resourcex

package
v0.2.5 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 6, 2026 License: MIT Imports: 7 Imported by: 0

Documentation

Overview

Package resourcex defines Kernel's provider-neutral resource control-plane contracts.

The package is intentionally business-neutral. It does not know about Aisphere-specific resources such as skills, repositories, agents or sandboxes. Applications and platform services implement these interfaces in their own control-plane service, while shared middleware and generated code can depend on the stable contracts here.

Index

Constants

View Source
const (
	SubjectTypeUser           = authz.SubjectTypeUser
	SubjectTypeGroup          = authz.SubjectTypeGroup
	SubjectTypeServiceAccount = "service_account"
	SubjectTypeAgent          = "agent"

	SourceManual       = "manual"
	SourceSystem       = "system"
	SourceInherited    = "inherited"
	SourceExternalSync = "external_sync"
	SourceTemplate     = "template"

	StatusActive   = "active"
	StatusArchived = "archived"
	StatusDeleted  = "deleted"

	VisibilityPrivate = "private"
	VisibilityOrg     = "org"
	VisibilityPublic  = "public"
)

Variables

This section is empty.

Functions

func NormalizeType

func NormalizeType(t string) string

func ValidateBinding

func ValidateBinding(binding ResourceBinding) error

func ValidateGrant

func ValidateGrant(grant Grant) error

func ValidateResource

func ValidateResource(resource Resource) error

func ValidateResourceType

func ValidateResourceType(typ ResourceType) error

func ValidateRoleTemplate

func ValidateRoleTemplate(tpl RoleTemplate) error

Types

type AttributeSet

type AttributeSet map[string]any

type BindingList

type BindingList struct {
	Items      []ResourceBinding
	NextCursor string
	Total      int64
}

type BindingQuery

type BindingQuery struct {
	Source   ResourceRef
	Target   ResourceRef
	Relation string
	Status   string
	Limit    int
	Cursor   string
}

type ExternalResourceBinding

type ExternalResourceBinding struct {
	ID       string
	Resource ResourceRef

	Provider     string
	ExternalType string
	ExternalID   string
	ExternalPath string
	ExternalURL  string

	SyncMode     string
	SyncStatus   string
	LastSyncedAt time.Time
	Metadata     AttributeSet
}

ExternalResourceBinding maps an Aisphere resource projection to an external provider resource, for example a Forgejo repository or Kubernetes namespace.

type Grant

type Grant struct {
	ID       string
	Resource ResourceRef

	RoleKey  string
	Relation string
	Subject  SubjectRef

	Source    string
	Reason    string
	ExpiresAt time.Time

	CreatedBy SubjectRef
	CreatedAt time.Time
	RevokedAt time.Time

	ConsistencyToken string
	Metadata         AttributeSet
}

Grant is the durable management record for an authorization relationship. The grant is the control-plane fact; SpiceDB/OpenFGA relationships are the query-optimized projection.

type GrantList

type GrantList struct {
	Items      []Grant
	NextCursor string
	Total      int64
}

type GrantManager

type GrantManager interface {
	RegisterRoleTemplate(ctx context.Context, tpl RoleTemplate) (RoleTemplate, error)
	ListRoleTemplates(ctx context.Context, query RoleTemplateQuery) ([]RoleTemplate, error)

	GrantAccess(ctx context.Context, grant Grant) (Grant, error)
	RevokeAccess(ctx context.Context, grantID string) error
	ListGrants(ctx context.Context, query GrantQuery) (GrantList, error)
}

GrantManager manages product-level RBAC grants while projecting them to the authorization graph through an implementation-specific backend.

type GrantQuery

type GrantQuery struct {
	Resource ResourceRef
	Subject  SubjectRef
	Relation string
	RoleKey  string
	Source   string
	Active   *bool
	Limit    int
	Cursor   string
}

type MemoryStore

type MemoryStore struct {
	// contains filtered or unexported fields
}

func NewMemoryStore

func NewMemoryStore() *MemoryStore

func (*MemoryStore) ArchiveResource

func (s *MemoryStore) ArchiveResource(ctx context.Context, ref ResourceRef) (Resource, error)

func (*MemoryStore) BindResource

func (s *MemoryStore) BindResource(ctx context.Context, binding ResourceBinding) (ResourceBinding, error)

func (*MemoryStore) DeleteResource

func (s *MemoryStore) DeleteResource(ctx context.Context, ref ResourceRef) error

func (*MemoryStore) GetResource

func (s *MemoryStore) GetResource(ctx context.Context, ref ResourceRef) (Resource, error)

func (*MemoryStore) GetResourceType

func (s *MemoryStore) GetResourceType(ctx context.Context, typ string) (ResourceType, error)

func (*MemoryStore) GrantAccess

func (s *MemoryStore) GrantAccess(ctx context.Context, grant Grant) (Grant, error)

func (*MemoryStore) ListGrants

func (s *MemoryStore) ListGrants(ctx context.Context, query GrantQuery) (GrantList, error)

func (*MemoryStore) ListResourceBindings

func (s *MemoryStore) ListResourceBindings(ctx context.Context, query BindingQuery) (BindingList, error)

func (*MemoryStore) ListResourceTypes

func (s *MemoryStore) ListResourceTypes(ctx context.Context, filter ResourceTypeFilter) ([]ResourceType, error)

func (*MemoryStore) ListResources

func (s *MemoryStore) ListResources(ctx context.Context, query ResourceQuery) (ResourceList, error)

func (*MemoryStore) ListRoleTemplates

func (s *MemoryStore) ListRoleTemplates(ctx context.Context, query RoleTemplateQuery) ([]RoleTemplate, error)

func (*MemoryStore) MoveResource

func (s *MemoryStore) MoveResource(ctx context.Context, ref ResourceRef, parent ResourceRef) (Resource, error)

func (*MemoryStore) RegisterResourceType

func (s *MemoryStore) RegisterResourceType(ctx context.Context, typ ResourceType) (ResourceType, error)

func (*MemoryStore) RegisterRoleTemplate

func (s *MemoryStore) RegisterRoleTemplate(ctx context.Context, tpl RoleTemplate) (RoleTemplate, error)

func (*MemoryStore) RevokeAccess

func (s *MemoryStore) RevokeAccess(ctx context.Context, grantID string) error

func (*MemoryStore) UnbindResource

func (s *MemoryStore) UnbindResource(ctx context.Context, bindingID string) error

func (*MemoryStore) UpsertResource

func (s *MemoryStore) UpsertResource(ctx context.Context, resource Resource) (Resource, error)

type Resource

type Resource struct {
	Ref ResourceRef

	OrgID     string
	ProjectID string
	Parent    ResourceRef

	OwnerService    string
	OwnerResourceID string

	Slug        string
	DisplayName string
	Path        string
	Status      string
	Visibility  string
	Grantable   bool

	Labels      map[string]string
	Annotations map[string]string
	Metadata    AttributeSet

	CreatedBy SubjectRef
	CreatedAt time.Time
	UpdatedAt time.Time
	DeletedAt time.Time
}

Resource is the IAM/control-plane projection of a business resource. It is intentionally not the resource body: owner services still own their domain tables, payloads and lifecycle-specific state.

func (Resource) IsZero

func (r Resource) IsZero() bool

type ResourceBinding

type ResourceBinding struct {
	ID       string
	Source   ResourceRef
	Relation string
	Target   ResourceRef

	Status    string
	Metadata  AttributeSet
	CreatedBy SubjectRef
	CreatedAt time.Time
	UpdatedAt time.Time
}

ResourceBinding captures cross-domain resource relationships, such as a skill backed by a git repository, or an agent using a skill/tool.

type ResourceList

type ResourceList struct {
	Items      []Resource
	NextCursor string
	Total      int64
}

type ResourceQuery

type ResourceQuery struct {
	Type       string
	OrgID      string
	ProjectID  string
	Parent     ResourceRef
	Owner      string
	Status     string
	Visibility string
	Labels     map[string]string
	Limit      int
	Cursor     string
}

type ResourceRef

type ResourceRef = authz.ObjectRef

type ResourceRegistry

type ResourceRegistry interface {
	RegisterResourceType(ctx context.Context, typ ResourceType) (ResourceType, error)
	GetResourceType(ctx context.Context, typ string) (ResourceType, error)
	ListResourceTypes(ctx context.Context, filter ResourceTypeFilter) ([]ResourceType, error)

	UpsertResource(ctx context.Context, resource Resource) (Resource, error)
	GetResource(ctx context.Context, ref ResourceRef) (Resource, error)
	ListResources(ctx context.Context, query ResourceQuery) (ResourceList, error)
	MoveResource(ctx context.Context, ref ResourceRef, parent ResourceRef) (Resource, error)
	ArchiveResource(ctx context.Context, ref ResourceRef) (Resource, error)
	DeleteResource(ctx context.Context, ref ResourceRef) error

	BindResource(ctx context.Context, binding ResourceBinding) (ResourceBinding, error)
	UnbindResource(ctx context.Context, bindingID string) error
	ListResourceBindings(ctx context.Context, query BindingQuery) (BindingList, error)
}

ResourceRegistry manages resource types, resource projections and resource bindings. Implementations usually live in a platform IAM/resource service.

type ResourceType

type ResourceType struct {
	Type         string
	Capability   string
	OwnerService string
	DisplayName  string
	Description  string

	ParentTypes []string
	Grantable   bool
	Auditable   bool
	SpiceDBType string

	Relations   []string
	Permissions []string
	Labels      map[string]string
	Metadata    AttributeSet

	Status    string
	CreatedAt time.Time
	UpdatedAt time.Time
}

ResourceType describes a grantable resource kind and how it maps to the authorization graph. Instances can be dynamic, but resource types are a governed contract and normally require a matching SpiceDB/OpenFGA schema.

type ResourceTypeFilter

type ResourceTypeFilter struct {
	Capability   string
	OwnerService string
	Grantable    *bool
	Status       string
}

type RoleTemplate

type RoleTemplate struct {
	ID           string
	ResourceType string
	RoleKey      string
	DisplayName  string
	Description  string
	Relation     string
	BuiltIn      bool
	Enabled      bool
	SortOrder    int
	Metadata     AttributeSet
}

RoleTemplate is the product-facing RBAC role. It maps to an authorization relation. The graph engine still evaluates ReBAC relationships.

type RoleTemplateQuery

type RoleTemplateQuery struct {
	ResourceType string
	RoleKey      string
	Enabled      *bool
}

type SubjectRef

type SubjectRef = authz.SubjectRef

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL