fabric/reviewer

The identity that answers an approval request.

An answer (fabric.approve, fabric.reject, graph.approve, graph.reject) does not take a reviewer: it takes an approvers.Proof, and the reviewer it records (run.Approval.reviewer) is the one the approvers’ verify function returned. A reviewer is that function’s building block: it names the identity a credential authenticated, such as the subject and issuer of a verified access token.

use token, requirement <- approvers.new("sso")
use claims <- result.try(verify_token(token, requirement))
reviewer.new(claims.subject)
|> result.try(reviewer.with_issuer(_, claims.issuer))
|> result.map_error(fn(error) {
  approvers.NotAuthenticated(reviewer.describe_error(error))
})

A subject and an issuer come from a token, so they are checked: each is 1 to 256 bytes. Fabric may add optional parts to a reviewer; build one with new and read it with the accessors.

Types

Error

</>

Why new or with_issuer refused a value.

pub type Error {
  Empty(part: Part)
  TooLong(part: Part, bytes: Int, limit: Int)
}

Constructors

```
Empty(part: Part)
```
The part is the empty string.
```
TooLong(part: Part, bytes: Int, limit: Int)
```
The part is longer than limit bytes (bytes is its length).

Part

</>

Which part of a reviewer Error names.

pub type Part {
  Subject
  Issuer
}

Constructors

```
Subject
```
```
Issuer
```

Reviewer

</>

An authenticated identity that answers approvals. Build one with new.

pub type Reviewer =
  @internal Reviewer

Values

describe_error

</>

pub fn describe_error(error: Error) -> String

One line for logs.

issuer

</>

pub fn issuer(reviewer: Reviewer) -> option.Option(String)

max_bytes

</>

pub const max_bytes: Int

The longest subject or issuer, in bytes.

new

</>

pub fn new(subject: String) -> Result(Reviewer, Error)

A reviewer named by subject: the authenticated identity’s stable id within its issuer (an OIDC sub, a user id), 1 to 256 bytes.

subject

</>

pub fn subject(reviewer: Reviewer) -> String

with_issuer

</>

pub fn with_issuer(
  reviewer: Reviewer,
  issuer: String,
) -> Result(Reviewer, Error)

The authority that vouches for the subject (an OIDC iss), so that two identity providers’ subjects are not confused; 1 to 256 bytes.