verifiedpermissions

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 26 Imported by: 0

README

Verified Permissions

Parity grade: A · SDK aws-sdk-go-v2/service/verifiedpermissions@v1.36.0 · last audited 2026-07-25 (9050476f8)

Coverage

Metric Value
Operations audited 34 (33 ok, 1 partial)
Known gaps 4
Deferred items 0
Resource leaks clean
Known gaps
  • IsAuthorizedWithToken/BatchIsAuthorizedWithToken: principalFromToken matches the token's "iss" claim against configured identity sources (improved a prior pass) but does not additionally match "aud"/"client_id" against the source's configured client IDs/audiences, nor verify the JWT signature. Documented simplification of the identity-source-selection logic, not a wire-shape bug.
  • DeletePolicyStoreAlias: the real SDK declares an InvalidStateException, but its documented trigger text is (byte-for-byte) DeletePolicyStore's own "deletion protection is enabled" message, which does not apply to aliases (no deletionProtection field exists on PolicyStoreAlias). Treated as unreliable auto-generated API-reference boilerplate rather than implemented as a guessed condition; if AWS's real behavior differs (e.g. re-soft-deleting an already-PendingDeletion alias), this needs a follow-up once the actual trigger is confirmed.
  • CreatePolicyStoreAlias's ServiceQuotaExceededException is declared as a possible error but no numeric per-account/region alias quota is documented anywhere in the API reference, so none is enforced -- consistent with how this service (and others in gopherstack) leaves undocumented-threshold quota exceptions unenforced rather than fabricating a number.
  • resolvePolicyStoreID (alias-as-policyStoreId resolution, wired into every other policyStoreId-accepting op this pass) was independently verified against the AWS API reference for 6 ops spanning distinct categories -- GetPolicyStore, UpdatePolicyStore (implied by GetPolicyStore's identical doc text), IsAuthorized, CreatePolicy, DeletePolicy, PutSchema -- all carrying byte-identical documented wording. Applied by strong pattern consistency to the remaining ~15 policyStoreId-accepting ops (policy templates, identity sources, GetSchema, the Batch* evaluation ops) rather than independently doc-verified one-by-one; the two documented exceptions (CreatePolicyStoreAlias, DeletePolicyStore) are confirmed and excluded. Flagging this as an inference rather than a silently-assumed fact.

More

Documentation

Index

Constants

View Source 
const (
	ValidationModeOff    = "OFF"
	ValidationModeStrict = "STRICT"
)

ValidationMode constants for policy store validation settings.

View Source 
const (
	DeletionProtectionEnabled  = "ENABLED"
	DeletionProtectionDisabled = "DISABLED"
)

DeletionProtection constants for policy store deletion protection.

View Source 
const (
	AliasStateActive          = "Active"
	AliasStatePendingDeletion = "PendingDeletion"
)

AliasState constants for policy store alias state (real SDK: types.AliasState).

View Source 
const (
	DeletionModeSoftDelete = "SoftDelete"
	DeletionModeHardDelete = "HardDelete"
)

DeletionMode constants for DeletePolicyStoreAlias (real SDK: types.DeletionMode).

Variables

View Source 
var (
	// ErrPolicyStoreNotFound is returned when a policy store is not found.
	ErrPolicyStoreNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrPolicyNotFound is returned when a policy is not found.
	ErrPolicyNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrPolicyTemplateNotFound is returned when a policy template is not found.
	ErrPolicyTemplateNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrIdentitySourceNotFound is returned when an identity source is not found.
	ErrIdentitySourceNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrSchemaNotFound is returned when no schema has been set for a policy store.
	ErrSchemaNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrValidation is returned when input fails validation.
	ErrValidation = awserr.New("ValidationException", awserr.ErrInvalidParameter)
	// ErrConflict is returned when a resource conflict prevents an operation.
	ErrConflict = awserr.New("ConflictException", awserr.ErrConflict)
	// ErrTooManyTags is returned when TagResource would push a resource's tag
	// count over the 50-tag limit. Real AWS only declares TooManyTagsException
	// for TagResource -- CreatePolicyStore's tag-count overflow stays a plain
	// ValidationException (ErrValidation), per the SDK's per-op error models.
	ErrTooManyTags = awserr.New("TooManyTagsException", awserr.ErrInvalidParameter)
)
View Source 
var ErrNilAppContext = errors.New("verifiedpermissions: nil AppContext")

ErrNilAppContext is returned when a nil AppContext is passed to Init.

Functions

This section is empty.

Types

type AuthDecision 

type AuthDecision struct {
	Request             AuthorizationRequest `json:"request"`
	Decision            string               `json:"decision"`
	DeterminingPolicies []string             `json:"determiningPolicies"`
	Errors              []string             `json:"errors"`
}

AuthDecision is the result of a single authorization evaluation.

type AuthorizationRequest 

type AuthorizationRequest struct {
	PrincipalEntityType string `json:"principalEntityType,omitempty"`
	PrincipalEntityID   string `json:"principalEntityId,omitempty"`
	ActionType          string `json:"actionType,omitempty"`
	ActionID            string `json:"actionId,omitempty"`
	ResourceEntityType  string `json:"resourceEntityType,omitempty"`
	ResourceEntityID    string `json:"resourceEntityId,omitempty"`
}

AuthorizationRequest represents a single authorization evaluation request.

type BatchGetPolicyItem 

type BatchGetPolicyItem struct {
	PolicyStoreID string `json:"policyStoreId"`
	PolicyID      string `json:"policyId"`
}

BatchGetPolicyItem identifies a policy to retrieve in a batch request.

type BatchGetPolicyResult 

type BatchGetPolicyResult struct {
	Results []Policy                  `json:"results"`
	Errors  []batchGetPolicyErrorItem `json:"errors"`
}

BatchGetPolicyResult holds the results of a BatchGetPolicy call.

type CognitoGroupConfig 

type CognitoGroupConfig struct {
	GroupEntityType string `json:"groupEntityType,omitempty"`
}

CognitoGroupConfig holds Cognito group-to-Cedar-entity mapping configuration.

type CreatePolicyParams 

type CreatePolicyParams struct {
	PolicyType          string // "STATIC" or "TEMPLATE_LINKED"
	Statement           string // STATIC only
	Description         string // STATIC only
	PolicyTemplateID    string // TEMPLATE_LINKED only
	PrincipalEntityType string // TEMPLATE_LINKED only
	PrincipalEntityID   string // TEMPLATE_LINKED only
	ResourceEntityType  string // TEMPLATE_LINKED only
	ResourceEntityID    string // TEMPLATE_LINKED only
	ClientToken         string // idempotency token, see InMemoryBackend.checkClientToken
}

CreatePolicyParams holds parameters for creating a policy.

type Handler 

type Handler struct {
	Backend StorageBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP handler for Amazon Verified Permissions operations.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new Verified Permissions handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this handler handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the Verified Permissions action from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported Verified Permissions operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for Verified Permissions requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all Verified Permissions state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Verified Permissions API requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type IdentitySource 

type IdentitySource struct {
	CreatedDate         time.Time           `json:"createdDate"`
	LastUpdated         time.Time           `json:"lastUpdated"`
	CognitoGroupConfig  *CognitoGroupConfig `json:"cognitoGroupConfig,omitempty"`
	OIDCGroupConfig     *OIDCGroupConfig    `json:"oidcGroupConfig,omitempty"`
	OIDCTokenSelection  *OIDCTokenSelection `json:"oidcTokenSelection,omitempty"`
	IdentitySourceID    string              `json:"identitySourceId"`
	PolicyStoreID       string              `json:"policyStoreId"`
	PrincipalEntityType string              `json:"principalEntityType"`
	UserPoolArn         string              `json:"userPoolArn,omitempty"`
	OpenIDIssuer        string              `json:"openIdIssuer,omitempty"`
	EntityIDPrefix      string              `json:"entityIdPrefix,omitempty"`
	ClientIDs           []string            `json:"clientIds,omitempty"`
}

IdentitySource represents an Amazon Verified Permissions identity source.

type IdentitySourceConfig 

type IdentitySourceConfig struct {
	// Cognito
	UserPoolArn            string
	ClientIDs              []string
	CognitoGroupEntityType string
	// OIDC
	Issuer              string
	EntityIDPrefix      string
	OIDCGroupClaim      string
	OIDCGroupEntityType string
	// Token selection
	TokenType        string // "IDENTITY" or "ACCESS"
	PrincipalIDClaim string
	Audiences        []string
}

IdentitySourceConfig holds full identity source configuration for create/update.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for Verified Permissions resources.

policyStores registers directly on b.registry, keyed by its real PolicyStoreID field. policies, policyTemplates, and identitySources were previously nested by policy store (map[string]map[string]*T); each is now a flat *store.Table keyed by the composite "policyStoreID/id" string (see policyKey/policyTemplateKey/identitySourceKey), with a companion *store.Index grouping entries by policy store for the per-store scans the nested maps used to answer directly -- the same pattern services/codeartifact uses for its region-nested maps. All three carry real, wire-visible PolicyStoreID fields, so each is a "clean" table registered directly on b.registry, no DTO wrapper needed (see persistence.go).

schemas has no wire-visible identity field at all (one schema per policy store, keyed only by the outer map's policyStoreID), so it gained a hidden policyStoreID field purely for this key; it is a "dirty" table (store.New only, deliberately NOT store.Register-ed onto b.registry) round-tripped through a DTO wrapper in persistence.go.

policyStoreAliases registers directly on b.registry too, keyed by its own (wire-visible, account/region-unique) AliasName field -- a "clean" table like policyStores, needing no DTO wrapper. policyStoreAliasesByStore groups aliases by the policy store they point at, for ListPolicyStoreAliases' filter and for DeletePolicyStore's cascade (see DeletePolicyStore).

arnIndex is a derived cache rebuilt from the tables above on Restore, so it is never itself persisted. resourceTags, policySetCache, and policySetDirty remain plain maps: resourceTags is a non-*T value map (map[string]string) still persisted directly; policySetCache/policySetDirty are ephemeral caches that are never persisted.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID configured for this backend.

func (*InMemoryBackend) AddIdentitySourceInternal 

func (b *InMemoryBackend) AddIdentitySourceInternal(is *IdentitySource)

AddIdentitySourceInternal inserts a pre-built IdentitySource directly into the backend (for test seeding).

func (*InMemoryBackend) AddPolicyInternal 

func (b *InMemoryBackend) AddPolicyInternal(p *Policy)

AddPolicyInternal inserts a pre-built Policy directly into the backend (for test seeding).

func (*InMemoryBackend) AddPolicyStoreInternal 

func (b *InMemoryBackend) AddPolicyStoreInternal(ps *PolicyStore)

AddPolicyStoreInternal inserts a pre-built PolicyStore directly into the backend (for test seeding).

func (*InMemoryBackend) AddPolicyTemplateInternal 

func (b *InMemoryBackend) AddPolicyTemplateInternal(pt *PolicyTemplate)

AddPolicyTemplateInternal inserts a pre-built PolicyTemplate directly into the backend (for test seeding).

func (*InMemoryBackend) BatchGetPolicy 

func (b *InMemoryBackend) BatchGetPolicy(items []BatchGetPolicyItem) BatchGetPolicyResult

BatchGetPolicy retrieves multiple policies in a single request.

func (*InMemoryBackend) BatchIsAuthorized 

func (b *InMemoryBackend) BatchIsAuthorized(
	policyStoreID string,
	requests []AuthorizationRequest,
) ([]AuthDecision, error)

BatchIsAuthorized evaluates a batch of authorization requests.

func (*InMemoryBackend) BatchIsAuthorizedWithToken 

func (b *InMemoryBackend) BatchIsAuthorizedWithToken(
	policyStoreID string,
	requests []AuthorizationRequest,
) ([]AuthDecision, error)

BatchIsAuthorizedWithToken evaluates a batch of authorization requests using a token.

func (*InMemoryBackend) CreateIdentitySource 

func (b *InMemoryBackend) CreateIdentitySource(
	policyStoreID, principalEntityType string,
	cfg IdentitySourceConfig,
	clientToken string,
) (*IdentitySource, error)

CreateIdentitySource creates a new identity source in the given policy store. A non-empty clientToken makes the call idempotent for eight hours, same semantics as CreatePolicyStore's ClientToken.

func (*InMemoryBackend) CreatePolicy 

func (b *InMemoryBackend) CreatePolicy(policyStoreID string, params CreatePolicyParams) (*Policy, error)

CreatePolicy creates a new policy in the given policy store.

func (*InMemoryBackend) CreatePolicyStore 

func (b *InMemoryBackend) CreatePolicyStore(
	description string,
	tags map[string]string,
	validationMode, deletionProtection, clientToken string,
) (*PolicyStore, error)

CreatePolicyStore creates a new policy store. A non-empty clientToken makes the call idempotent for eight hours: a retry with the same token and the same parameters replays the original policy store instead of creating a duplicate, and a retry with the same token but different parameters fails with ErrConflict, matching real AWS's documented ClientToken semantics.

func (*InMemoryBackend) CreatePolicyStoreAlias added in v1.2.0 

func (b *InMemoryBackend) CreatePolicyStoreAlias(aliasName, policyStoreID string) (*PolicyStoreAlias, error)

CreatePolicyStoreAlias creates an alias pointing at policyStoreID.

Real AWS semantics (this op is new to the SDK; verified against the API reference since no prior gopherstack pass audited it):

  • aliasName must be prefixed "policy-store-alias/" (ValidationException).
  • policyStoreID must reference an existing policy store, identified by ID only -- unlike almost every other policyStoreId parameter in this API (see Handler.resolvePolicyStoreID), alias resolution does NOT apply here: "The associated policy store must be specified using its ID. The alias name cannot be used." A nonexistent target is ResourceNotFoundException.
  • Idempotent on an exact (aliasName, policyStoreId) repeat against an Active alias: replays the existing alias instead of erroring ("For each duplicate CreatePolicyStoreAlias request, a Success response will be returned and a new policy store alias will not be created").
  • An aliasName already in use for a DIFFERENT policyStoreId, or currently in the PendingDeletion state (real SDK's GetPolicyStoreAlias doc: "creating a policy store alias with the same alias name will fail" while PendingDeletion -- no exception carved out for the same-target-store case), is a ConflictException.

func (*InMemoryBackend) CreatePolicyTemplate 

func (b *InMemoryBackend) CreatePolicyTemplate(
	policyStoreID, description, statement, clientToken string,
) (*PolicyTemplate, error)

CreatePolicyTemplate creates a new policy template in the given policy store. A non-empty clientToken makes the call idempotent for eight hours, same semantics as CreatePolicyStore's ClientToken.

func (*InMemoryBackend) DeleteIdentitySource 

func (b *InMemoryBackend) DeleteIdentitySource(policyStoreID, identitySourceID string) error

DeleteIdentitySource removes an identity source from the given policy store.

func (*InMemoryBackend) DeletePolicy 

func (b *InMemoryBackend) DeletePolicy(policyStoreID, policyID string) error

DeletePolicy removes a policy from the given policy store.

func (*InMemoryBackend) DeletePolicyStore 

func (b *InMemoryBackend) DeletePolicyStore(policyStoreID string) error

DeletePolicyStore removes a policy store and all its policies and templates.

func (*InMemoryBackend) DeletePolicyStoreAlias added in v1.2.0 

func (b *InMemoryBackend) DeletePolicyStoreAlias(aliasName string, hardDelete bool) error

DeletePolicyStoreAlias deletes the named alias. Idempotent: a nonexistent aliasName is a no-op success, matching the real SDK's documented idempotency ("If you specify a policy store alias that does not exist, the request response will still return a successful HTTP 200 status code"). hardDelete selects DeletionMode=HardDelete (immediate removal, bypassing PendingDeletion); the default (false, SoftDelete) instead transitions the alias to PendingDeletion -- it remains visible via GetPolicyStoreAlias/ListPolicyStoreAliases but is ineligible for a new CreatePolicyStoreAlias with the same name and for policyStoreId-alias resolution elsewhere (see ResolvePolicyStoreAlias).

func (*InMemoryBackend) DeletePolicyTemplate 

func (b *InMemoryBackend) DeletePolicyTemplate(policyStoreID, policyTemplateID string) error

DeletePolicyTemplate removes a policy template from the given policy store. Per the real SDK's documented behavior ("This operation also deletes any policies that were created from the specified policy template"), it also cascade-deletes every TEMPLATE_LINKED policy that references this template -- otherwise those policies would be left pointing at a nonexistent template (a dangling reference visible to GetPolicy/ListPolicies/BatchGetPolicy, and silently dropped from Cedar evaluation, since resolveStatementLocked treats a missing template as an empty statement).

func (*InMemoryBackend) GetIdentitySource 

func (b *InMemoryBackend) GetIdentitySource(policyStoreID, identitySourceID string) (*IdentitySource, error)

GetIdentitySource returns the identity source with the given ID.

func (*InMemoryBackend) GetPolicy 

func (b *InMemoryBackend) GetPolicy(policyStoreID, policyID string) (*Policy, error)

GetPolicy returns the policy with the given ID.

func (*InMemoryBackend) GetPolicyStore 

func (b *InMemoryBackend) GetPolicyStore(policyStoreID string) (*PolicyStore, error)

GetPolicyStore returns the policy store with the given ID.

func (*InMemoryBackend) GetPolicyStoreAlias added in v1.2.0 

func (b *InMemoryBackend) GetPolicyStoreAlias(aliasName string) (*PolicyStoreAlias, error)

GetPolicyStoreAlias returns the alias with the given name, regardless of its state -- reporting Active vs PendingDeletion is exactly this op's job.

func (*InMemoryBackend) GetPolicyTemplate 

func (b *InMemoryBackend) GetPolicyTemplate(policyStoreID, policyTemplateID string) (*PolicyTemplate, error)

GetPolicyTemplate returns the policy template with the given ID.

func (*InMemoryBackend) GetSchema 

func (b *InMemoryBackend) GetSchema(policyStoreID string) (*PolicyStoreSchema, error)

GetSchema returns the schema for a policy store.

func (*InMemoryBackend) IsAuthorized 

func (b *InMemoryBackend) IsAuthorized(policyStoreID string, req AuthorizationRequest) (*AuthDecision, error)

IsAuthorized evaluates a single authorization request against stored Cedar policies.

func (*InMemoryBackend) IsAuthorizedWithToken 

func (b *InMemoryBackend) IsAuthorizedWithToken(
	policyStoreID string,
	req AuthorizationRequest,
) (*AuthDecision, error)

IsAuthorizedWithToken evaluates a single authorization request using a token.

func (*InMemoryBackend) ListIdentitySources 

func (b *InMemoryBackend) ListIdentitySources(
	policyStoreID, nextToken string,
	maxResults int,
	principalEntityTypes []string,
) ([]IdentitySource, string, error)

ListIdentitySources returns all identity sources for a policy store sorted by creation date. principalEntityTypes mirrors the wire "filters" list (each element's principalEntityType); when non-empty, only identity sources whose PrincipalEntityType matches one of them are returned (an OR across filters, matching AWS's ListIdentitySourcesInput.Filters semantics).

func (*InMemoryBackend) ListPolicies 

func (b *InMemoryBackend) ListPolicies(
	policyStoreID string,
	filter ListPoliciesFilter,
	nextToken string,
	maxResults int,
) ([]Policy, string, error)

ListPolicies returns policies in a policy store, with optional filter and pagination.

func (*InMemoryBackend) ListPolicyStoreAliases added in v1.2.0 

func (b *InMemoryBackend) ListPolicyStoreAliases(
	policyStoreID, nextToken string, maxResults int,
) ([]PolicyStoreAlias, string)

ListPolicyStoreAliases returns all policy store aliases in the account, optionally narrowed to one policy store, sorted by creation date ascending and paginated -- the same shape/pagination convention ListPolicyTemplates/ListIdentitySources use (see listByPolicyStore).

func (*InMemoryBackend) ListPolicyStores 

func (b *InMemoryBackend) ListPolicyStores(nextToken string, maxResults int) ([]PolicyStore, string)

ListPolicyStores returns all policy stores sorted by creation date (newest first).

func (*InMemoryBackend) ListPolicyTemplates 

func (b *InMemoryBackend) ListPolicyTemplates(
	policyStoreID, nextToken string,
	maxResults int,
) ([]PolicyTemplate, string, error)

ListPolicyTemplates returns all policy templates in a policy store sorted by creation date.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(resourceARN string) (map[string]string, error)

ListTagsForResource returns the tags for a resource identified by its ARN. Supports policy stores, policies, policy templates, and identity sources.

func (*InMemoryBackend) PolicyScope added in v1.2.0 

func (b *InMemoryBackend) PolicyScope(p *Policy) *PolicyScopeResult

PolicyScope returns the effect/actions/principal/resource derived from p's effective Cedar statement: p's own statement for STATIC policies, or the referenced policy template's statement (with ?principal/?resource substituted) for TEMPLATE_LINKED policies. Returns nil if the statement can't be resolved (e.g. a dangling template reference) or parsed.

func (*InMemoryBackend) PutSchema 

func (b *InMemoryBackend) PutSchema(policyStoreID, schema string) ([]string, error)

PutSchema creates or replaces the schema for a policy store, extracts namespaces, and returns them.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all policy store state.

func (*InMemoryBackend) ResolvePolicyStoreAlias added in v1.2.0 

func (b *InMemoryBackend) ResolvePolicyStoreAlias(aliasName string) (string, error)

ResolvePolicyStoreAlias resolves an alias name (prefixed "policy-store-alias/") to its underlying policy store ID, for operations that accept either a policy store ID or an alias name in their policyStoreId field (see Handler.resolvePolicyStoreID). Only an Active alias resolves; a nonexistent or PendingDeletion alias is ResourceNotFoundException -- matching the real SDK's documented behavior: "If the policy store alias is used in an API that has a policyStoreId field, the operation will fail with a ResourceNotFound exception" once the alias enters PendingDeletion.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(resourceARN string, tags map[string]string) error

TagResource adds or updates tags on a resource identified by its ARN. Supports policy stores, policies, policy templates, and identity sources.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource identified by its ARN. Supports policy stores, policies, policy templates, and identity sources.

func (*InMemoryBackend) UpdateIdentitySource 

func (b *InMemoryBackend) UpdateIdentitySource(
	policyStoreID, identitySourceID, principalEntityType string,
	cfg IdentitySourceConfig,
) (*IdentitySource, error)

UpdateIdentitySource updates the configuration and principal entity type of an identity source.

func (*InMemoryBackend) UpdatePolicy 

func (b *InMemoryBackend) UpdatePolicy(policyStoreID, policyID string, params UpdatePolicyParams) (*Policy, error)

UpdatePolicy updates an existing policy.

func (*InMemoryBackend) UpdatePolicyStore 

func (b *InMemoryBackend) UpdatePolicyStore(
	policyStoreID, description, validationMode, deletionProtection string,
) (*PolicyStore, error)

UpdatePolicyStore updates a policy store.

func (*InMemoryBackend) UpdatePolicyTemplate 

func (b *InMemoryBackend) UpdatePolicyTemplate(
	policyStoreID, policyTemplateID, description, statement string,
) (*PolicyTemplate, error)

UpdatePolicyTemplate updates the description and statement of a policy template.

type ListPoliciesFilter 

type ListPoliciesFilter struct {
	PolicyType           string
	PolicyTemplateID     string
	PrincipalEntityType  string
	PrincipalEntityID    string
	ResourceEntityType   string
	ResourceEntityID     string
	PrincipalUnspecified bool
	ResourceUnspecified  bool
}

ListPoliciesFilter holds filter params for ListPolicies. PrincipalUnspecified / ResourceUnspecified mirror the wire filter's EntityReference "unspecified" variant: when set, only policies with no principal/resource scope match.

type OIDCGroupConfig 

type OIDCGroupConfig struct {
	GroupClaim      string `json:"groupClaim,omitempty"`
	GroupEntityType string `json:"groupEntityType,omitempty"`
}

OIDCGroupConfig holds OIDC group claim to Cedar entity mapping configuration.

type OIDCTokenSelection 

type OIDCTokenSelection struct {
	TokenType        string   `json:"tokenType,omitempty"` // IDENTITY | ACCESS
	PrincipalIDClaim string   `json:"principalIdClaim,omitempty"`
	Audiences        []string `json:"audiences,omitempty"`
}

OIDCTokenSelection holds configuration for which OIDC token to use for authorization.

type Policy 

type Policy struct {
	CreatedDate         time.Time `json:"createdDate"`
	LastUpdated         time.Time `json:"lastUpdated"`
	PolicyStoreID       string    `json:"policyStoreID"`
	PolicyID            string    `json:"policyID"`
	PolicyType          string    `json:"policyType"` // STATIC | TEMPLATE_LINKED
	Statement           string    `json:"statement"`
	Description         string    `json:"description,omitempty"`
	PolicyTemplateID    string    `json:"policyTemplateID,omitempty"`
	PrincipalEntityType string    `json:"principalEntityType,omitempty"`
	PrincipalEntityID   string    `json:"principalEntityID,omitempty"`
	ResourceEntityType  string    `json:"resourceEntityType,omitempty"`
	ResourceEntityID    string    `json:"resourceEntityID,omitempty"`
}

Policy represents a policy in a Verified Permissions policy store.

type PolicyScopeResult added in v1.2.0 

type PolicyScopeResult struct {
	Principal *entityIdentifier
	Resource  *entityIdentifier
	Effect    string
	Actions   []actionIdentifierJSON
}

PolicyScopeResult holds the scope-derived fields the real SDK echoes at the top level of policy responses: effect, actions, principal, resource. A nil *PolicyScopeResult means the statement could not be resolved or parsed (e.g. a dangling template reference); callers should omit these fields, same as AWS omits them "when [the value] isn't present in the policy content".

type PolicyStore 

type PolicyStore struct {
	CreatedDate        time.Time         `json:"createdDate"`
	LastUpdated        time.Time         `json:"lastUpdated"`
	Tags               map[string]string `json:"tags,omitempty"`
	PolicyStoreID      string            `json:"policyStoreID"`
	Arn                string            `json:"arn"`
	Description        string            `json:"description"`
	AccountID          string            `json:"accountID"`
	Region             string            `json:"region"`
	ValidationMode     string            `json:"validationMode"`
	DeletionProtection string            `json:"deletionProtection"`
}

PolicyStore represents an Amazon Verified Permissions policy store.

type PolicyStoreAlias added in v1.2.0 

type PolicyStoreAlias struct {
	CreatedAt     time.Time `json:"createdAt"`
	AliasName     string    `json:"aliasName"`
	Arn           string    `json:"arn"`
	PolicyStoreID string    `json:"policyStoreID"`
	State         string    `json:"state"`
}

PolicyStoreAlias represents a Verified Permissions policy store alias -- a human-readable, account/region-unique name that (once Active) resolves to a policy store ID and can be used in place of that ID in the policyStoreId field of nearly every other operation (see Handler.resolvePolicyStoreID). Not itself taggable: the real SDK's TagResource doc says "In Verified Permissions, policy stores can be tagged" and there is no alias ResourceType, so -- unlike PolicyStore/Policy/PolicyTemplate/ IdentitySource -- aliases are never registered in InMemoryBackend's arnIndex/resourceTags.

type PolicyStoreSchema 

type PolicyStoreSchema struct {
	CreatedDate time.Time `json:"createdDate"`
	LastUpdated time.Time `json:"lastUpdated"`
	Schema      string    `json:"schema"`

	Namespaces []string `json:"namespaces,omitempty"`
	// contains filtered or unexported fields
}

PolicyStoreSchema holds the Cedar schema for a policy store.

type PolicyTemplate 

type PolicyTemplate struct {
	CreatedDate      time.Time `json:"createdDate"`
	LastUpdated      time.Time `json:"lastUpdated"`
	PolicyStoreID    string    `json:"policyStoreID"`
	PolicyTemplateID string    `json:"policyTemplateID"`
	Description      string    `json:"description"`
	Statement        string    `json:"statement"`
}

PolicyTemplate represents a policy template in a Verified Permissions policy store.

type Provider 

type Provider struct{}

Provider implements service.Provider for Amazon Verified Permissions.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Verified Permissions service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type StorageBackend 

type StorageBackend interface {
	AccountID() string
	CreatePolicyStore(
		description string,
		tags map[string]string,
		validationMode, deletionProtection, clientToken string,
	) (*PolicyStore, error)
	GetPolicyStore(policyStoreID string) (*PolicyStore, error)
	ListPolicyStores(nextToken string, maxResults int) ([]PolicyStore, string)
	UpdatePolicyStore(policyStoreID, description, validationMode, deletionProtection string) (*PolicyStore, error)
	DeletePolicyStore(policyStoreID string) error
	CreatePolicy(policyStoreID string, params CreatePolicyParams) (*Policy, error)
	GetPolicy(policyStoreID, policyID string) (*Policy, error)
	ListPolicies(
		policyStoreID string,
		filter ListPoliciesFilter,
		nextToken string,
		maxResults int,
	) ([]Policy, string, error)
	UpdatePolicy(policyStoreID, policyID string, params UpdatePolicyParams) (*Policy, error)
	DeletePolicy(policyStoreID, policyID string) error
	PolicyScope(p *Policy) *PolicyScopeResult
	CreatePolicyTemplate(policyStoreID, description, statement, clientToken string) (*PolicyTemplate, error)
	GetPolicyTemplate(policyStoreID, policyTemplateID string) (*PolicyTemplate, error)
	ListPolicyTemplates(policyStoreID, nextToken string, maxResults int) ([]PolicyTemplate, string, error)
	UpdatePolicyTemplate(policyStoreID, policyTemplateID, description, statement string) (*PolicyTemplate, error)
	DeletePolicyTemplate(policyStoreID, policyTemplateID string) error
	Reset()
	TagResource(resourceARN string, tags map[string]string) error
	UntagResource(resourceARN string, tagKeys []string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)
	IsAuthorized(policyStoreID string, req AuthorizationRequest) (*AuthDecision, error)
	IsAuthorizedWithToken(policyStoreID string, req AuthorizationRequest) (*AuthDecision, error)
	BatchGetPolicy(items []BatchGetPolicyItem) BatchGetPolicyResult
	BatchIsAuthorized(policyStoreID string, requests []AuthorizationRequest) ([]AuthDecision, error)
	BatchIsAuthorizedWithToken(policyStoreID string, requests []AuthorizationRequest) ([]AuthDecision, error)
	CreateIdentitySource(
		policyStoreID, principalEntityType string,
		cfg IdentitySourceConfig,
		clientToken string,
	) (*IdentitySource, error)
	GetIdentitySource(policyStoreID, identitySourceID string) (*IdentitySource, error)
	DeleteIdentitySource(policyStoreID, identitySourceID string) error
	ListIdentitySources(
		policyStoreID, nextToken string,
		maxResults int,
		principalEntityTypes []string,
	) ([]IdentitySource, string, error)
	UpdateIdentitySource(
		policyStoreID, identitySourceID, principalEntityType string,
		cfg IdentitySourceConfig,
	) (*IdentitySource, error)
	PutSchema(policyStoreID, schema string) ([]string, error)
	GetSchema(policyStoreID string) (*PolicyStoreSchema, error)
	CreatePolicyStoreAlias(aliasName, policyStoreID string) (*PolicyStoreAlias, error)
	GetPolicyStoreAlias(aliasName string) (*PolicyStoreAlias, error)
	ListPolicyStoreAliases(policyStoreID, nextToken string, maxResults int) ([]PolicyStoreAlias, string)
	DeletePolicyStoreAlias(aliasName string, hardDelete bool) error
	ResolvePolicyStoreAlias(aliasName string) (string, error)
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend is the interface for Verified Permissions storage operations.

type UpdatePolicyParams 

type UpdatePolicyParams struct {
	// For STATIC updates:
	Statement   string
	Description string
	// For TEMPLATE_LINKED principal/resource updates (template id is immutable):
	PrincipalEntityType string
	PrincipalEntityID   string
	ResourceEntityType  string
	ResourceEntityID    string
}

UpdatePolicyParams holds parameters for updating a policy.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.