authz

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 28, 2026 License: MIT Imports: 4 Imported by: 0

Documentation

Overview

Package authz provides explicit, allowlist-style authorization decisions.

Policies return a Decision built with Allow or Deny. Handlers enforce a decision with Authorize, which writes the canonical 403 forbidden envelope on deny; services convert one into an error with Decision.Err. Deny reasons are internal: they are logged and wrapped as error causes, but never serialized into HTTP responses.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Authorize 

func Authorize(c *gin.Context, d Decision) bool

Authorize enforces a decision at the HTTP boundary. When denied it logs the internal reason through the request-scoped logger, writes the canonical 403 forbidden envelope, aborts the request, and returns false. When allowed it writes nothing and returns true.

Types

type Decision 

type Decision struct {
	// Allowed store data used by this type.
	Allowed bool
	Reason  string // internal; logged, never serialized
}

Decision is the outcome of a policy check. The zero value denies, so a forgotten rule fails closed.

func Allow 

func Allow() Decision

Allow grants the action.

func Deny 

func Deny(reason string) Decision

Deny rejects the action. The reason stays internal — it is logged and carried as an error cause, never sent to clients.

func (Decision) Err 

func (d Decision) Err() error

Err returns nil when the decision allows the action. Otherwise it returns a stable 403 *httpx.Error with code "forbidden"; the deny reason travels only as the wrapped cause, so the response body never varies with it.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.