Documentation
¶
Index ¶
- Constants
- func InvalidateCheck(ctx context.Context, rdb *redis.Client, ...)
- func InvalidateListObjects(ctx context.Context, rdb *redis.Client, user, relation, objectType string)
- type Client
- func (c *Client) CachedCheck(ctx context.Context, rdb *redis.Client, ttl time.Duration, ...) (allowed bool, cacheHit bool, err error)
- func (c *Client) CachedListObjects(ctx context.Context, rdb *redis.Client, ttl time.Duration, ...) ([]string, error)
- func (c *Client) Check(ctx context.Context, user, relation, objectType, objectID string) (bool, error)
- func (c *Client) DeleteTuples(ctx context.Context, tuples ...Tuple) error
- func (c *Client) EnsureTuples(ctx context.Context, tuples ...Tuple) error
- func (c *Client) InvalidateForTuples(ctx context.Context, rdb *redis.Client, tuples []Tuple)
- func (c *Client) ListObjects(ctx context.Context, user, relation, objectType string) ([]string, error)
- func (c *Client) TupleExists(ctx context.Context, t Tuple) (bool, error)
- func (c *Client) WriteTuples(ctx context.Context, tuples ...Tuple) error
- type ClientOption
- type Tuple
Constants ¶
const ( DefaultCheckCacheTTL = 60 * time.Second DefaultListCacheTTL = 10 * time.Minute )
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client wraps the OpenFGA SDK client with caching, audit, and framework integration.
func NewClient ¶
func NewClient(cfg *conf.App_OpenFGA, opts ...ClientOption) (*Client, error)
NewClient creates a new OpenFGA client from the given configuration.
func NewClientOptional ¶
NewClientOptional creates an OpenFGA client when the app configuration contains valid OpenFGA settings, returning nil (instead of an error) when the component is not configured or initialisation fails. This allows services to start without OpenFGA for local development or environments where authorisation is not required.
func (*Client) CachedCheck ¶
func (c *Client) CachedCheck(ctx context.Context, rdb *redis.Client, ttl time.Duration, user, relation, objectType, objectID string) (allowed bool, cacheHit bool, err error)
CachedCheck is like Check but caches results in Redis. If the Redis client is nil the call degrades to a plain Check. The second return value indicates whether the result was served from cache.
func (*Client) CachedListObjects ¶
func (c *Client) CachedListObjects(ctx context.Context, rdb *redis.Client, ttl time.Duration, user, relation, objectType string) ([]string, error)
CachedListObjects is like ListObjects but caches the full ID list in Redis. Subsequent calls within the TTL window return the cached result, avoiding repeated OpenFGA round-trips. Returns all IDs; the caller is responsible for pagination.
func (*Client) Check ¶
func (c *Client) Check(ctx context.Context, user, relation, objectType, objectID string) (bool, error)
Check returns whether the given principal (e.g. "user:uuid") has the specified relation on objectType:objectID.
func (*Client) DeleteTuples ¶
DeleteTuples deletes one or more relationship tuples atomically and emits an audit event on success when a recorder is configured.
func (*Client) EnsureTuples ¶
EnsureTuples writes each tuple only if it does not already exist. It is safe to call repeatedly (idempotent) and does not rely on error message text matching.
func (*Client) InvalidateForTuples ¶
InvalidateForTuples invalidates all cached Check and ListObjects entries that could be affected by the given tuples. This should be called after WriteTuples or DeleteTuples to keep the cache consistent.
For each tuple it invalidates:
- The exact Check cache entry (user + relation + object)
- The ListObjects cache for the user on the object's type with the tuple's relation
- Additional computed relations as configured via WithComputedRelations
func (*Client) ListObjects ¶
func (c *Client) ListObjects(ctx context.Context, user, relation, objectType string) ([]string, error)
ListObjects returns the IDs of objects of the given type that the principal (e.g. "user:uuid") has the specified relation to. The returned strings are bare IDs (i.e. the "type:" prefix is stripped).
func (*Client) TupleExists ¶
TupleExists reports whether the exact tuple already exists in the store.
type ClientOption ¶
type ClientOption func(*clientOptions)
ClientOption configures optional Client behaviour.
func WithAuditRecorder ¶
func WithAuditRecorder(r *audit.Recorder) ClientOption
WithAuditRecorder injects an audit recorder for tuple-change and check events. Passing nil is safe and disables audit emission.
func WithComputedRelations ¶
func WithComputedRelations(m map[string][]string) ClientOption
WithComputedRelations provides a mapping from object-type to computed relations used for cache invalidation. When a tuple with a given object-type is written/deleted, all listed relations are also invalidated.
Source Files