access

type AccessPolicy struct {
	// contains filtered or unexported fields
}

type Assessment struct {
	Outcome      AssessmentOutcome
	Complete     bool
	Policies     []PolicyAssessment
	Restrictions []AssessmentRestriction
}

type AssessmentOutcome string

type AssessmentRestriction struct {
	OperationID   string
	PolicyIndex   int // Index into Assessment.Policies, including opt-in canonical delegates.
	ResourceIndex int
	Rule          string
	Slot          DecisionSlot
	Condition     dal.Condition
	Expression    *DocumentCondition
	Write         *WriteResidual
	Fields        []string
	Opaque        bool
}

type AuditDecision struct {
	Audit        bool
	Operation    Operations
	Resource     Resource
	Policy       string
	PolicySource string
	Rule         string
	Effect       string
	Explanation  string
}

type AuditPolicy struct {
	// contains filtered or unexported fields
}

type AuthorizedFieldEvidence struct {
	Path    []string
	Present bool
	Value   any
}

type AuthorizedPointEvidence struct {
	OperationID  string
	Exists       bool
	DataRevision string
	Fields       []AuthorizedFieldEvidence
}

type Bindings struct {
	Roles    map[string][]string
	Groups   map[string][]string
	Users    map[string][]string
	Everyone []string
}

type CandidateValidator func(context.Context, ProtectedOperation, map[string]any) error

type Codec interface {
	// Decode reads one policy document from the reader into document.
	Decode(io.Reader, *Document) error
	// Encode writes document to the writer.
	Encode(io.Writer, Document) error
}

type CompiledMask struct {
	// contains filtered or unexported fields
}

type DBOption func(*secureDBOptions) error

type Decision struct {
	Allowed      bool
	Operation    Operations
	Resource     Resource
	Policy       string
	PolicySource string
	Rule         string
	Effect       string
	Explanation  string
	// Code, Scope, Slot, and Columns are stable machine-readable facts for
	// authorization inspection. Explanation remains diagnostic text and must
	// never be parsed to construct a public result.
	Code    ReasonCode
	Scope   DecisionScope
	Slot    DecisionSlot
	Columns [][]string
	// Condition is the source text of the row condition behind a conditional
	// decision, with parameter names rather than resolved values.
	Condition string
	// Residuals holds, per request resource (same index as Request.Resources),
	// the resolved row condition the caller must still enforce before the
	// operation is complete: after the read for point operations, by query
	// rewrite for Query. A nil entry means the resource is allowed outright.
	// Residuals is nil for an unconditional decision.
	Residuals []dal.Condition
	// ResidualDocuments preserves source expressions with unresolved params.
	ResidualDocuments []*DocumentCondition
	// Writes holds, per request resource, the ordered alternatives that decide
	// a write on that resource (see WriteResidual). A nil entry means the write
	// is allowed outright, with no row or post-image constraint.
	Writes []*WriteResidual
}

type DecisionScope string

type DecisionSlot string

type DecodeOption func(*decodeOptions)

type DeniedError struct {
	Decision Decision
	// Decisions contains every independently evaluated mandatory policy in
	// configured order. Decision remains the first denial for legacy callers.
	Decisions []Decision
}

type Document struct {
	APIVersion string           `json:"apiVersion" yaml:"apiVersion"`
	Kind       string           `json:"kind" yaml:"kind"`
	Metadata   DocumentMetadata `json:"metadata" yaml:"metadata"`
	Default    string           `json:"default" yaml:"default"`
	Scopes     []DocumentScope  `json:"scopes,omitempty" yaml:"scopes,omitempty"`
	// RuleSets and Bindings describe a principal policy set: named rule sets
	// (each a scope tree like Scopes) and the roles, groups, users and
	// everyone they are bound to. A document has either Scopes or both
	// RuleSets and Bindings.
	RuleSets map[string][]DocumentScope `json:"ruleSets,omitempty" yaml:"ruleSets,omitempty"`
	Bindings *DocumentBindings          `json:"bindings,omitempty" yaml:"bindings,omitempty"`
}

type DocumentBindings struct {
	Roles    map[string][]string `json:"roles,omitempty" yaml:"roles,omitempty"`
	Groups   map[string][]string `json:"groups,omitempty" yaml:"groups,omitempty"`
	Users    map[string][]string `json:"users,omitempty" yaml:"users,omitempty"`
	Everyone []string            `json:"everyone,omitempty" yaml:"everyone,omitempty"`
}

type DocumentCondition struct {
	Op    string              `json:"op,omitempty" yaml:"op,omitempty"`
	Left  *DocumentExpression `json:"left,omitempty" yaml:"left,omitempty"`
	Right *DocumentExpression `json:"right,omitempty" yaml:"right,omitempty"`
	And   []DocumentCondition `json:"and,omitempty" yaml:"and,omitempty"`
	Or    []DocumentCondition `json:"or,omitempty" yaml:"or,omitempty"`
}

type DocumentExpression struct {
	Field  string `json:"field,omitempty" yaml:"field,omitempty"`
	Value  any    `json:"value,omitempty" yaml:"value,omitempty"`
	Values any    `json:"values,omitempty" yaml:"values,omitempty"`
	Param  string `json:"param,omitempty" yaml:"param,omitempty"`
}

type DocumentMetadata struct {
	Name string `json:"name" yaml:"name"`
}

type DocumentRule struct {
	ID         string   `json:"id" yaml:"id"`
	Effect     string   `json:"effect" yaml:"effect"`
	Operations []string `json:"operations" yaml:"operations"`
	// Where is an optional row condition on an allow rule, written in the
	// TugQL condition syntax with a `param` expression for runtime variables.
	Where *DocumentCondition `json:"where,omitempty" yaml:"where,omitempty"`
	// Check is an optional post-image condition on an allow rule: what a row
	// written under the rule must satisfy afterwards. Defaults to Where.
	Check *DocumentCondition `json:"check,omitempty" yaml:"check,omitempty"`
	// Fields is an optional allow-list of field patterns on an allow rule.
	Fields []string `json:"fields,omitempty" yaml:"fields,omitempty"`
	// contains filtered or unexported fields
}

type DocumentScope struct {
	Path            string          `json:"path,omitempty" yaml:"path,omitempty"`
	CollectionGroup string          `json:"collectionGroup,omitempty" yaml:"collectionGroup,omitempty"`
	OpaqueQuery     bool            `json:"opaqueQuery,omitempty" yaml:"opaqueQuery,omitempty"`
	Table           *TableName      `json:"table,omitempty" yaml:"table,omitempty"`
	Rules           []DocumentRule  `json:"rules,omitempty" yaml:"rules,omitempty"`
	Scopes          []DocumentScope `json:"scopes,omitempty" yaml:"scopes,omitempty"`
}

type EnforcementCoordinator struct {
	// contains filtered or unexported fields
}

type ExecutionClass string

type ExecutionEntry struct {
	Class     ExecutionClass `json:"class" yaml:"class"`
	Namespace string         `json:"namespace,omitempty" yaml:"namespace,omitempty"`
	Mask      *Mask          `json:"mask,omitempty" yaml:"mask,omitempty"`
}

type ExecutionGate struct {
	Allow []ExecutionEntry `json:"allow" yaml:"allow"`
}

type ExecutionReceipt struct {
	OperationID  string
	DataRevision string
}

type ExecutionSession interface {
	InspectionSession
	// Execute performs the protected writes when the assessment allows them.
	Execute(context.Context) (Assessment, error)
	// Receipts returns per-operation data revisions after a successful Execute.
	Receipts(context.Context) ([]ExecutionReceipt, error)
	// Revisions maps operation ids to data revisions from Receipts.
	Revisions(context.Context) (map[string]string, error)
	// contains filtered or unexported methods
}

type ExecutionTarget struct {
	Class     ExecutionClass
	Namespace string
	Name      string
}

type FilePolicyConfig struct {
	Enabled  bool     `json:"enabled" yaml:"enabled"`
	Database string   `json:"database" yaml:"database"`
	Realm    string   `json:"realm,omitempty" yaml:"realm,omitempty"`
	Policies []string `json:"policies" yaml:"policies"`
}

type InspectionPurePolicy interface {
	Policy
	// InspectionPure reports whether Decide is safe for plan and inspection evaluation.
	InspectionPure() bool
}

type InspectionSession interface {
	// Assess returns the assessment for the protected operations.
	Assess(context.Context) (Assessment, error)
	// Evidence returns authorized field evidence when the assessment allows it.
	Evidence(context.Context) ([]AuthorizedPointEvidence, error)
	// ReadVisibility reports which operation records are visible to the ingress principal.
	ReadVisibility(context.Context) (map[string]bool, error)
	// ReadVisibilityFor intersects ingress visibility with visibility for the given principal.
	ReadVisibilityFor(context.Context, Principal) (map[string]bool, error)
	// contains filtered or unexported methods
}

type JSONCodec struct{}

type MandatoryParticipant struct {
	LayerID   string
	Provider  PolicyLeaseProvider
	Validator CandidateValidator
}

type Mask struct {
	Stages []MaskStage `json:"stages" yaml:"stages"`
}

type MaskKind string

type MaskStage struct {
	Include []string `json:"include,omitempty" yaml:"include,omitempty"`
	Exclude []string `json:"exclude,omitempty" yaml:"exclude,omitempty"`
}

type Operations uint16

type PathPattern struct {
	// contains filtered or unexported fields
}

type Policy interface {
	// Name returns the policy name.
	Name() string
	// Decide evaluates the request and returns the authorization decision.
	Decide(context.Context, Request) Decision
	// Authorize returns an error when the request is not allowed.
	Authorize(context.Context, Request) error
}

type PolicyAssessment struct {
	OperationID string
	LayerID     string
	Policy      PolicyMetadata
	Decision    Decision
}

type PolicyLease interface {
	// Policies returns the pinned policies.
	Policies() []Policy
	// Revision returns the snapshot revision.
	Revision() string
	// Release releases the lease.
	Release()
}

type PolicyLeaseProvider func(context.Context) (PolicyLease, error)

type PolicyMetadata struct {
	ID         string
	Revision   string
	Visibility PolicyVisibility
	Source     string
}

type PolicyMetadataProvider interface {
	// PolicyMetadata returns the policy's trusted owner metadata.
	PolicyMetadata() PolicyMetadata
}

type PolicyProvider func(context.Context) ([]Policy, error)

type PolicyProviderError struct{ Err error }

type PolicyVisibility string

type Principal struct {
	Subject            *PrincipalRef
	Actor              *PrincipalRef
	ID                 any // legacy untyped user identity, used only when Subject is nil
	Roles              []string
	Groups             []string
	MembershipRevision string
}

type PrincipalKind string

type PrincipalPolicySet struct {
	// contains filtered or unexported fields
}

type PrincipalRef struct {
	Realm string        `json:"realm" yaml:"realm"`
	Kind  PrincipalKind `json:"kind" yaml:"kind"`
	ID    string        `json:"id" yaml:"id"`
}

type ProtectedEvidence struct {
	OperationID, CanonicalTarget, SnapshotToken, DataRevision, CandidateRevision string
	Exists, Complete                                                             bool
	PreImage, CandidateImage                                                     map[string]any
	PreparationError                                                             error
}

type ProtectedExecutionStorage interface {
	ProtectedInspectionStorage
	// Execute performs the protected writes.
	Execute(context.Context) error
}

type ProtectedInspectionStorage interface {
	// Evidence returns private storage evidence for the protected operations.
	Evidence(context.Context) ([]ProtectedEvidence, error)
}

type ProtectedOperation struct {
	// contains filtered or unexported fields
}

type ProtectedStorage interface {
	// WithinProtectedInspection runs the callback inside the trusted inspection boundary.
	WithinProtectedInspection(context.Context, []ProtectedOperation, func(ProtectedInspectionStorage) error) error
	// WithinProtectedExecution runs the callback inside the trusted execution boundary.
	WithinProtectedExecution(context.Context, []ProtectedOperation, func(ProtectedExecutionStorage) error) error
}

type ProtectedUpdate struct {
	Path   []string
	Value  any
	Delete bool
}

type ReasonCode string

type Request struct {
	Operation Operations
	Resources []Resource
	// Query retains the structured or opaque query for custom policies and
	// future predicate, projection, index, and cost constraints. It is nil for
	// non-query operations; v1 declarative policies authorize query sources.
	Query dal.Query
	// Execution is trusted assessment metadata, never a caller override of Query.
	Execution *ExecutionTarget
	// Columns is the normalized set of fields explicitly read or touched by a
	// non-query operation. Paths use one string per segment.
	Columns [][]string
}

type Resource struct {
	// contains filtered or unexported fields
}

type ResourceKind string

type Rule struct {
	// contains filtered or unexported fields
}

type TableName struct {
	Database string `json:"database,omitempty" yaml:"database,omitempty"`
	Schema   string `json:"schema,omitempty" yaml:"schema,omitempty"`
	Name     string `json:"name" yaml:"name"`
}

type TugQLDocument struct {
	APIVersion     string                  `json:"apiVersion" yaml:"apiVersion"`
	Kind           string                  `json:"kind" yaml:"kind"`
	Metadata       TugQLMetadata           `json:"metadata" yaml:"metadata"`
	Target         TugQLTarget             `json:"target" yaml:"target"`
	Composition    string                  `json:"composition" yaml:"composition"`
	Default        string                  `json:"default" yaml:"default"`
	Scopes         []TugQLScope            `json:"scopes,omitempty" yaml:"scopes,omitempty"`
	RuleSets       map[string][]TugQLScope `json:"ruleSets,omitempty" yaml:"ruleSets,omitempty"`
	Bindings       *DocumentBindings       `json:"bindings,omitempty" yaml:"bindings,omitempty"`
	Execution      *ExecutionGate          `json:"execution,omitempty" yaml:"execution,omitempty"`
	CollectionMask *Mask                   `json:"collectionMask,omitempty" yaml:"collectionMask,omitempty"`
}

type TugQLMetadata struct {
	Name        string `json:"name" yaml:"name"`
	Description string `json:"description,omitempty" yaml:"description,omitempty"`
	Visibility  string `json:"visibility,omitempty" yaml:"visibility,omitempty"`
}

type TugQLRule struct {
	ID         string             `json:"id" yaml:"id"`
	Effect     string             `json:"effect" yaml:"effect"`
	Operations []string           `json:"operations" yaml:"operations"`
	Where      *DocumentCondition `json:"where,omitempty" yaml:"where,omitempty"`
	Check      *DocumentCondition `json:"check,omitempty" yaml:"check,omitempty"`
	Fields     []string           `json:"fields,omitempty" yaml:"fields,omitempty"`
	FieldMask  *Mask              `json:"fieldMask,omitempty" yaml:"fieldMask,omitempty"`
}

type TugQLScope struct {
	Path            string       `json:"path,omitempty" yaml:"path,omitempty"`
	CollectionGroup string       `json:"collectionGroup,omitempty" yaml:"collectionGroup,omitempty"`
	OpaqueQuery     bool         `json:"opaqueQuery,omitempty" yaml:"opaqueQuery,omitempty"`
	Rules           []TugQLRule  `json:"rules,omitempty" yaml:"rules,omitempty"`
	Scopes          []TugQLScope `json:"scopes,omitempty" yaml:"scopes,omitempty"`
	CollectionMask  *Mask        `json:"collectionMask,omitempty" yaml:"collectionMask,omitempty"`
}

type TugQLTarget struct {
	Database string `json:"database" yaml:"database"`
}

type WriteAlternative struct {
	Rule      string
	Where     dal.Condition
	Check     dal.Condition
	WhereText string
	CheckText string
	// Fields is the rule's allow-list of field patterns; nil means every field.
	Fields        []string
	WhereDocument *DocumentCondition
	CheckDocument *DocumentCondition
	// contains filtered or unexported fields
}

type WriteResidual struct {
	Alternatives []WriteAlternative
	Terminal     *WriteAlternative
}

type YAMLCodec struct{}