columnauth

type BoundColumnUse ¶

type BoundColumnUse struct {
	Column       ColumnIdentity
	Usage        Usage
	Site         string
	OutputIndex  int
	BindingAlias string
	ViewPath     string
}

BoundColumnUse is the S3 output/reference fact consumed by S4. OutputIndex is zero based and is ignored for reference-only sites.

type ColumnIdentity ¶

type ColumnIdentity struct {
	Relation   RelationIdentity
	Ordinal    int
	Name       string
	TypeDigest string
}

type Input ¶

type Input struct {
	Agent                 model.Agent
	DatasourceID          string
	Statement             model.StmtType
	PreliminaryAllowed    bool
	DatasourceSupported   bool
	CatalogConsistent     bool
	BinderDigest          string
	CatalogDigest         string
	ControlRevisionDigest string
	Relations             []RelationIdentity
	Uses                  []BoundColumnUse
	Policies              []model.Policy
	Masks                 []MaskCandidate
	Nonce                 []byte
	Now                   time.Time
}

Input is an immutable request snapshot assembled from authenticated caller state, the S3 locked manifest/catalog frame, and the control snapshot.

type MaskCandidate ¶

type MaskCandidate struct {
	OutputIndex int
	Column      ColumnIdentity
	Identity    MaskIdentity
	Capable     bool
}

type MaskIdentity ¶

type MaskIdentity struct {
	AlgorithmID         string
	SemanticVersion     string
	KeyID               string
	KeyVersion          int
	CanonicalParameters string
	InputType           string
	OutputType          string
}

MaskIdentity deliberately contains only immutable transform identity and type/capability facts. It never contains a value, result sample, predicate, or other data-derived input.

type OutputMask ¶

type OutputMask struct {
	OutputIndex int
	Identity    MaskIdentity
}

type ProtectionPlan ¶

type ProtectionPlan struct {
	// contains filtered or unexported fields
}

ProtectionPlan is request-bound. The proof material remains unexported; callers can only verify it against the original request facts and consume the already-decided mask positions.

func Authorize(input Input) ProtectionPlan

func (plan ProtectionPlan) Allowed() bool

func (plan ProtectionPlan) Digest() string

func (plan ProtectionPlan) Masks() []OutputMask

func (plan ProtectionPlan) Reason() Reason

func (plan ProtectionPlan) Verify(input Input) bool

type Reason ¶

type Reason string

Reason is a stable, identity-only authorization result. It is safe to put in a public error envelope: none of the values contains a relation or column name supplied by the database.

const (
	ReasonAllow                 Reason = "ALLOW"
	ReasonAgentDenied           Reason = "AUTH_AGENT_DENIED"
	ReasonStatementDenied       Reason = "AUTH_STATEMENT_CLASS_DENIED"
	ReasonDatasourceUnsupported Reason = "AUTH_DATASOURCE_UNSUPPORTED"
	ReasonRelationDenied        Reason = "AUTH_RELATION_DENIED"
	ReasonRelationGrantMissing  Reason = "AUTH_RELATION_GRANT_MISSING"
	ReasonIdentityUnproven      Reason = "AUTH_IDENTITY_UNPROVEN"
	ReasonColumnGrantMissing    Reason = "AUTH_COLUMN_GRANT_MISSING"
	ReasonMaskMeetUndefined     Reason = "AUTH_MASK_MEET_UNDEFINED"
	ReasonMaskCapabilityMissing Reason = "AUTH_MASK_CAPABILITY_MISSING"
)

type RelationIdentity ¶

type RelationIdentity struct {
	DatabaseID         string
	StableObjectID     string
	Schema             string
	Name               string
	CatalogFingerprint string
	BindingAlias       string
	ViewPath           string
}

RelationIdentity and ColumnIdentity are the catalog identities used by the authorizer. Names aid exact policy matching, while DatabaseID/StableObjectID and ordinal/type digest are the authority-bearing identities.

type Usage ¶

type Usage string

const (
	UsageOutput    Usage = "output"
	UsageReference Usage = "reference"
)