Documentation
¶
Overview ¶
Package iamx defines Kernel's provider-neutral IAM domain model.
IAM owns users, organizations, groups and memberships inside Kernel. External systems such as Casdoor are adapters or sync sources; business packages must depend on iamx contracts, not on Casdoor object structs or SDK calls.
Index ¶
- Constants
- func ErrConflict(message string) error
- func ErrInvalidArgument(message string) error
- func ErrNotFound(message string) error
- type Attributes
- type Directory
- type Group
- type GroupNode
- type GroupQuery
- type Membership
- type Organization
- type OrganizationQuery
- type Service
- func (s *Service) AddMembership(ctx context.Context, membership Membership) error
- func (s *Service) BuildGroupTree(ctx context.Context, orgID string) ([]GroupNode, error)
- func (s *Service) CreateGroup(ctx context.Context, group Group) (Group, error)
- func (s *Service) CreateOrganization(ctx context.Context, org Organization) (Organization, error)
- func (s *Service) CreateUser(ctx context.Context, user User) (User, error)
- func (s *Service) DeleteGroup(ctx context.Context, orgID, groupID string) error
- func (s *Service) DeleteOrganization(ctx context.Context, orgID string) error
- func (s *Service) DeleteUser(ctx context.Context, orgID, userID string) error
- func (s *Service) Directory() Directory
- func (s *Service) DisableUser(ctx context.Context, orgID, userID string) error
- func (s *Service) EnsureGroup(ctx context.Context, group Group) (Group, error)
- func (s *Service) EnsureOrganization(ctx context.Context, org Organization) (Organization, error)
- func (s *Service) EnsureUser(ctx context.Context, user User) (User, error)
- func (s *Service) GetGroup(ctx context.Context, orgID, groupID string) (Group, error)
- func (s *Service) GetOrganization(ctx context.Context, orgID string) (Organization, error)
- func (s *Service) GetUser(ctx context.Context, orgID, userID string) (User, error)
- func (s *Service) ListEffectiveMemberships(ctx context.Context, orgID, userID string) ([]Membership, error)
- func (s *Service) ListGroupAncestors(ctx context.Context, orgID, groupID string) ([]Group, error)
- func (s *Service) ListGroupDescendants(ctx context.Context, orgID, groupID string) ([]Group, error)
- func (s *Service) ListGroups(ctx context.Context, query GroupQuery) ([]Group, error)
- func (s *Service) ListMemberships(ctx context.Context, orgID, userID string) ([]Membership, error)
- func (s *Service) ListOrganizations(ctx context.Context, query OrganizationQuery) ([]Organization, error)
- func (s *Service) ListUserGroups(ctx context.Context, q UserGroupQuery) ([]Group, error)
- func (s *Service) ListUsers(ctx context.Context, query UserQuery) ([]User, error)
- func (s *Service) RemoveMembership(ctx context.Context, orgID, groupID, userID string) error
- func (s *Service) UpdateGroup(ctx context.Context, group Group) (Group, error)
- func (s *Service) UpdateOrganization(ctx context.Context, org Organization) (Organization, error)
- func (s *Service) UpdateUser(ctx context.Context, user User) (User, error)
- type User
- type UserGroupQuery
- type UserQuery
Constants ¶
const ( CodeInvalidArgument = "IAM_INVALID_ARGUMENT" CodeNotFound = "IAM_NOT_FOUND" CodeConflict = "IAM_CONFLICT" )
const ( ProviderCasdoor = "casdoor" ProviderKernel = "kernel" )
const ( GroupTypePhysical = "physical" GroupTypeVirtual = "virtual" GroupTypeTeam = "team" )
const ( MembershipDirect = "direct" MembershipInherited = "inherited" )
Variables ¶
This section is empty.
Functions ¶
func ErrConflict ¶
func ErrInvalidArgument ¶
func ErrNotFound ¶
Types ¶
type Attributes ¶
type Directory ¶
type Directory interface {
CreateUser(ctx context.Context, user User) (User, error)
GetUser(ctx context.Context, orgID, userID string) (User, error)
ListUsers(ctx context.Context, query UserQuery) ([]User, error)
UpdateUser(ctx context.Context, user User) (User, error)
UpsertUser(ctx context.Context, user User) (User, error)
DisableUser(ctx context.Context, orgID, userID string) error
DeleteUser(ctx context.Context, orgID, userID string) error
CreateOrganization(ctx context.Context, org Organization) (Organization, error)
GetOrganization(ctx context.Context, orgID string) (Organization, error)
ListOrganizations(ctx context.Context, query OrganizationQuery) ([]Organization, error)
UpdateOrganization(ctx context.Context, org Organization) (Organization, error)
UpsertOrganization(ctx context.Context, org Organization) (Organization, error)
DeleteOrganization(ctx context.Context, orgID string) error
CreateGroup(ctx context.Context, group Group) (Group, error)
GetGroup(ctx context.Context, orgID, groupID string) (Group, error)
ListGroups(ctx context.Context, query GroupQuery) ([]Group, error)
UpdateGroup(ctx context.Context, group Group) (Group, error)
UpsertGroup(ctx context.Context, group Group) (Group, error)
DeleteGroup(ctx context.Context, orgID, groupID string) error
ListGroupAncestors(ctx context.Context, orgID, groupID string) ([]Group, error)
ListGroupDescendants(ctx context.Context, orgID, groupID string) ([]Group, error)
AddMembership(ctx context.Context, membership Membership) error
RemoveMembership(ctx context.Context, orgID, groupID, userID string) error
ListMemberships(ctx context.Context, orgID, userID string) ([]Membership, error)
ListEffectiveMemberships(ctx context.Context, orgID, userID string) ([]Membership, error)
}
Directory is the IAM read/write surface for users, orgs, groups and memberships. It is intentionally provider-neutral. Casdoor, DB-backed IAM and hybrid sync implementations must adapt to this interface.
type Group ¶
type Group struct {
ID string
ExternalID string
Provider string
OrgID string
ParentID string
Name string
DisplayName string
Type string
Path string
Enabled bool
Attributes Attributes
CreatedAt time.Time
UpdatedAt time.Time
}
Group models organizational groups/teams. ParentID creates a group tree.
type GroupQuery ¶
type Membership ¶
type Membership struct {
OrgID string
UserID string
GroupID string
RoleIDs []string
Source string
CreatedAt time.Time
}
Membership binds a user to a group. RoleIDs are optional role projections; resource authorization still belongs to authz/accessx.
func (Membership) Normalize ¶
func (m Membership) Normalize() Membership
type Organization ¶
type Organization struct {
ID string
ExternalID string
Provider string
ParentID string
Name string
DisplayName string
OwnerID string
Enabled bool
Attributes Attributes
CreatedAt time.Time
UpdatedAt time.Time
}
Organization models a tenant/org boundary. ParentID allows multi-level orgs.
func (Organization) Normalize ¶
func (o Organization) Normalize() Organization
type OrganizationQuery ¶
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service is Kernel IAM's application-facing facade. Business components should depend on this facade rather than calling authn/casdoor or provider SDKs.
func NewService ¶
func (*Service) AddMembership ¶
func (s *Service) AddMembership(ctx context.Context, membership Membership) error
func (*Service) BuildGroupTree ¶
func (*Service) CreateGroup ¶
func (*Service) CreateOrganization ¶
func (s *Service) CreateOrganization(ctx context.Context, org Organization) (Organization, error)
func (*Service) CreateUser ¶
func (*Service) DeleteGroup ¶
func (*Service) DeleteOrganization ¶
func (*Service) DeleteUser ¶
func (*Service) DisableUser ¶
func (*Service) EnsureGroup ¶
func (*Service) EnsureOrganization ¶
func (s *Service) EnsureOrganization(ctx context.Context, org Organization) (Organization, error)
func (*Service) EnsureUser ¶
func (*Service) GetOrganization ¶
func (*Service) ListEffectiveMemberships ¶
func (*Service) ListGroupAncestors ¶
func (*Service) ListGroupDescendants ¶
func (*Service) ListGroups ¶
func (*Service) ListMemberships ¶
func (*Service) ListOrganizations ¶
func (s *Service) ListOrganizations(ctx context.Context, query OrganizationQuery) ([]Organization, error)
func (*Service) ListUserGroups ¶
func (*Service) RemoveMembership ¶
func (*Service) UpdateGroup ¶
func (*Service) UpdateOrganization ¶
func (s *Service) UpdateOrganization(ctx context.Context, org Organization) (Organization, error)
type User ¶
type User struct {
ID string
ExternalID string
Provider string
OrgID string
Username string
Name string
Email string
Phone string
Enabled bool
Locked bool
Deleted bool
Attributes Attributes
CreatedAt time.Time
UpdatedAt time.Time
}
User is Kernel's canonical user projection. It intentionally keeps fewer fields than Casdoor's object.User and stores provider-specific data under Attributes so the domain model stays stable.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package authnadapter adapts authn.IdentityAdmin providers, such as Casdoor, into Kernel IAM directory contracts.
|
Package authnadapter adapts authn.IdentityAdmin providers, such as Casdoor, into Kernel IAM directory contracts. |