openvaultdb

type AuthorizationError ¶

type AuthorizationError struct{ Decision az.Result }

AuthorizationError retains the owner's validated structured denial internally. Its Error string is deliberately safe for the existing public API error mapper.

func (*AuthorizationError) Error() string

func (*AuthorizationError) Unwrap() error

type Client ¶

type Client struct{ HTTP *http.Client }

func (c Client) Evidence(ctx context.Context, target Target, body []byte) (Response, error)

func (c Client) Explain(ctx context.Context, target Target, body []byte) (Response, error)

func (c Client) Query(ctx context.Context, target Target, dtql []byte) (Response, error)

func (c Client) Update(ctx context.Context, target Target, table, row string, body []byte) (Response, error)

type Response ¶

type Response struct {
	StatusCode int
	Body       []byte
	Type       string
}

type SourceConfig ¶

type SourceConfig struct {
	BaseURL     string `json:"baseUrl"`
	DatabaseID  string `json:"databaseId"`
	TokenEnv    string `json:"tokenEnv"`
	PrincipalID string `json:"principalId"`
}

SourceConfig is CLI-owned connection metadata referenced by a normal project catalog's Path. Tokens remain in the daemon environment. PrincipalID binds the configured credential to the fixed local session; OVDB authenticates its own token and resolves memberships independently. No caller-supplied identity is sent.

type Target ¶

type Target struct {
	BaseURL    string
	DatabaseID string
	Token      string
}

func (t Target) Validate() error