iamx

package
v0.2.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 2, 2026 License: MIT Imports: 4 Imported by: 0

Documentation

Overview

Package iamx defines Kernel's provider-neutral IAM domain model.

IAM owns users, organizations, groups and memberships inside Kernel. External systems such as Casdoor are adapters or sync sources; business packages must depend on iamx contracts, not on Casdoor object structs or SDK calls.

Index

Constants

View Source 
const (
	CodeInvalidArgument = "IAM_INVALID_ARGUMENT"
	CodeNotFound        = "IAM_NOT_FOUND"
	CodeConflict        = "IAM_CONFLICT"
)
View Source 
const (
	ProviderCasdoor = "casdoor"
	ProviderKernel  = "kernel"
)
View Source 
const (
	GroupTypePhysical = "physical"
	GroupTypeVirtual  = "virtual"
	GroupTypeTeam     = "team"
)
View Source 
const (
	MembershipDirect    = "direct"
	MembershipInherited = "inherited"
)

Variables

This section is empty.

Functions

func ErrConflict 

func ErrConflict(message string) error

func ErrInvalidArgument 

func ErrInvalidArgument(message string) error

func ErrNotFound 

func ErrNotFound(message string) error

Types

type Attributes 

type Attributes map[string]any

type Directory 

type Directory interface {
	CreateUser(ctx context.Context, user User) (User, error)
	GetUser(ctx context.Context, orgID, userID string) (User, error)
	ListUsers(ctx context.Context, query UserQuery) ([]User, error)
	UpdateUser(ctx context.Context, user User) (User, error)
	UpsertUser(ctx context.Context, user User) (User, error)
	DisableUser(ctx context.Context, orgID, userID string) error
	DeleteUser(ctx context.Context, orgID, userID string) error

	CreateOrganization(ctx context.Context, org Organization) (Organization, error)
	GetOrganization(ctx context.Context, orgID string) (Organization, error)
	ListOrganizations(ctx context.Context, query OrganizationQuery) ([]Organization, error)
	UpdateOrganization(ctx context.Context, org Organization) (Organization, error)
	UpsertOrganization(ctx context.Context, org Organization) (Organization, error)
	DeleteOrganization(ctx context.Context, orgID string) error

	CreateGroup(ctx context.Context, group Group) (Group, error)
	GetGroup(ctx context.Context, orgID, groupID string) (Group, error)
	ListGroups(ctx context.Context, query GroupQuery) ([]Group, error)
	UpdateGroup(ctx context.Context, group Group) (Group, error)
	UpsertGroup(ctx context.Context, group Group) (Group, error)
	DeleteGroup(ctx context.Context, orgID, groupID string) error
	ListGroupAncestors(ctx context.Context, orgID, groupID string) ([]Group, error)
	ListGroupDescendants(ctx context.Context, orgID, groupID string) ([]Group, error)

	AddMembership(ctx context.Context, membership Membership) error
	RemoveMembership(ctx context.Context, orgID, groupID, userID string) error
	ListMemberships(ctx context.Context, orgID, userID string) ([]Membership, error)
	ListEffectiveMemberships(ctx context.Context, orgID, userID string) ([]Membership, error)
}

Directory is the IAM read/write surface for users, orgs, groups and memberships. It is intentionally provider-neutral. Casdoor, DB-backed IAM and hybrid sync implementations must adapt to this interface.

type Group 

type Group struct {
	ID          string
	ExternalID  string
	Provider    string
	OrgID       string
	ParentID    string
	Name        string
	DisplayName string
	Type        string
	Path        string
	Enabled     bool
	Attributes  Attributes
	CreatedAt   time.Time
	UpdatedAt   time.Time
}

Group models organizational groups/teams. ParentID creates a group tree.

func (Group) Normalize 

func (g Group) Normalize() Group

type GroupNode 

type GroupNode struct {
	Group    Group
	Children []GroupNode
}

GroupNode is an API-friendly tree projection for org/group management UI.

type GroupQuery 

type GroupQuery struct {
	OrgID    string
	ParentID string
	Type     string
	UserID   string
	Limit    int
	Offset   int
}

type Membership 

type Membership struct {
	OrgID     string
	UserID    string
	GroupID   string
	RoleIDs   []string
	Source    string
	CreatedAt time.Time
}

Membership binds a user to a group. RoleIDs are optional role projections; resource authorization still belongs to authz/accessx.

func (Membership) Normalize 

func (m Membership) Normalize() Membership

type Organization 

type Organization struct {
	ID          string
	ExternalID  string
	Provider    string
	ParentID    string
	Name        string
	DisplayName string
	OwnerID     string
	Enabled     bool
	Attributes  Attributes
	CreatedAt   time.Time
	UpdatedAt   time.Time
}

Organization models a tenant/org boundary. ParentID allows multi-level orgs.

func (Organization) Normalize 

func (o Organization) Normalize() Organization

type OrganizationQuery 

type OrganizationQuery struct {
	ParentID string
	Name     string
	Limit    int
	Offset   int
}

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service is Kernel IAM's application-facing facade. Business components should depend on this facade rather than calling authn/casdoor or provider SDKs.

func NewService 

func NewService(directory Directory) (*Service, error)

func (*Service) AddMembership 

func (s *Service) AddMembership(ctx context.Context, membership Membership) error

func (*Service) BuildGroupTree 

func (s *Service) BuildGroupTree(ctx context.Context, orgID string) ([]GroupNode, error)

func (*Service) CreateGroup 

func (s *Service) CreateGroup(ctx context.Context, group Group) (Group, error)

func (*Service) CreateOrganization 

func (s *Service) CreateOrganization(ctx context.Context, org Organization) (Organization, error)

func (*Service) CreateUser 

func (s *Service) CreateUser(ctx context.Context, user User) (User, error)

func (*Service) DeleteGroup 

func (s *Service) DeleteGroup(ctx context.Context, orgID, groupID string) error

func (*Service) DeleteOrganization 

func (s *Service) DeleteOrganization(ctx context.Context, orgID string) error

func (*Service) DeleteUser 

func (s *Service) DeleteUser(ctx context.Context, orgID, userID string) error

func (*Service) Directory 

func (s *Service) Directory() Directory

func (*Service) DisableUser 

func (s *Service) DisableUser(ctx context.Context, orgID, userID string) error

func (*Service) EnsureGroup 

func (s *Service) EnsureGroup(ctx context.Context, group Group) (Group, error)

func (*Service) EnsureOrganization 

func (s *Service) EnsureOrganization(ctx context.Context, org Organization) (Organization, error)

func (*Service) EnsureUser 

func (s *Service) EnsureUser(ctx context.Context, user User) (User, error)

func (*Service) GetGroup 

func (s *Service) GetGroup(ctx context.Context, orgID, groupID string) (Group, error)

func (*Service) GetOrganization 

func (s *Service) GetOrganization(ctx context.Context, orgID string) (Organization, error)

func (*Service) GetUser 

func (s *Service) GetUser(ctx context.Context, orgID, userID string) (User, error)

func (*Service) ListEffectiveMemberships 

func (s *Service) ListEffectiveMemberships(ctx context.Context, orgID, userID string) ([]Membership, error)

func (*Service) ListGroupAncestors 

func (s *Service) ListGroupAncestors(ctx context.Context, orgID, groupID string) ([]Group, error)

func (*Service) ListGroupDescendants 

func (s *Service) ListGroupDescendants(ctx context.Context, orgID, groupID string) ([]Group, error)

func (*Service) ListGroups 

func (s *Service) ListGroups(ctx context.Context, query GroupQuery) ([]Group, error)

func (*Service) ListMemberships 

func (s *Service) ListMemberships(ctx context.Context, orgID, userID string) ([]Membership, error)

func (*Service) ListOrganizations 

func (s *Service) ListOrganizations(ctx context.Context, query OrganizationQuery) ([]Organization, error)

func (*Service) ListUserGroups 

func (s *Service) ListUserGroups(ctx context.Context, q UserGroupQuery) ([]Group, error)

func (*Service) ListUsers 

func (s *Service) ListUsers(ctx context.Context, query UserQuery) ([]User, error)

func (*Service) RemoveMembership 

func (s *Service) RemoveMembership(ctx context.Context, orgID, groupID, userID string) error

func (*Service) UpdateGroup 

func (s *Service) UpdateGroup(ctx context.Context, group Group) (Group, error)

func (*Service) UpdateOrganization 

func (s *Service) UpdateOrganization(ctx context.Context, org Organization) (Organization, error)

func (*Service) UpdateUser 

func (s *Service) UpdateUser(ctx context.Context, user User) (User, error)

type User 

type User struct {
	ID         string
	ExternalID string
	Provider   string

	OrgID    string
	Username string
	Name     string
	Email    string
	Phone    string

	Enabled    bool
	Locked     bool
	Deleted    bool
	Attributes Attributes

	CreatedAt time.Time
	UpdatedAt time.Time
}

User is Kernel's canonical user projection. It intentionally keeps fewer fields than Casdoor's object.User and stores provider-specific data under Attributes so the domain model stays stable.

func (User) Active 

func (u User) Active() bool

func (User) Normalize 

func (u User) Normalize() User

type UserGroupQuery 

type UserGroupQuery struct {
	OrgID            string
	UserID           string
	IncludeInherited bool
	Limit            int
	Offset           int
}

UserGroupQuery controls user -> group projection queries.

type UserQuery 

type UserQuery struct {
	OrgID    string
	ID       string
	Username string
	Email    string
	GroupID  string
	Limit    int
	Offset   int
}

Source Files

View all Source files

Directories

Path Synopsis
Package authnadapter adapts authn.IdentityAdmin providers, such as Casdoor, into Kernel IAM directory contracts.
 Package authnadapter adapts authn.IdentityAdmin providers, such as Casdoor, into Kernel IAM directory contracts.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.