v2

package

v0.6.0 Latest Latest Go to latest Published: Jul 11, 2026 License: MIT Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/GoCodeAlone/workflow-plugin-authz

Links

Open Source Insights

Documentation ¶

Overview ¶

Package v2 exposes the canonical read-only authorization administration API.

Index ¶

Variables
func NewHandler(options Options) (http.Handler, error)
type Authorizer
type Capabilities
type CapabilityDescriptor
type Decision
type DecisionRequest
type Options
type PolicyRule
type Principal
type PrincipalResolver
type Provider
type RoleAssignment

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	// ErrUnauthenticated reports that no trusted principal is available.
	ErrUnauthenticated = errors.New("authz principal is unauthenticated")
	// ErrForbidden reports a legitimate authorization denial.
	ErrForbidden = errors.New("authz request is forbidden")
	// ErrUnavailable reports an identity, authorization, or policy dependency failure.
	ErrUnavailable = errors.New("authz provider is unavailable")
	// ErrInvalidRequest reports invalid caller input.
	ErrInvalidRequest = errors.New("invalid authz request")
)

Functions ¶

func NewHandler ¶

func NewHandler(options Options) (http.Handler, error)

NewHandler returns the canonical read-only v2 authorization admin API.

Types ¶

type Authorizer ¶

type Authorizer interface {
	Authorize(context.Context, Principal, string, string) error
}

Authorizer protects each admin API operation before provider access.

type Capabilities ¶

type Capabilities struct {
	Module              string                 `json:"module"`
	Provider            string                 `json:"provider"`
	Capabilities        []string               `json:"capabilities"`
	Descriptors         []CapabilityDescriptor `json:"capability_descriptors"`
	Health              string                 `json:"health"`
	MissingRequirements []string               `json:"missing_requirements,omitempty"`
}

Capabilities is the provider capability envelope consumed by the admin UI.

type CapabilityDescriptor ¶

type CapabilityDescriptor struct {
	Mode              string   `json:"mode"`
	Operations        []string `json:"operations"`
	Configured        bool     `json:"configured"`
	Source            string   `json:"source"`
	Health            string   `json:"health"`
	UnsupportedReason string   `json:"unsupported_reason,omitempty"`
}

CapabilityDescriptor describes one configured authorization mode.

type Decision ¶

type Decision struct {
	Allowed bool `json:"allowed"`
}

Decision is the result of evaluating the authenticated principal's role.

type DecisionRequest ¶

type DecisionRequest struct {
	Object string `json:"object"`
	Action string `json:"action"`
}

DecisionRequest intentionally excludes subject. Providers derive the effective subject or role from the authenticated Principal.

type Options ¶

type Options struct {
	BasePath          string
	PrincipalResolver PrincipalResolver
	Authorizer        Authorizer
	Provider          Provider
}

Options supplies the host adapters and optional mount path.

type PolicyRule ¶

type PolicyRule struct {
	Subject string `json:"subject"`
	Object  string `json:"object"`
	Action  string `json:"action"`
}

PolicyRule is one immutable direct-role policy row.

type Principal ¶

type Principal struct {
	Subject string `json:"subject"`
	Email   string `json:"email,omitempty"`
	Role    string `json:"role"`
}

Principal is the trusted authenticated identity used for every v2 request.

type PrincipalResolver ¶

type PrincipalResolver interface {
	CurrentPrincipal(*http.Request) (Principal, error)
}

PrincipalResolver resolves a trusted identity from the request.

type Provider ¶

type Provider interface {
	Capabilities(context.Context, Principal) (Capabilities, error)
	RoleAssignments(context.Context, Principal) ([]RoleAssignment, error)
	Policies(context.Context, Principal) ([]PolicyRule, error)
	Decide(context.Context, Principal, DecisionRequest) (Decision, error)
}

Provider supplies the read-only authorization views and decisions.

type RoleAssignment ¶

type RoleAssignment struct {
	User    string   `json:"user"`
	Role    string   `json:"role"`
	Context string   `json:"context,omitempty"`
	Scopes  []string `json:"scopes,omitempty"`
}

RoleAssignment is one host-owned principal-to-role projection.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL