accessx

type AccessConfig struct {
	// SkipOperations lists operations that should skip the SpiceDB
	// authorization check but still require authentication and record audit.
	// Each entry can be a short method name (e.g. "GetMe"), a full gRPC
	// method name (e.g. "iam.v1.IAMAuthService/GetMe"), or an HTTP path
	// (e.g. "/v1/iam/control-plane/orgs").
	//
	// This is the recommended replacement for the deprecated AllowAllOperations.
	SkipOperations []string `json:"skip_operations" yaml:"skip_operations"`

	// PublicOperations lists operations that skip both authentication AND
	// authorization. Use for endpoints that must be accessible without any
	// credentials (health checks, login, token exchange, etc.). Guard.Require
	// still records audit with an anonymous actor.
	//
	// Each entry follows the same matching rules as SkipOperations.
	PublicOperations []string `json:"public_operations" yaml:"public_operations"`

	// AllowAllOperations lists operations where any authenticated user is
	// allowed. This is the legacy field — new deployments should use
	// SkipOperations instead.
	//
	// Deprecated: Use SkipOperations instead.
	AllowAllOperations []string `json:"allow_all_operations" yaml:"allow_all_operations"`
}

type AccessRule struct {
	ID           string               `json:"id" yaml:"id"`
	Authn        AuthnMode            `json:"authn" yaml:"authn"`
	Permission   string               `json:"permission" yaml:"permission"`
	Resource     ResourceResolverSpec `json:"resource" yaml:"resource"`
	Subject      SubjectResolverSpec  `json:"subject" yaml:"subject"`
	ShortCircuit ShortCircuitSpec     `json:"short_circuit" yaml:"short_circuit"`
	Audit        AuditSpec            `json:"audit" yaml:"audit"`
}

type AuditSpec struct {
	Action string `json:"action" yaml:"action"`
	Level  string `json:"level" yaml:"level"`
}

type AuthnMode string

type Check struct {
	Credential authn.Credential
	Principal  authn.Principal

	Permission string
	Resource   authz.ObjectRef

	// SkipPolicy controls whether authorization (and optionally authentication)
	// is skipped. The default (SkipDefault) performs the full authn+authz check.
	// When set to SkipAuthz, the Guard skips the SpiceDB check but still
	// authenticates and records audit. When set to SkipAll, both authentication
	// and authorization are skipped.
	//
	// If SkipPolicy is SkipDefault, the deprecated AuthzMode and AllowAll fields
	// are checked for backward compatibility.
	SkipPolicy SkipPolicy

	// AuthzMode controls whether SpiceDB authorization is required.
	// Use AuthzModeNone for operations like CreateOrganization where the
	// target resource does not yet exist in the authorization graph.
	//
	// Deprecated: Use SkipPolicy=SkipAuthz instead.
	AuthzMode AuthzMode

	// AllowAll grants access to every authenticated principal when true.
	// This is useful for self-service operations (e.g. CreateOrganization,
	// CreateProject) where any authenticated user should be allowed.
	// When AllowAll is true, AuthzMode is implicitly AuthzModeNone.
	// This can be made configurable per deployment via platform policy.
	//
	// Deprecated: Use SkipPolicy=SkipAuthz instead.
	AllowAll bool

	TenantID  string
	OrgID     string
	ProjectID string

	SubjectAttrs     authz.AttributeSet
	ResourceAttrs    authz.AttributeSet
	EnvironmentAttrs authz.AttributeSet
	Consistency      authz.Consistency

	AuditAction string
	RequestID   string
	TraceID     string
	ClientIP    string
	UserAgent   string
	Metadata    auditx.AttributeSet
}

type Guard struct {
	// Authn is retained only as a legacy fallback for callers that still pass
	// credentials directly to accessx.Check. The primary framework path is:
	// middleware/authn authenticates first, injects authn.Principal into context,
	// then accessx consumes Check.Principal. New services should not rely on this
	// field for the normal request path.
	Authn authn.Authenticator
	Authz authz.Authorizer
	Audit auditx.Recorder
}

type Providers struct {
	Authn authn.ProviderSet
	Authz authz.ProviderSet
	Audit auditx.Recorder
}

type ResourceResolverSpec struct {
	Type     string `json:"type" yaml:"type"`
	StaticID string `json:"static_id" yaml:"static_id"`
	IDFrom   string `json:"id_from" yaml:"id_from"`
}

type ShortCircuitMode string

type ShortCircuitSpec struct {
	Mode   ShortCircuitMode `json:"mode" yaml:"mode"`
	Reason string           `json:"reason" yaml:"reason"`
}

type SkipPolicy string

type SkipPolicyResolver func(operation string) SkipPolicy

type SubjectResolverSpec struct {
	Type     string `json:"type" yaml:"type"`
	IDFrom   string `json:"id_from" yaml:"id_from"`
	Relation string `json:"relation" yaml:"relation"`
}