
- $roleKey : string