Documentation
¶
Overview ¶
Package resourcex defines Kernel's provider-neutral resource control-plane contracts.
The package is intentionally business-neutral. It does not know about Aisphere-specific resources such as skills, repositories, agents or sandboxes. Applications and platform services implement these interfaces in their own control-plane service, while shared middleware and generated code can depend on the stable contracts here.
Index ¶
- Constants
- func NormalizeType(t string) string
- func ValidateBinding(binding ResourceBinding) error
- func ValidateGrant(grant Grant) error
- func ValidateResource(resource Resource) error
- func ValidateResourceType(typ ResourceType) error
- func ValidateRoleTemplate(tpl RoleTemplate) error
- type AttributeSet
- type BindingList
- type BindingQuery
- type ExternalResourceBinding
- type Grant
- type GrantList
- type GrantManager
- type GrantQuery
- type MemoryStore
- func (s *MemoryStore) ArchiveResource(ctx context.Context, ref ResourceRef) (Resource, error)
- func (s *MemoryStore) BindResource(ctx context.Context, binding ResourceBinding) (ResourceBinding, error)
- func (s *MemoryStore) DeleteResource(ctx context.Context, ref ResourceRef) error
- func (s *MemoryStore) GetResource(ctx context.Context, ref ResourceRef) (Resource, error)
- func (s *MemoryStore) GetResourceType(ctx context.Context, typ string) (ResourceType, error)
- func (s *MemoryStore) GrantAccess(ctx context.Context, grant Grant) (Grant, error)
- func (s *MemoryStore) ListGrants(ctx context.Context, query GrantQuery) (GrantList, error)
- func (s *MemoryStore) ListResourceBindings(ctx context.Context, query BindingQuery) (BindingList, error)
- func (s *MemoryStore) ListResourceTypes(ctx context.Context, filter ResourceTypeFilter) ([]ResourceType, error)
- func (s *MemoryStore) ListResources(ctx context.Context, query ResourceQuery) (ResourceList, error)
- func (s *MemoryStore) ListRoleTemplates(ctx context.Context, query RoleTemplateQuery) ([]RoleTemplate, error)
- func (s *MemoryStore) MoveResource(ctx context.Context, ref ResourceRef, parent ResourceRef) (Resource, error)
- func (s *MemoryStore) RegisterResourceType(ctx context.Context, typ ResourceType) (ResourceType, error)
- func (s *MemoryStore) RegisterRoleTemplate(ctx context.Context, tpl RoleTemplate) (RoleTemplate, error)
- func (s *MemoryStore) RevokeAccess(ctx context.Context, grantID string) error
- func (s *MemoryStore) UnbindResource(ctx context.Context, bindingID string) error
- func (s *MemoryStore) UpsertResource(ctx context.Context, resource Resource) (Resource, error)
- type Resource
- type ResourceBinding
- type ResourceList
- type ResourceQuery
- type ResourceRef
- type ResourceRegistry
- type ResourceType
- type ResourceTypeFilter
- type RoleTemplate
- type RoleTemplateQuery
- type SubjectRef
Constants ¶
const ( SubjectTypeUser = authz.SubjectTypeUser SubjectTypeGroup = authz.SubjectTypeGroup SubjectTypeServiceAccount = "service_account" SubjectTypeAgent = "agent" SourceManual = "manual" SourceSystem = "system" SourceInherited = "inherited" SourceExternalSync = "external_sync" SourceTemplate = "template" StatusActive = "active" StatusArchived = "archived" StatusDeleted = "deleted" VisibilityPrivate = "private" VisibilityOrg = "org" VisibilityPublic = "public" )
Variables ¶
This section is empty.
Functions ¶
func NormalizeType ¶
func ValidateBinding ¶
func ValidateBinding(binding ResourceBinding) error
func ValidateGrant ¶
func ValidateResource ¶
func ValidateResourceType ¶
func ValidateResourceType(typ ResourceType) error
func ValidateRoleTemplate ¶
func ValidateRoleTemplate(tpl RoleTemplate) error
Types ¶
type AttributeSet ¶
type BindingList ¶
type BindingList struct {
Items []ResourceBinding
NextCursor string
Total int64
}
type BindingQuery ¶
type BindingQuery struct {
Source ResourceRef
Target ResourceRef
Relation string
Status string
Limit int
Cursor string
}
type ExternalResourceBinding ¶
type ExternalResourceBinding struct {
ID string
Resource ResourceRef
Provider string
ExternalType string
ExternalID string
ExternalPath string
ExternalURL string
SyncMode string
SyncStatus string
LastSyncedAt time.Time
Metadata AttributeSet
}
ExternalResourceBinding maps an Aisphere resource projection to an external provider resource, for example a Forgejo repository or Kubernetes namespace.
type Grant ¶
type Grant struct {
ID string
Resource ResourceRef
RoleKey string
Relation string
Subject SubjectRef
Source string
Reason string
ExpiresAt time.Time
CreatedBy SubjectRef
CreatedAt time.Time
RevokedAt time.Time
ConsistencyToken string
Metadata AttributeSet
}
Grant is the durable management record for an authorization relationship. The grant is the control-plane fact; SpiceDB/OpenFGA relationships are the query-optimized projection.
type GrantManager ¶
type GrantManager interface {
RegisterRoleTemplate(ctx context.Context, tpl RoleTemplate) (RoleTemplate, error)
ListRoleTemplates(ctx context.Context, query RoleTemplateQuery) ([]RoleTemplate, error)
GrantAccess(ctx context.Context, grant Grant) (Grant, error)
RevokeAccess(ctx context.Context, grantID string) error
ListGrants(ctx context.Context, query GrantQuery) (GrantList, error)
}
GrantManager manages product-level RBAC grants while projecting them to the authorization graph through an implementation-specific backend.
type GrantQuery ¶
type GrantQuery struct {
Resource ResourceRef
Subject SubjectRef
Relation string
RoleKey string
Source string
Active *bool
Limit int
Cursor string
}
type MemoryStore ¶
type MemoryStore struct {
// contains filtered or unexported fields
}
func NewMemoryStore ¶
func NewMemoryStore() *MemoryStore
func (*MemoryStore) ArchiveResource ¶
func (s *MemoryStore) ArchiveResource(ctx context.Context, ref ResourceRef) (Resource, error)
func (*MemoryStore) BindResource ¶
func (s *MemoryStore) BindResource(ctx context.Context, binding ResourceBinding) (ResourceBinding, error)
func (*MemoryStore) DeleteResource ¶
func (s *MemoryStore) DeleteResource(ctx context.Context, ref ResourceRef) error
func (*MemoryStore) GetResource ¶
func (s *MemoryStore) GetResource(ctx context.Context, ref ResourceRef) (Resource, error)
func (*MemoryStore) GetResourceType ¶
func (s *MemoryStore) GetResourceType(ctx context.Context, typ string) (ResourceType, error)
func (*MemoryStore) GrantAccess ¶
func (*MemoryStore) ListGrants ¶
func (s *MemoryStore) ListGrants(ctx context.Context, query GrantQuery) (GrantList, error)
func (*MemoryStore) ListResourceBindings ¶
func (s *MemoryStore) ListResourceBindings(ctx context.Context, query BindingQuery) (BindingList, error)
func (*MemoryStore) ListResourceTypes ¶
func (s *MemoryStore) ListResourceTypes(ctx context.Context, filter ResourceTypeFilter) ([]ResourceType, error)
func (*MemoryStore) ListResources ¶
func (s *MemoryStore) ListResources(ctx context.Context, query ResourceQuery) (ResourceList, error)
func (*MemoryStore) ListRoleTemplates ¶
func (s *MemoryStore) ListRoleTemplates(ctx context.Context, query RoleTemplateQuery) ([]RoleTemplate, error)
func (*MemoryStore) MoveResource ¶
func (s *MemoryStore) MoveResource(ctx context.Context, ref ResourceRef, parent ResourceRef) (Resource, error)
func (*MemoryStore) RegisterResourceType ¶
func (s *MemoryStore) RegisterResourceType(ctx context.Context, typ ResourceType) (ResourceType, error)
func (*MemoryStore) RegisterRoleTemplate ¶
func (s *MemoryStore) RegisterRoleTemplate(ctx context.Context, tpl RoleTemplate) (RoleTemplate, error)
func (*MemoryStore) RevokeAccess ¶
func (s *MemoryStore) RevokeAccess(ctx context.Context, grantID string) error
func (*MemoryStore) UnbindResource ¶
func (s *MemoryStore) UnbindResource(ctx context.Context, bindingID string) error
func (*MemoryStore) UpsertResource ¶
type Resource ¶
type Resource struct {
Ref ResourceRef
OrgID string
ProjectID string
Parent ResourceRef
OwnerService string
OwnerResourceID string
Slug string
DisplayName string
Path string
Status string
Visibility string
Grantable bool
Labels map[string]string
Annotations map[string]string
Metadata AttributeSet
CreatedBy SubjectRef
CreatedAt time.Time
UpdatedAt time.Time
DeletedAt time.Time
}
Resource is the IAM/control-plane projection of a business resource. It is intentionally not the resource body: owner services still own their domain tables, payloads and lifecycle-specific state.
type ResourceBinding ¶
type ResourceBinding struct {
ID string
Source ResourceRef
Relation string
Target ResourceRef
Status string
Metadata AttributeSet
CreatedBy SubjectRef
CreatedAt time.Time
UpdatedAt time.Time
}
ResourceBinding captures cross-domain resource relationships, such as a skill backed by a git repository, or an agent using a skill/tool.
type ResourceList ¶
type ResourceQuery ¶
type ResourceRef ¶
type ResourceRegistry ¶
type ResourceRegistry interface {
RegisterResourceType(ctx context.Context, typ ResourceType) (ResourceType, error)
GetResourceType(ctx context.Context, typ string) (ResourceType, error)
ListResourceTypes(ctx context.Context, filter ResourceTypeFilter) ([]ResourceType, error)
UpsertResource(ctx context.Context, resource Resource) (Resource, error)
GetResource(ctx context.Context, ref ResourceRef) (Resource, error)
ListResources(ctx context.Context, query ResourceQuery) (ResourceList, error)
MoveResource(ctx context.Context, ref ResourceRef, parent ResourceRef) (Resource, error)
ArchiveResource(ctx context.Context, ref ResourceRef) (Resource, error)
DeleteResource(ctx context.Context, ref ResourceRef) error
BindResource(ctx context.Context, binding ResourceBinding) (ResourceBinding, error)
UnbindResource(ctx context.Context, bindingID string) error
ListResourceBindings(ctx context.Context, query BindingQuery) (BindingList, error)
}
ResourceRegistry manages resource types, resource projections and resource bindings. Implementations usually live in a platform IAM/resource service.
type ResourceType ¶
type ResourceType struct {
Type string
Capability string
OwnerService string
DisplayName string
Description string
ParentTypes []string
Grantable bool
Auditable bool
SpiceDBType string
Relations []string
Permissions []string
Labels map[string]string
Metadata AttributeSet
Status string
CreatedAt time.Time
UpdatedAt time.Time
}
ResourceType describes a grantable resource kind and how it maps to the authorization graph. Instances can be dynamic, but resource types are a governed contract and normally require a matching SpiceDB/OpenFGA schema.
type ResourceTypeFilter ¶
type RoleTemplate ¶
type RoleTemplate struct {
ID string
ResourceType string
RoleKey string
DisplayName string
Description string
Relation string
BuiltIn bool
Enabled bool
SortOrder int
Metadata AttributeSet
}
RoleTemplate is the product-facing RBAC role. It maps to an authorization relation. The graph engine still evaluates ReBAC relationships.
type RoleTemplateQuery ¶
type SubjectRef ¶
type SubjectRef = authz.SubjectRef