authorization

package
v0.87.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 23, 2026 License: MIT Imports: 8 Imported by: 0

Documentation

Overview

Package authorization defines the portable DTQL authorization result wire contract.

Index

Constants

View Source 
const (
	CodeAccessDenied           = access.CodeAccessDenied
	CodeRuleDenied             = access.CodeRuleDenied
	CodeNoMatch                = access.CodeNoMatch
	CodeRowPredicateFailed     = access.CodeRowPredicateFailed
	CodePostImageFailed        = access.CodePostImageFailed
	CodeColumnDenied           = access.CodeColumnDenied
	CodeEvaluationFailed       = access.CodeEvaluationFailed
	CodeConfigurationInvalid   = access.CodeConfigurationInvalid
	CodeSourceUnavailable      = access.CodeSourceUnavailable
	CodeEnforcementUnsupported = access.CodeEnforcementUnsupported
	CodePrincipalUnresolved    = access.CodePrincipalUnresolved
	CodeCapabilityDenied       = access.CodeCapabilityDenied
	CodeExecutionClassDenied   = access.CodeExecutionClassDenied
	CodeCallableDenied         = access.CodeCallableDenied
	CodeCollectionDenied       = access.CodeCollectionDenied
)
View Source 
const APIVersion = "dtql.org/authorization/v1"

Variables

This section is empty.

Functions

func MarshalResult 

func MarshalResult(result Result) ([]byte, error)

Types

type AuthorizationResult 

type AuthorizationResult = Result

type BindingRef 

type BindingRef struct {
	Kind string `json:"kind"`
	ID   string `json:"id"`
}

type Blocker 

type Blocker struct {
	OperationID    string         `json:"operationId"`
	Code           ReasonCode     `json:"code"`
	Scope          Scope          `json:"scope"`
	Resource       *Resource      `json:"resource,omitempty"`
	LayerID        string         `json:"layerId,omitempty"`
	PolicyRef      *PolicyRef     `json:"policyRef,omitempty"`
	Slot           string         `json:"slot,omitempty"`
	Columns        [][]string     `json:"columns,omitempty"`
	Retryable      *bool          `json:"retryable,omitempty"`
	ExecutionClass ExecutionClass `json:"executionClass,omitempty"`
	Callable       *Callable      `json:"callable,omitempty"`
}

type Callable 

type Callable struct {
	Namespace string `json:"namespace"`
	Name      string `json:"name"`
}

type Coverage 

type Coverage struct {
	Evaluation  EvaluationCompleteness `json:"evaluation"`
	Disclosure  DisclosureCompleteness `json:"disclosure"`
	Truncated   bool                   `json:"truncated"`
	Unevaluated []Unevaluated          `json:"unevaluated"`
}

type DisclosureCompleteness 

type DisclosureCompleteness string
const (
	DisclosureFull     DisclosureCompleteness = "full"
	DisclosureRedacted DisclosureCompleteness = "redacted"
)

type EvaluationCompleteness 

type EvaluationCompleteness string
const (
	EvaluationComplete EvaluationCompleteness = "complete"
	EvaluationPartial  EvaluationCompleteness = "partial"
)

type ExecutionClass 

type ExecutionClass string
const (
	ExecutionDTQL            ExecutionClass = "dtql"
	ExecutionNativeSQL       ExecutionClass = "native_sql"
	ExecutionNativeGraphQL   ExecutionClass = "native_graphql"
	ExecutionStoredProcedure ExecutionClass = "stored_procedure"
)

type Layer 

type Layer struct {
	LayerID        string          `json:"layerId"`
	Source         Source          `json:"source"`
	ACLState       string          `json:"aclState"`
	Result         Outcome         `json:"result"`
	PolicyRevision string          `json:"policyRevision,omitempty"`
	Decisions      []LayerDecision `json:"decisions"`
}

type LayerDecision 

type LayerDecision struct {
	OperationID    string       `json:"operationId"`
	Result         Outcome      `json:"result"`
	PolicyRef      *PolicyRef   `json:"policyRef,omitempty"`
	Scope          Scope        `json:"scope"`
	RuleRefs       []string     `json:"ruleRefs,omitempty"`
	BindingRefs    []BindingRef `json:"bindingRefs,omitempty"`
	RestrictionIDs []string     `json:"restrictionIds"`
}

type Mode 

type Mode string
const (
	ModePlan      Mode = "plan"
	ModeInspect   Mode = "inspect"
	ModeSample    Mode = "sample"
	ModeExecution Mode = "execution"
)

type OperationRef 

type OperationRef struct {
	ID                 string `json:"id"`
	RequestOperationID string `json:"requestOperationId"`
}

type OperationResult 

type OperationResult struct {
	ID                 string         `json:"id"`
	RequestOperationID string         `json:"requestOperationId"`
	Action             string         `json:"action"`
	Resource           Resource       `json:"resource"`
	Result             Outcome        `json:"result"`
	RestrictionIDs     []string       `json:"restrictionIds"`
	AllOf              []string       `json:"allOf"`
	ExecutionClass     ExecutionClass `json:"executionClass"`
	Callable           *Callable      `json:"callable,omitempty"`
}

type Outcome 

type Outcome string
const (
	OutcomeAllow         Outcome = "allow"
	OutcomeConditional   Outcome = "conditional"
	OutcomeDeny          Outcome = "deny"
	OutcomeIndeterminate Outcome = "indeterminate"
)

type PolicyRef 

type PolicyRef struct {
	OwnerID    string `json:"ownerId"`
	DatabaseID string `json:"databaseId"`
	PolicyID   string `json:"policyId"`
	Revision   string `json:"revision"`
	RuleID     string `json:"ruleId,omitempty"`
}

type ReasonCode 

type ReasonCode = access.ReasonCode

type Resource 

type Resource struct {
	DatabaseID string     `json:"databaseId"`
	Path       string     `json:"path"`
	Table      string     `json:"table,omitempty"`
	RowID      string     `json:"rowId,omitempty"`
	Columns    [][]string `json:"columns,omitempty"`
}

type Restriction 

type Restriction struct {
	ID             string                    `json:"id"`
	OperationID    string                    `json:"operationId"`
	LayerID        string                    `json:"layerId,omitempty"`
	PolicyRef      *PolicyRef                `json:"policyRef,omitempty"`
	Enforced       bool                      `json:"enforced"`
	Representation string                    `json:"representation"`
	Kind           string                    `json:"kind"`
	Expression     *access.DocumentCondition `json:"expression,omitempty"`
	Fields         []string                  `json:"fields,omitempty"`
	OmissionReason string                    `json:"omissionReason,omitempty"`
	Mask           *access.Mask              `json:"mask,omitempty"`
}

type Result 

type Result struct {
	APIVersion   string            `json:"apiVersion"`
	RequestID    string            `json:"requestId"`
	Mode         Mode              `json:"mode"`
	Scope        Scope             `json:"scope"`
	Result       Outcome           `json:"result"`
	Allowed      bool              `json:"allowed"`
	Hypothetical bool              `json:"hypothetical"`
	Operations   []OperationResult `json:"operations"`
	Layers       []Layer           `json:"layers"`
	Blockers     []Blocker         `json:"blockers"`
	Coverage     Coverage          `json:"coverage"`
	Restrictions []Restriction     `json:"restrictions"`
	Sample       *Sample           `json:"sample,omitempty"`
}

func DecodeResultCompatible 

func DecodeResultCompatible(data []byte) (Result, error)

DecodeResultCompatible decodes returned results while preserving unknown future blocker codes. All other frozen-v1 validation remains strict, and an unknown blocker can never coexist with an allowed result.

func ParseResult 

func ParseResult(data []byte) (Result, error)

func (Result) Validate 

func (result Result) Validate() error

type Sample 

type Sample struct {
	RequestedLimit      int           `json:"requestedLimit"`
	EvaluatedCount      int           `json:"evaluatedCount"`
	Selection           string        `json:"selection"`
	Order               []SampleOrder `json:"order"`
	Exhaustive          bool          `json:"exhaustive"`
	TemplateOperationID string        `json:"templateOperationId"`
	SelectionResource   Resource      `json:"selectionResource"`
}

type SampleOrder 

type SampleOrder struct {
	Field     []string `json:"field"`
	Direction string   `json:"direction"`
}

type Scope 

type Scope string
const (
	ScopeRequest       Scope = "request"
	ScopeSample        Scope = "sample"
	ScopeDatabase      Scope = "database"
	ScopeTable         Scope = "table"
	ScopeRow           Scope = "row"
	ScopeColumn        Scope = "column"
	ScopeOperation     Scope = "operation"
	ScopePrincipal     Scope = "principal"
	ScopeConfiguration Scope = "configuration"
)

type Source 

type Source struct {
	OwnerID    string `json:"ownerId"`
	Provider   string `json:"provider"`
	DatabaseID string `json:"databaseId"`
	Kind       string `json:"kind"`
	Reference  string `json:"reference,omitempty"`
}

type Unevaluated 

type Unevaluated struct {
	OperationID string `json:"operationId"`
	LayerID     string `json:"layerId,omitempty"`
	Reason      string `json:"reason"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.