store

type Operation struct {
	Name     string `json:"name"`
	Resource string `json:"resource"`
}

type Resource struct {
	Name string `json:"name"`
}

type Role struct {
	Name string `json:"name"`
}

type RoleGrant struct {
	Role      string
	Operation string
	Scope     model.Scope
}

type Shared interface {
	EnsureUser(sub string) error
	ListUsers() ([]User, error)

	CreateResource(name string) error // ErrConflict when it exists
	EnsureResource(name string) error
	DeleteResource(name string) error // ErrNotFound; cascades operations
	ListResources() ([]Resource, error)

	CreateOperation(name, resource string) error // ErrConflict; ensures the resource
	EnsureOperation(name, resource string) error
	DeleteOperation(name string) error // ErrNotFound
	ListOperations() ([]Operation, error)
	OperationExists(name string) (bool, error)
}

type Stores struct {
	Shared Shared
	// contains filtered or unexported fields
}

type Tenant interface {
	CreateRole(name string) error // ErrConflict
	EnsureRole(name string) error
	RoleExists(name string) (bool, error)
	RenameRole(name, newName string) error // ErrNotFound / ErrConflict
	DeleteRole(name string) error          // ErrNotFound; cascades everything
	ListRoles() ([]Role, error)

	AssignRole(sub, role string) error   // ErrNotFound when the role is missing; idempotent
	UnassignRole(sub, role string) error // ErrNotFound when not assigned
	UserRoles(sub string) ([]string, error)

	SetRolePermission(role, operation string, scope model.Scope) error // upsert; ErrNotFound role
	RemoveRolePermission(role, operation string) error                 // ErrNotFound; cascades IDs
	RolePermissions(role string) ([]model.OperationScope, error)       // ErrNotFound role
	HasRolePermission(role, operation string) (bool, error)            // ErrNotFound role

	SetUserPermission(sub, operation string, scope model.Scope) error // upsert
	RemoveUserPermission(sub, operation string) error                 // ErrNotFound; cascades IDs
	UserPermissions(sub string) ([]model.OperationScope, error)
	HasUserPermission(sub, operation string) (bool, error)

	AddRoleRestrictedIDs(role, operation string, ids []string) error // idempotent
	RemoveRoleRestrictedIDs(role, operation string, ids []string) error
	RoleRestrictedIDs(roles []string, operation string) ([]string, error) // deduplicated union

	AddUserRestrictedIDs(sub, operation string, ids []string) error // idempotent
	RemoveUserRestrictedIDs(sub, operation string, ids []string) error
	UserRestrictedIDs(sub, operation string) ([]string, error)

	// RoleGrants returns every (role, operation, scope) triple of the given roles.
	RoleGrants(roles []string) ([]RoleGrant, error)
}

type User struct {
	Sub string `json:"sub"`
}