cluster

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 13, 2026 License: AGPL-3.0 Imports: 16 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type GetClusterUseCase 

type GetClusterUseCase struct {
	// contains filtered or unexported fields
}

GetClusterUseCase — reads the singleton cluster row.

func NewGetClusterUseCase 

func NewGetClusterUseCase(r clusterReader) *GetClusterUseCase

NewGetClusterUseCase — constructor.

func (*GetClusterUseCase) Execute 

func (uc *GetClusterUseCase) Execute(ctx context.Context) (domain.Cluster, error)

Execute — returns the singleton cluster (domain.ClusterSingletonID).

type GrantAdminUseCase 

type GrantAdminUseCase struct {
	// contains filtered or unexported fields
}

GrantAdminUseCase — orchestrates GrantAdmin synchronously.

func NewGrantAdminUseCase 

func NewGrantAdminUseCase(
	w grantWriter,
	r grantReader,
	relations relationOutboxEmitter,
	txb service.TxBeginner,
	opsRepo operationRepo,
) *GrantAdminUseCase

NewGrantAdminUseCase — constructor (subject-state guard wired separately via WithSubjectStateReader).

func (*GrantAdminUseCase) Execute 

func (uc *GrantAdminUseCase) Execute(
	ctx context.Context,
	subjectType iamv1.ClusterGrantSubjectType,
	subjectID string,
) (*operationpb.Operation, error)

Execute — sync validation + sync domain mutation + Operation envelope.

func (*GrantAdminUseCase) WithAdminChecker 

func (uc *GrantAdminUseCase) WithAdminChecker(c adminChecker) *GrantAdminUseCase

WithAdminChecker — wires the defense-in-depth ReBAC system_admin gate. Composition-root only (cmd/kaname/wiring.go). nil checker stays fail-closed.

func (*GrantAdminUseCase) WithAuditEmitter 

func (uc *GrantAdminUseCase) WithAuditEmitter(a auditEmitter) *GrantAdminUseCase

WithAuditEmitter — wires the durable audit_outbox emitter. Composition-root only. nil emitter → audit emit is skipped.

func (*GrantAdminUseCase) WithSubjectStateReader 

func (uc *GrantAdminUseCase) WithSubjectStateReader(c subjectStateReader) *GrantAdminUseCase

WithSubjectStateReader — wires the subject-state guard.

type Handler 

type Handler struct {
	iamv1.UnimplementedInternalClusterServiceServer
	// contains filtered or unexported fields
}

Handler implements iamv1.InternalClusterServiceServer.

func NewHandler 

func NewHandler(
	get *GetClusterUseCase,
	grant *GrantAdminUseCase,
	revoke *RevokeAdminUseCase,
	list *ListAdminsUseCase,
) *Handler

NewHandler assembles the Handler from the four use-cases. Composition root: cmd/kaname/wiring.go.

func (*Handler) Get 

func (h *Handler) Get(ctx context.Context, _ *iamv1.GetClusterRequest) (*iamv1.Cluster, error)

Get — returns the singleton cluster row.

func (*Handler) GrantAdmin 

func (h *Handler) GrantAdmin(ctx context.Context, req *iamv1.GrantClusterAdminRequest) (*operationpb.Operation, error)

GrantAdmin — grants cluster-admin authority to a subject (synchronous).

REST default: `DELETE /iam/v1/internal/cluster/admins/{subject_id}` and `POST /iam/v1/internal/cluster/admins` URL patterns don't carry subject_type — REST clients (UI/curl) typically omit it, defaulting to UNSPECIFIED. Since USER is the only supported value in this version (per validation in use-case), substitute UNSPECIFIED → USER here so REST callers don't see 400 "only 'user' supported".

func (*Handler) ListAdmins 

func (h *Handler) ListAdmins(ctx context.Context, _ *iamv1.ListClusterAdminsRequest) (*iamv1.ListClusterAdminsResponse, error)

ListAdmins — returns all currently-active cluster admin entries.

func (*Handler) RevokeAdmin 

func (h *Handler) RevokeAdmin(ctx context.Context, req *iamv1.RevokeClusterAdminRequest) (*operationpb.Operation, error)

RevokeAdmin — revokes cluster-admin authority from a subject (synchronous). Same UNSPECIFIED → USER default as GrantAdmin (REST URL only carries id).

type ListAdminsUseCase 

type ListAdminsUseCase struct {
	// contains filtered or unexported fields
}

ListAdminsUseCase — reads all active cluster admin grants.

func NewListAdminsUseCase 

func NewListAdminsUseCase(r grantReader) *ListAdminsUseCase

NewListAdminsUseCase — constructor.

func (*ListAdminsUseCase) Execute 

func (uc *ListAdminsUseCase) Execute(ctx context.Context) ([]domain.ClusterAdminEntry, error)

Execute — returns the slice of active ClusterAdminEntry rows.

type RevokeAdminUseCase 

type RevokeAdminUseCase struct {
	// contains filtered or unexported fields
}

RevokeAdminUseCase — orchestrates RevokeAdmin synchronously.

func NewRevokeAdminUseCase 

func NewRevokeAdminUseCase(
	w grantWriter,
	relations relationOutboxEmitter,
	txb service.TxBeginner,
	opsRepo operationRepo,
) *RevokeAdminUseCase

NewRevokeAdminUseCase — constructor.

func (*RevokeAdminUseCase) Execute 

func (uc *RevokeAdminUseCase) Execute(
	ctx context.Context,
	subjectType iamv1.ClusterGrantSubjectType,
	subjectID string,
) (*operationpb.Operation, error)

Execute — sync validation + sync domain mutation + Operation envelope.

func (*RevokeAdminUseCase) WithAdminChecker 

func (uc *RevokeAdminUseCase) WithAdminChecker(c adminChecker) *RevokeAdminUseCase

WithAdminChecker — wires the defense-in-depth ReBAC system_admin gate. Composition-root only (cmd/kaname/wiring.go). nil checker stays fail-closed.

func (*RevokeAdminUseCase) WithAuditEmitter 

func (uc *RevokeAdminUseCase) WithAuditEmitter(a auditEmitter) *RevokeAdminUseCase

WithAuditEmitter — wires the durable audit_outbox emitter. Composition-root only. nil emitter → audit emit is skipped.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.