Documentation
¶
Index ¶
- Variables
- func AgentIDFromContext(ctx context.Context) string
- func GroupIDFromContext(ctx context.Context) string
- func IsForbidden(err error) bool
- func IsNotFound(err error) bool
- func MapError(tool string, err error) error
- func UserIDFromContext(ctx context.Context) string
- func WithAgentID(ctx context.Context, agentID string) context.Context
- func WithGroupID(ctx context.Context, groupID string) context.Context
- func WithUserID(ctx context.Context, userID string) context.Context
- type Action
- type ActorKind
- type AgentID
- type Authority
- func NewAgentAuthority(owner UserID, executor AgentID) (Authority, error)
- func NewChannelAuthority(user UserID, admin bool, channelID string) (Authority, error)
- func NewGroupAgentAuthority(group GroupID, agent AgentID) (Authority, error)
- func NewSystemAuthority(name Component) (Authority, error)
- func NewUserAuthority(user UserID, admin bool) (Authority, error)
- type Component
- type GroupID
- type Identity
- type UserID
Constants ¶
This section is empty.
Variables ¶
var ( ErrNotFound = errors.New("not found") ErrForbidden = errors.New("permission denied") ErrUnauthenticated = errors.New("authentication required - ask the user to run this from a signed-in one-on-one session") )
var ErrInvalidActor = errors.New("authz: invalid actor")
ErrInvalidActor is returned when constructor arguments do not satisfy the requested variant (missing required id).
Functions ¶
func AgentIDFromContext ¶
AgentIDFromContext extracts the agent ID from context.
func GroupIDFromContext ¶
GroupIDFromContext extracts the group ID from context.
func IsForbidden ¶
func IsNotFound ¶
func UserIDFromContext ¶
UserIDFromContext extracts the user ID from context.
func WithAgentID ¶
WithAgentID attaches an agent ID to the context.
func WithGroupID ¶
WithGroupID attaches a group ID to the context. Group turns carry the group (not a user) so a trusted adapter can reconstruct a confined GroupAgentActor without ever minting a user identity for the group (D9 isolation).
Types ¶
type Action ¶
type Action uint8
Action is a closed catalog of the verbs an Authority can be authorised to perform on a resource.
const ( // ActionInvalid is the zero value and never authorises anything. ActionInvalid Action = iota // ActionRead reads a single resource's content or configuration. ActionRead // ActionList enumerates resources of a type within the caller's scope. ActionList // ActionCreate creates a new resource. ActionCreate // ActionWrite mutates an existing resource (update/replace). ActionWrite // ActionDelete removes a resource. ActionDelete // ActionExecute runs a command/turn/job against a resource (run, cancel, // send, archive, and other state-transitioning commands collapse to this // verb at the catalog level; the specific command is a request fact). ActionExecute // ActionManage is a control-plane administrative action over a resource // class (settings, membership, provider registration). ActionManage // ActionUse invokes a resource as a capability without reading or mutating // it — using an agent to run a turn, using a connection to call an API. ActionUse )
type ActorKind ¶
type ActorKind uint8
ActorKind is the closed catalog of actor variants an Authority discriminates.
const ( // ActorInvalid is the zero value. A zero Authority is invalid and fails // closed. ActorInvalid ActorKind = iota // ActorUser is a human user acting through HTTP or a linked private channel, // optionally the admin superuser. ActorUser // ActorAgent is an agent delegated by a user and confined to one agent, // either a live private-session tool call or reconstructed durable work. ActorAgent // ActorGroupAgent is a group turn executing as one agent inside one group; it // carries no user and can never reach user-private capabilities. ActorGroupAgent // ActorSystem is named maintenance / control-plane work. It has no user or // admin identity and is never an implicit omnipotent actor. ActorSystem )
func AllActorKinds ¶
func AllActorKinds() []ActorKind
AllActorKinds returns the closed actor-kind catalog.
type AgentID ¶
type AgentID string
UserID, AgentID, GroupID, and Component are distinct string types so a caller cannot accidentally pass an agent id where a user id is required. Component names the maintenance class of a SystemActor.
type Authority ¶
type Authority struct {
// contains filtered or unexported fields
}
Authority is the immutable identity plus trusted attributes, discriminated by kind. Owner/executor for a delegated AgentActor are (userID, agentID). A GroupAgentActor carries only (groupID, agentID): the triggering group member is request/audit attribution resolved by the transport, never part of the authority, so it cannot grant that member's private-user capabilities to the group turn. admin marks the user superuser; channelBindingID, when set, is the one exact dedicated channel binding the Agent PEP may consume.
func NewAgentAuthority ¶
NewAgentAuthority constructs an AgentActor authority delegated by owner and confined to executor. Both ids are required; this is also the shape a durable worker reconstructs from a persisted owner + executor agent. A delegated agent never carries admin or a channel binding.
func NewChannelAuthority ¶
NewChannelAuthority constructs a UserActor authority that additionally holds one exact dedicated channel binding. channelID is read from the persisted channel configuration by the channel adapter; it is never request-payload identity, and it is consumed only by the Agent PEP's dedicated-channel decision.
func NewGroupAgentAuthority ¶
NewGroupAgentAuthority constructs a GroupAgentActor authority: one agent executing inside one group. It carries no user id and no admin identity, so user-private access is structurally impossible.
func NewSystemAuthority ¶
NewSystemAuthority constructs a named SystemActor. The component name is required. A system actor has no user or admin identity; it is named maintenance work, never an implicit omnipotent identity.
func NewUserAuthority ¶
NewUserAuthority constructs a UserActor authority. Every valid user is an ordinary user, optionally the admin superuser. The user id is required.
func (Authority) AgentID ¶
AgentID returns the confined/executing agent for AgentActor and GroupAgentActor, empty otherwise.
func (Authority) ChannelBindingID ¶
ChannelBindingID returns the exact dedicated channel binding this authority holds, or empty when it holds none. Only a UserActor minted by NewChannelAuthority carries one.
func (Authority) Component ¶
Component returns the maintenance class for SystemActor, empty otherwise.
func (Authority) UserID ¶
UserID returns the owning/acting user for UserActor and AgentActor, empty for group/system actors that have no user owner.
type Component ¶
type Component string
UserID, AgentID, GroupID, and Component are distinct string types so a caller cannot accidentally pass an agent id where a user id is required. Component names the maintenance class of a SystemActor.
type GroupID ¶
type GroupID string
UserID, AgentID, GroupID, and Component are distinct string types so a caller cannot accidentally pass an agent id where a user id is required. Component names the maintenance class of a SystemActor.
type Identity ¶
Identity is the non-spoofable runtime identity carried by context or an HTTP adapter. AgentScoped means access must stay inside AgentID's resource boundary.
func FromContext ¶
FromContext extracts the runtime identity for built-in tools. Group and unauthenticated sessions have no user id, so identity-scoped tools must refuse them. An agent session is always confined to its own agent's resources.
func (Identity) ToAuthority ¶
ToAuthority converts a legacy runtime Identity into an Authority. An agent-scoped identity with a bound agent becomes a delegated AgentActor (owner = user, executor = agent); a bare user identity becomes a UserActor. A group or unauthenticated identity (no user id) has no user-owned Authority and returns ErrUnauthenticated — the same fail-closed rule FromContext applies.
The legacy Identity carries no admin flag, so a bare user maps to an ordinary (non-admin) UserActor; this adapter only carries identity. Each domain resolves the durable facts its rules need at decision time.
Source Files