internal

Jul 11, 2026

Changes in this version

+ const StorageSchemaVersion

+ func IsStorageValidationError(err error) bool

+ func ValidateMigrationMode(mode MigrationMode) error

+ func ValidateStorage(ctx context.Context, db *gorm.DB, tableName string) error

type CasbinModule

+ func (m *CasbinModule) CloseStorage() error

+ func (m *CasbinModule) InitContext(ctx context.Context) error

+ func (m *CasbinModule) PingStorage(ctx context.Context) (bool, error)

+ func (m *CasbinModule) PolicySnapshot() ([][]string, error)

+ type MigrationMode string

+ const MigrationModeAuto

+ const MigrationModeValidate

+ func DecodeMigrationMode(raw map[string]any) (MigrationMode, error)

+ type StorageColumn struct

+ Name string

+ Nullable bool

+ Type string

+ type StorageDescriptor struct

+ Columns []StorageColumn

+ Dialect StorageDialect

+ PrimaryKey []string

+ Table string

+ UniqueIndexes []StorageIndex

+ Version int

+ func StorageSchema(tableName string) StorageDescriptor

+ func StorageSchemaForDialect(dialect StorageDialect, tableName string) (StorageDescriptor, error)

+ type StorageDialect string

+ const StorageDialectPostgres

+ const StorageDialectSQLite

+ type StorageIndex struct

+ Columns []string

+ Name string

May 27, 2026

Changes in this version

+ func RegisterAuthzProvider(name string, provider AuthzProvider)

+ type AssignmentFilter struct

+ Context string

+ Role string

+ Subject string

+ type AttributeCheck struct

+ Action string

+ Context string

+ EnvironmentAttributes map[string]string

+ Resource string

+ ResourceAttributes map[string]string

+ Subject string

+ SubjectAttributes map[string]string

+ type AttributeCheckResult struct

+ Action string

+ Allowed bool

+ Context string

+ MatchedPolicyID string

+ Reason string

+ Resource string

+ Subject string

+ type AttributeCondition struct

+ Attribute string

+ Operator string

+ Target string

+ Values []string

+ type AttributePolicy struct

+ Action string

+ Conditions []AttributeCondition

+ Context string

+ Description string

+ Effect string

+ ID string

+ OwnerModule string

+ OwnerPlugin string

+ Resource string

+ type AttributePolicyFilter struct

+ Action string

+ Context string

+ ID string

+ OwnerModule string

+ OwnerPlugin string

+ Resource string

+ type AttributePolicyProvider interface

+ CheckAttributes func(context.Context, AttributeCheck) (AttributeCheckResult, error)

+ DeclareAttributes func(context.Context, []*contracts.AttributeDeclaration) error

+ ListAttributePolicies func(context.Context, AttributePolicyFilter) ([]AttributePolicy, error)

+ Name func() string

+ RemoveAttributePolicy func(context.Context, AttributePolicyFilter) error

+ UpsertAttributePolicy func(context.Context, AttributePolicy) error

+ type AuthorizationDecisionInput struct

+ Action string

+ Context string

+ EnvironmentAttributes map[string]string

+ Explain bool

+ Mode AuthzCapability

+ Provider string

+ Relation string

+ Resource string

+ ResourceAttributes map[string]string

+ Scope string

+ Subject string

+ SubjectAttributes map[string]string

+ type AuthorizationDecisionOutput struct

+ Allowed bool

+ Context string

+ Explain string

+ Mode AuthzCapability

+ Reason string

+ Subject string

+ func DecideAuthorization(ctx context.Context, provider any, input AuthorizationDecisionInput) (AuthorizationDecisionOutput, error)

+ type AuthzOperation string

+ const OperationCheck

+ const OperationList

+ const OperationManagePolicies

+ const OperationManageRelations

+ const OperationManageRoles

type AuthzProvider

+ CapabilityDescriptors func() []CapabilityDescriptor

+ RequireCapabilities func([]CapabilityRequirement) error

+ type CapabilityDescriptor struct

+ Configured bool

+ Health string

+ Mode AuthzCapability

+ Operations []AuthzOperation

+ Source string

+ UnsupportedReason string

+ type CapabilityRequirement struct

+ Mode AuthzCapability

+ Operations []AuthzOperation

type CasbinModule

+ func (m *CasbinModule) AssignRole(ctx context.Context, assignment SubjectRoleAssignment) error

+ func (m *CasbinModule) CapabilityDescriptors() []CapabilityDescriptor

+ func (m *CasbinModule) CheckAttributes(ctx context.Context, check AttributeCheck) (AttributeCheckResult, error)

+ func (m *CasbinModule) CheckRelation(ctx context.Context, check RelationCheck) (RelationCheckResult, error)

+ func (m *CasbinModule) CheckScope(ctx context.Context, check ScopeCheck) (ScopeCheckResult, error)

+ func (m *CasbinModule) DeclareAttributes(ctx context.Context, attrs []*contracts.AttributeDeclaration) error

+ func (m *CasbinModule) DeclareScopes(ctx context.Context, scopes []*contracts.ScopeDeclaration) error

+ func (m *CasbinModule) InvokeMethod(method string, input map[string]any) (map[string]any, error)

+ func (m *CasbinModule) ListAssignments(ctx context.Context, filter AssignmentFilter) ([]SubjectRoleAssignment, error)

+ func (m *CasbinModule) ListAttributePolicies(ctx context.Context, filter AttributePolicyFilter) ([]AttributePolicy, error)

+ func (m *CasbinModule) ListRelationTuples(_ context.Context, filter RelationTupleFilter) ([]RelationTuple, error)

+ func (m *CasbinModule) RemoveAssignment(ctx context.Context, assignment SubjectRoleAssignment) error

+ func (m *CasbinModule) RemoveAttributePolicy(ctx context.Context, filter AttributePolicyFilter) error

+ func (m *CasbinModule) RemoveRelationTuple(_ context.Context, tuple RelationTuple) error

+ func (m *CasbinModule) RequireCapabilities(requirements []CapabilityRequirement) error

+ func (m *CasbinModule) UpsertAttributePolicy(ctx context.Context, policy AttributePolicy) error

+ func (m *CasbinModule) UpsertRelationTuple(_ context.Context, tuple RelationTuple) error

+ func (m *CasbinModule) UpsertRole(ctx context.Context, grant RoleScopeGrant) error

+ type KetoModule struct

+ func (m *KetoModule) AssignRole(ctx context.Context, assignment SubjectRoleAssignment) error

+ func (m *KetoModule) Capabilities() []AuthzCapability

+ func (m *KetoModule) CapabilityDescriptors() []CapabilityDescriptor

+ func (m *KetoModule) CheckRelation(ctx context.Context, check RelationCheck) (RelationCheckResult, error)

+ func (m *KetoModule) CheckScope(ctx context.Context, check ScopeCheck) (ScopeCheckResult, error)

+ func (m *KetoModule) DeclareScopes(ctx context.Context, scopes []*contracts.ScopeDeclaration) error

+ func (m *KetoModule) Init() error

+ func (m *KetoModule) InvokeMethod(method string, input map[string]any) (map[string]any, error)

+ func (m *KetoModule) ListAssignments(ctx context.Context, filter AssignmentFilter) ([]SubjectRoleAssignment, error)

+ func (m *KetoModule) ListRelationTuples(ctx context.Context, filter RelationTupleFilter) ([]RelationTuple, error)

+ func (m *KetoModule) Name() string

+ func (m *KetoModule) RemoveAssignment(ctx context.Context, assignment SubjectRoleAssignment) error

+ func (m *KetoModule) RemoveRelationTuple(ctx context.Context, tuple RelationTuple) error

+ func (m *KetoModule) RequireCapabilities(requirements []CapabilityRequirement) error

+ func (m *KetoModule) Start(_ context.Context) error

+ func (m *KetoModule) Stop(_ context.Context) error

+ func (m *KetoModule) SupportsCapability(cap AuthzCapability) bool

+ func (m *KetoModule) UpsertRelationTuple(ctx context.Context, tuple RelationTuple) error

+ func (m *KetoModule) UpsertRole(ctx context.Context, grant RoleScopeGrant) error

type PermitModule

+ func (m *PermitModule) AssignRole(ctx context.Context, assignment SubjectRoleAssignment) error

+ func (m *PermitModule) CapabilityDescriptors() []CapabilityDescriptor

+ func (m *PermitModule) CheckAttributes(_ context.Context, check AttributeCheck) (AttributeCheckResult, error)

+ func (m *PermitModule) CheckRelation(_ context.Context, check RelationCheck) (RelationCheckResult, error)

+ func (m *PermitModule) CheckScope(ctx context.Context, check ScopeCheck) (ScopeCheckResult, error)

+ func (m *PermitModule) DeclareAttributes(context.Context, []*contracts.AttributeDeclaration) error

+ func (m *PermitModule) DeclareScopes(ctx context.Context, scopes []*contracts.ScopeDeclaration) error

+ func (m *PermitModule) InvokeMethod(method string, input map[string]any) (map[string]any, error)

+ func (m *PermitModule) ListAssignments(ctx context.Context, filter AssignmentFilter) ([]SubjectRoleAssignment, error)

+ func (m *PermitModule) ListAttributePolicies(context.Context, AttributePolicyFilter) ([]AttributePolicy, error)

+ func (m *PermitModule) ListRelationTuples(context.Context, RelationTupleFilter) ([]RelationTuple, error)

+ func (m *PermitModule) RemoveAssignment(ctx context.Context, assignment SubjectRoleAssignment) error

+ func (m *PermitModule) RemoveAttributePolicy(context.Context, AttributePolicyFilter) error

+ func (m *PermitModule) RemoveRelationTuple(context.Context, RelationTuple) error

+ func (m *PermitModule) RequireCapabilities(requirements []CapabilityRequirement) error

+ func (m *PermitModule) UpsertAttributePolicy(context.Context, AttributePolicy) error

+ func (m *PermitModule) UpsertRelationTuple(context.Context, RelationTuple) error

+ func (m *PermitModule) UpsertRole(ctx context.Context, grant RoleScopeGrant) error

+ type RelationCheck struct

+ Context string

+ Object string

+ Relation string

+ Subject string

+ type RelationCheckResult struct

+ Allowed bool

+ Context string

+ Object string

+ Reason string

+ Relation string

+ Subject string

+ type RelationTuple struct

+ Context string

+ Object string

+ Relation string

+ Subject string

+ type RelationTupleFilter struct

+ Context string

+ Object string

+ Relation string

+ Subject string

+ type RelationshipProvider interface

+ CheckRelation func(context.Context, RelationCheck) (RelationCheckResult, error)

+ ListRelationTuples func(context.Context, RelationTupleFilter) ([]RelationTuple, error)

+ Name func() string

+ RemoveRelationTuple func(context.Context, RelationTuple) error

+ UpsertRelationTuple func(context.Context, RelationTuple) error

+ type RoleScopeGrant struct

+ Context string

+ Role string

+ Scopes []string

+ type ScopeCheck struct

+ Action string

+ Context string

+ Resource string

+ Scope string

+ Subject string

+ type ScopeCheckResult struct

+ Allowed bool

+ Context string

+ MatchedRole string

+ MatchedScopes []string

+ Provider string

+ Reason string

+ Scope string

+ Subject string

+ type ScopeRoleProvider interface

+ AssignRole func(context.Context, SubjectRoleAssignment) error

+ CheckScope func(context.Context, ScopeCheck) (ScopeCheckResult, error)

+ DeclareScopes func(context.Context, []*contracts.ScopeDeclaration) error

+ ListAssignments func(context.Context, AssignmentFilter) ([]SubjectRoleAssignment, error)

+ Name func() string

+ RemoveAssignment func(context.Context, SubjectRoleAssignment) error

+ UpsertRole func(context.Context, RoleScopeGrant) error

+ type SubjectRoleAssignment struct

+ Context string

+ DirectScopes []string

+ Role string

+ Subject string

Apr 22, 2026

Changes in this version

+ var Version = "dev"

Mar 21, 2026

Changes in this version

+ func GetPermitClient(name string) (*permitClient, bool)

+ func NewAuthzPlugin() sdk.PluginProvider

+ func RegisterModule(m *CasbinModule)

+ func RegisterPermitClient(name string, c *permitClient)

+ func UnregisterPermitClient(name string)

+ type AuthzCapability string

+ const CapabilityABAC

+ const CapabilityACL

+ const CapabilityRBAC

+ const CapabilityReBAC

+ type AuthzProvider interface

+ Capabilities func() []AuthzCapability

+ SupportsCapability func(AuthzCapability) bool

+ type CasbinModule struct

+ func NewCasbinModuleFromConfig(name string, config map[string]any) (*CasbinModule, error)

+ func (m *CasbinModule) AddGroupingPolicy(rule []string) (bool, error)

+ func (m *CasbinModule) AddPolicy(rule []string) (bool, error)

+ func (m *CasbinModule) Capabilities() []AuthzCapability

+ func (m *CasbinModule) Enforce(sub, obj, act string, extra ...string) (bool, error)

+ func (m *CasbinModule) Init() error

+ func (m *CasbinModule) Name() string

+ func (m *CasbinModule) RemoveGroupingPolicy(rule []string) (bool, error)

+ func (m *CasbinModule) RemovePolicy(rule []string) (bool, error)

+ func (m *CasbinModule) Start(_ context.Context) error

+ func (m *CasbinModule) Stop(_ context.Context) error

+ func (m *CasbinModule) SupportsCapability(cap AuthzCapability) bool

+ type GORMFilter struct

+ Field string

+ Value string

+ type PermitModule struct

+ func NewPermitModuleFromConfig(name string, config map[string]any) (*PermitModule, error)

+ func (m *PermitModule) Capabilities() []AuthzCapability

+ func (m *PermitModule) Init() error

+ func (m *PermitModule) Name() string

+ func (m *PermitModule) Start(_ context.Context) error

+ func (m *PermitModule) Stop(_ context.Context) error

+ func (m *PermitModule) SupportsCapability(cap AuthzCapability) bool

+ type StepExecutor interface

+ Execute func(ctx context.Context, triggerData map[string]any, ...) (*sdk.StepResult, error)

+ func NewAddPolicyStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzABACAddPolicyStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzABACCheckStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzACLCheckStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzACLGrantStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzACLListStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzACLRevokeStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzCapabilitiesStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzReBACAddRelationStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzReBACCheckStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzReBACListRelationsStep(name string, config map[string]any) (StepExecutor, error)

+ func NewAuthzReBACRemoveRelationStep(name string, config map[string]any) (StepExecutor, error)

+ func NewCasbinCheckStep(name string, config map[string]any) (StepExecutor, error)

+ func NewPermitCheckBulkStep(name string, config map[string]any) (StepExecutor, error)

+ func NewPermitCheckStep(name string, config map[string]any) (StepExecutor, error)

+ func NewPermitRoleAssignStep(name string, config map[string]any) (StepExecutor, error)

+ func NewPermitRoleUnassignStep(name string, config map[string]any) (StepExecutor, error)

+ func NewPermitUserSyncStep(name string, config map[string]any) (StepExecutor, error)

+ func NewRemovePolicyStep(name string, config map[string]any) (StepExecutor, error)

+ func NewRoleAssignStep(name string, config map[string]any) (StepExecutor, error)