authz

May 11, 2026

Changes in this version

type AuthzRule

+ Action string

+ ResourceIDField string

+ ResourceType string

type CheckRequest

+ Action string

+ Attributes map[string]any

+ ResourceID string

+ ResourceType string

type Option

+ func WithAuditOnDeny(auditor audit.Auditor) Option

+ func WithDefaultResourceID(id string) Option

+ func WithSubjectFunc(fn func(context.Context) (string, bool)) Option

May 6, 2026

Changes in this version

type Option

+ func WithObserver(fn func(ctx context.Context, detail DecisionDetail)) Option

May 3, 2026

Changes in this version

+ func NewAuthzBridge(recorder *audit.Recorder) func(context.Context, DecisionDetail)

type Authorizer

+ BatchCheck func(ctx context.Context, reqs []CheckRequest) ([]CheckResult, error)

+ Check func(ctx context.Context, subject, relation, objectType, objectID string) (allowed bool, err error)

+ ListAllowed func(ctx context.Context, subject, relation, objectType string) ([]string, error)

+ type CheckRequest struct

+ ObjectID string

+ ObjectType string

+ Relation string

+ Subject string

+ type CheckResult struct

+ Allowed bool

+ Err error

type Option

+ func WithCheckTimeout(d time.Duration) Option

+ func WithFailOpenOnMissingRule(alertFn func(ctx context.Context, operation string)) Option

Mar 26, 2026

Changes in this version

+ func MergeRules(maps ...map[string]AuthzRule) map[string]AuthzRule

+ func Server(authorizer Authorizer, opts ...Option) middleware.Middleware

+ type Authorizer interface

+ IsAuthorized func(ctx context.Context, subject, relation, objectType, objectID string) (allowed bool, err error)

+ type AuthzRule struct

+ IDField string

+ Mode authzpb.AuthzMode

+ ObjectType string

+ Relation string

+ type DecisionDetail struct

+ Allowed bool

+ CacheHit bool

+ Err error

+ ObjectID string

+ ObjectType string

+ Operation string

+ Relation string

+ Subject string

+ type Option func(*serverConfig)

+ func WithDecisionLogger(fn func(ctx context.Context, detail DecisionDetail)) Option

+ func WithDefaultObjectID(id string) Option

+ func WithRules(rules map[string]AuthzRule) Option

+ func WithRulesFunc(fn func() map[string]AuthzRule) Option

+ func WithRulesFuncs(fns ...func() map[string]AuthzRule) Option