Documentation

Convert the Credentials into an ObjId to which the ceredentials refer. That's the object the client is authenticated as.

Defines all the authorization points which are used in the server. For each you can supply your own logic. The default is to allow everything.

Authorization logic is implemented as a list of Avers actions, each of which we call a module and returns a result (AuthzR), which determines what happens next.

The result of a single module is either ContinueR, which means we continue executing following modules, AllowR which means that the action is allowed and any following modules are skipped, or RejcetR which means that the action is rejected and following modules are skipped as well.

Run the authorization logic inside of the Servant monad.

This doesn't change the result, but allows you to run arbitrary Avers actions. This is useful for debugging.

If the given Avers action returns True, it is sufficient to pass the authorization check.

The given Avers action must return True for this authorization check to pass.

True if the session created the given object.

True if the session is the given object. In most cases, a session has full access to the object against which it was created.