auth

type APIKeyValidator struct {
	// contains filtered or unexported fields
}

type Action string

type Authorizer interface {
	// Check returns nil if the principal may perform the action on the topic.
	Check(ctx context.Context, principal *Principal, topicID string, action Action) error

	// AccessibleTopics returns the set of topic IDs the principal can access
	// with at least the given permission level.
	AccessibleTopics(ctx context.Context, principal *Principal, minAction Action) ([]string, error)
}

type Grant struct {
	TopicID    string
	Principal  string
	Permission Action
}

type GrantAuthorizer struct {
	// contains filtered or unexported fields
}

type GrantStore interface {
	// GrantsForPrincipal returns all grants matching the principal ID or any of its groups.
	GrantsForPrincipal(ctx context.Context, principals []string) ([]Grant, error)

	// TopicOwner returns the owner of a topic.
	TopicOwner(ctx context.Context, topicID string) (string, error)

	// TopicIDsByOwner returns the IDs of all topics owned by the given principal.
	TopicIDsByOwner(ctx context.Context, ownerID string) ([]string, error)
}

type KeyLookup interface {
	// LookupKeyHash returns the principal for the given key hash, or empty if not found.
	LookupKeyHash(ctx context.Context, hash string) (*Principal, error)
}

type OIDCValidator struct {
	// contains filtered or unexported fields
}

type Principal struct {
	// ID is the unique identifier (e.g. "user:alice@example.com" or "system:bootstrap").
	ID string
	// Groups are the group memberships (e.g. ["group:engineering"]).
	Groups []string
	// IsSystem is true for system accounts authenticated via API key.
	IsSystem bool
}