authz

package
v0.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 11, 2026 License: MIT Imports: 14 Imported by: 2

Documentation

Overview

Package authz provides engine-native factories for the Casbin RBAC module and pipeline steps. Import this package when embedding the authz plugin directly into an engine plugin (avoiding gRPC / duplicate step registration).

Usage in a host plugin: 

func (p *MyPlugin) ModuleFactories() map[string]plugin.ModuleFactory {
    return map[string]plugin.ModuleFactory{
        "authz.casbin": authz.NewCasbinModuleFactory(),
    }
}

func (p *MyPlugin) StepFactories() map[string]plugin.StepFactory {
    return authz.StepFactories()
}

Index

Constants

View Source 
const StorageSchemaVersion = 1

StorageSchemaVersion identifies the published persistent policy schema.

Variables

View Source 
var ErrRuntimeClosed = errors.New("authz runtime closed")

ErrRuntimeClosed reports an operation attempted after Close.

Functions

func NewCasbinModuleFactory 

func NewCasbinModuleFactory() plugin.ModuleFactory

NewCasbinModuleFactory returns an engine-compatible ModuleFactory for "authz.casbin".

func StepFactories 

func StepFactories() map[string]plugin.StepFactory

StepFactories returns all authz step factories as engine-native StepFactory values. Step types: step.authz_check_casbin, step.authz_add_policy, step.authz_remove_policy, step.authz_role_assign.

func ValidateStorage added in v0.6.0 

func ValidateStorage(ctx context.Context, db *gorm.DB, tableName string) error

ValidateStorage verifies the published PostgreSQL or SQLite schema for tableName without executing DDL. Other dialects return a sanitized error.

Types

type Decision added in v0.6.0 

type Decision struct {
	Allowed bool
}

Decision is the immutable result of evaluating a request.

type DecisionRequest added in v0.6.0 

type DecisionRequest struct {
	Subject string
	Object  string
	Action  string
}

DecisionRequest is one RBAC decision tuple.

type Health added in v0.6.0 

type Health struct {
	Status HealthStatus
}

Health is a sanitized on-demand storage health result.

type HealthStatus added in v0.6.0 

type HealthStatus string

HealthStatus classifies the runtime's current storage reachability. 

const (
	// HealthUnknown means storage health could not be determined, including a
	// canceled caller context or a closed runtime.
	HealthUnknown HealthStatus = "unknown"
	// HealthReady means the immutable runtime is usable and storage, when
	// configured, responded to the bounded ping.
	HealthReady HealthStatus = "ready"
	// HealthDegraded means persistent storage failed its ping. Loaded decisions
	// remain available from the immutable snapshot.
	HealthDegraded HealthStatus = "degraded"
)

type MigrationMode added in v0.6.0 

type MigrationMode string

MigrationMode controls whether the runtime owns schema migration or only validates a schema owned by the host application. 

const (
	// MigrationModeAuto creates or updates the policy schema before loading it.
	MigrationModeAuto MigrationMode = "auto"
	// MigrationModeValidate verifies PostgreSQL or SQLite without executing DDL.
	// MySQL remains compatible with MigrationModeAuto only.
	MigrationModeValidate MigrationMode = "validate"
)

func DecodeMigrationMode added in v0.6.0 

func DecodeMigrationMode(raw map[string]any) (MigrationMode, error)

DecodeMigrationMode decodes migration_mode from raw module configuration.

type PolicyRule added in v0.6.0 

type PolicyRule struct {
	Subject string
	Object  string
	Action  string
}

PolicyRule is one three-field policy row.

type Runtime added in v0.6.0 

type Runtime struct {
	// contains filtered or unexported fields
}

Runtime owns one immutable Casbin snapshot without global registration, watcher startup, or mutation methods.

func NewRuntime added in v0.6.0 

func NewRuntime(ctx context.Context, config RuntimeConfig) (*Runtime, error)

NewRuntime constructs a standalone immutable authorization runtime without Modular, global registration, mutation methods, or policy watchers.

func (*Runtime) Close added in v0.6.0 

func (r *Runtime) Close() error

Close releases persistent storage and invalidates future operations. It is idempotent and safe to call concurrently with decisions.

func (*Runtime) Decide added in v0.6.0 

func (r *Runtime) Decide(ctx context.Context, request DecisionRequest) (Decision, error)

Decide evaluates one request against the loaded immutable snapshot.

func (*Runtime) Health added in v0.6.0 

func (r *Runtime) Health(ctx context.Context) Health

Health performs a bounded storage ping using the caller's context. It never reloads policy and never gates decisions from a successfully loaded snapshot.

func (*Runtime) Policies added in v0.6.0 

func (r *Runtime) Policies(ctx context.Context) ([]PolicyRule, error)

Policies returns a copy of the deterministic startup policy snapshot.

type RuntimeConfig added in v0.6.0 

type RuntimeConfig struct {
	Model   string
	Storage *StorageConfig
	Seed    *SeedConfig
}

RuntimeConfig configures exactly one immutable policy source.

func (RuntimeConfig) Validate added in v0.6.0 

func (c RuntimeConfig) Validate() error

Validate preserves the storage-mode validation contract published before standalone construction was added. NewRuntime enforces the full config.

type SeedConfig added in v0.6.0 

type SeedConfig struct {
	Policies        [][]string
	RoleAssignments [][]string
}

SeedConfig describes an immutable in-memory policy source.

type StorageColumn added in v0.6.0 

type StorageColumn struct {
	Name     string
	Type     string
	Nullable bool
}

StorageColumn describes one required policy storage column.

type StorageConfig added in v0.6.0 

type StorageConfig struct {
	Driver        string
	DSN           string
	TableName     string
	MigrationMode MigrationMode
}

StorageConfig describes persistent policy storage for a standalone runtime.

type StorageDescriptor added in v0.6.0 

type StorageDescriptor struct {
	Version       int
	Dialect       StorageDialect
	Table         string
	Columns       []StorageColumn
	PrimaryKey    []string
	UniqueIndexes []StorageIndex
}

StorageDescriptor is the complete public policy storage contract.

func StorageSchema added in v0.6.0 

func StorageSchema(tableName string) StorageDescriptor

StorageSchema returns the PostgreSQL schema descriptor for tableName. It is retained as the default production contract; new code may select a supported strict dialect with StorageSchemaForDialect.

func StorageSchemaForDialect added in v0.6.0 

func StorageSchemaForDialect(dialect StorageDialect, tableName string) (StorageDescriptor, error)

StorageSchemaForDialect returns the exact physical schema for a strict validation dialect. PostgreSQL and SQLite are supported; MySQL remains available only through legacy auto migration.

type StorageDialect added in v0.6.0 

type StorageDialect string

StorageDialect identifies a physical database schema supported by strict validation. 

const (
	// StorageDialectPostgres is the production strict-storage dialect.
	StorageDialectPostgres StorageDialect = "postgres"
	// StorageDialectSQLite is supported for embedded consumers and hermetic tests.
	StorageDialectSQLite StorageDialect = "sqlite"
)

type StorageIndex added in v0.6.0 

type StorageIndex struct {
	Name    string
	Columns []string
}

StorageIndex describes one required policy storage index.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.