user

type Admin struct{}

type Identity interface {
	// IsAdmin reports whether this is the Kargo API server's own admin user,
	// who may do everything the server can do and is never reviewed.
	IsAdmin() bool
	// Subjects returns the Kubernetes subjects whose permissions stand in
	// for this identity when performing the described operation. The
	// operation is allowed if any one of them is allowed. An identity with
	// no subjects is allowed nothing.
	Subjects(ra authv1.ResourceAttributes) []Subject
	// Actor names the identity the way events and audit annotations record
	// it.
	Actor() string
	// MemberOf reports whether the identity has a presence in the Project
	// namespace, such that the Project counts as one of theirs. It implies no
	// permission in it. Only an OIDCUser, through a mapped ServiceAccount,
	// ever does; nothing is recorded about which Projects anyone else belongs
	// to.
	MemberOf(namespace string) bool
}

type KubernetesUser struct {
	authnv1.UserInfo
}

type OIDCUser struct {
	// Claims are the verified claims of the user's token.
	Claims map[string]any
	// UsernameClaim names the claim the Username was taken from.
	UsernameClaim string
	// Username is the user's name as the configured claim states it. It is
	// often an email address, but may be anything the identity provider
	// sends.
	Username string
	// ServiceAccountsByNamespace maps namespaces to the ServiceAccounts in
	// them that the user's claims map to.
	ServiceAccountsByNamespace map[string]map[types.NamespacedName]struct{}
	// GlobalServiceAccountNamespaces are the namespaces, besides a Project's
	// own, in which a mapped ServiceAccount may grant access to the Project.
	GlobalServiceAccountNamespaces []string
}

type Subject struct {
	Username string
	UID      string
	Groups   []string
	Extra    map[string]authv1.ExtraValue
}