authz

type AttributeSet map[string]any

type AuditRecordBuilder func(req CheckRequest, decision Decision, checkErr error) auditx.Record

type AuditedAuthorizer struct {
	Next       Authorizer
	Recorder   auditx.Recorder
	Builder    AuditRecordBuilder
	FailClosed bool
}

type AuditedAuthorizerOption func(*AuditedAuthorizer)

type Authorizer interface {
	Check(ctx context.Context, req CheckRequest) (Decision, error)
}

type BatchAuthorizer interface {
	BatchCheck(ctx context.Context, req BatchCheckRequest) (BatchCheckResult, error)
}

type BatchCheckRequest struct {
	Checks      []CheckRequest
	Consistency Consistency
}

type BatchCheckResult struct {
	Decisions []Decision
}

type CheckRequest struct {
	Subject    SubjectRef
	Resource   ObjectRef
	Permission string

	TenantID  string
	OrgID     string
	ProjectID string

	SubjectAttrs     AttributeSet
	ResourceAttrs    AttributeSet
	EnvironmentAttrs AttributeSet
	Consistency      Consistency
}

type Consistency struct {
	Mode  ConsistencyMode
	Token string
}

type ConsistencyMode string

type Decision struct {
	// Effect preserves the important difference between explicit deny and no
	// matching relationship/policy. Allowed is kept for ergonomic callers and
	// backwards-compatible checks.
	Effect           DecisionEffect
	Allowed          bool
	Reason           string
	ConsistencyToken string
	Partial          bool
	MissingContext   []string
}

type DecisionEffect string

type LookupResourcesRequest struct {
	Subject      SubjectRef
	ResourceType string
	Permission   string

	TenantID  string
	OrgID     string
	ProjectID string

	SubjectAttrs     AttributeSet
	EnvironmentAttrs AttributeSet
	Consistency      Consistency
	Limit            int
	Cursor           string
}

type LookupResourcesResult struct {
	Resources        []ObjectRef
	NextCursor       string
	ConsistencyToken string
}

type LookupSubjectsRequest struct {
	Resource    ObjectRef
	Permission  string
	SubjectType string

	TenantID  string
	OrgID     string
	ProjectID string

	ResourceAttrs    AttributeSet
	EnvironmentAttrs AttributeSet
	Consistency      Consistency
	Limit            int
	Cursor           string
}

type LookupSubjectsResult struct {
	Subjects         []SubjectRef
	NextCursor       string
	ConsistencyToken string
}

type MemoryAuthorizer struct{ Store RelationshipReader }

type MemoryRelationshipStore struct {
	// contains filtered or unexported fields
}

type ObjectRef struct {
	Type string
	ID   string
}

type Relationship struct {
	Resource      ObjectRef
	Relation      string
	Subject       SubjectRef
	CaveatName    string
	CaveatContext AttributeSet

	// ExpiresAt supports time-limited sharing and temporary grants. For SpiceDB
	// adapters this can be implemented with relationship expiration when
	// available, or encoded as a caveat otherwise. Zero means no expiry.
	ExpiresAt time.Time
}

type RelationshipFilter struct {
	ResourceType string
	ResourceID   string
	Relation     string
	SubjectType  string
	SubjectID    string
	SubjectRel   string
}

type RelationshipProjector interface {
	ProjectRelationships(ctx context.Context, event any) ([]Relationship, error)
}

type RelationshipReader interface {
	ReadRelationships(ctx context.Context, filter RelationshipFilter) ([]Relationship, error)
}

type RelationshipStore interface {
	RelationshipWriter
	RelationshipReader
}

type RelationshipWriter interface {
	WriteRelationships(ctx context.Context, relationships ...Relationship) (WriteResult, error)
	DeleteRelationships(ctx context.Context, filter RelationshipFilter) (WriteResult, error)
}

type ResourceLookup interface {
	LookupResources(ctx context.Context, req LookupResourcesRequest) (LookupResourcesResult, error)
}

type Schema struct {
	Text    string
	Version string
}

type SchemaManager interface {
	ReadSchema(ctx context.Context) (Schema, error)
	WriteSchema(ctx context.Context, schema Schema) error
	ValidateSchema(ctx context.Context, schema Schema) error
}

type Service interface {
	Authorizer
	BatchAuthorizer
	ResourceLookup
	SubjectLookup
	RelationshipStore
	SchemaManager
}

type SubjectLookup interface {
	LookupSubjects(ctx context.Context, req LookupSubjectsRequest) (LookupSubjectsResult, error)
}

type SubjectRef struct {
	Type     string
	ID       string
	Relation string
}

type WriteResult struct {
	ConsistencyToken string
	Written          int
	Deleted          int
}