authz

type Engine ¶

type Engine struct {

	// MaxDepth is the recursion cap (NewEngine: DefaultMaxDepth; tests may lower it).
	MaxDepth int
	// contains filtered or unexported fields
}

Engine evaluates Zanzibar-style checks against a Store and fixed Namespace. Concurrency-safe if the Store is.

func NewEngine(store Store) *Engine

func (e *Engine) Check(ctx context.Context, objType, objID, relation, subjType, subjID string) (bool, error)

type MemoryStore ¶

type MemoryStore struct {
	// contains filtered or unexported fields
}

MemoryStore is an in-process, goroutine-safe Store for fast unit tests; not for production.

func NewMemoryStore() *MemoryStore

func (s *MemoryStore) Delete(_ context.Context, t Tuple) error

func (s *MemoryStore) ReadByObjectRelation(_ context.Context, objType, objID, relation string) ([]Tuple, error)

func (s *MemoryStore) ReadBySubject(_ context.Context, subjType, subjID string) ([]Tuple, error)

func (s *MemoryStore) Write(_ context.Context, t Tuple) error

type Namespace ¶

type Namespace struct {
	Types map[string]TypeDef
}

Namespace is the fixed, non-user-editable authorization model; DefaultNamespace returns the single canonical instance.

func DefaultNamespace() Namespace

type user
type system
  admin:   [user]
type tenant
  system:  [system]                        # parent edge (seeded at tenant create)
  admin:   [user] or admin from system      # tenant admins ∪ global admins
  owner:   [user]                           # personal-tenant owner (⊆ manager, ⊄ admin)
  manager: [user] or admin or owner         # admins AND owners are managers
  member:  [user] or manager                # managers are members
  viewer:  [user:*] or member               # wildcard enables public read
type document
  tenant:  [tenant]                         # parent edge (set at document create)
  viewer:  [user] or editor or viewer from tenant  # editors read too
  editor:  [user] or member from tenant

func (n Namespace) Relation(objType, relation string) (RelationDef, bool)

type PostgresStore ¶

type PostgresStore struct {
	// contains filtered or unexported fields
}

PostgresStore is the production GORM-backed Store, persisting to relation_tuples (model.go). Writes are idempotent via ON CONFLICT DO NOTHING on the composite-PK.

func NewPostgresStore(db *gorm.DB) *PostgresStore

func (s *PostgresStore) Delete(ctx context.Context, t Tuple) error

func (s *PostgresStore) ReadByObjectRelation(ctx context.Context, objType, objID, relation string) ([]Tuple, error)

func (s *PostgresStore) ReadBySubject(ctx context.Context, subjType, subjID string) ([]Tuple, error)

func (s *PostgresStore) Write(ctx context.Context, t Tuple) error

type RelationDef ¶

type RelationDef struct {
	Name           string
	DirectSubjects []string
	Rewrites       []Rewrite
}

RelationDef defines one relation within a type: the direct subject specs its `this` clause allows (documentation only — Check does not enforce subject typing) and the union of rewrite rules defining membership.

type RelationTuple ¶

type RelationTuple struct {
	ObjectType      string `gorm:"primaryKey;column:object_type;type:text;not null;index:idx_relation_tuples_object,priority:1"`
	ObjectID        string `gorm:"primaryKey;column:object_id;type:text;not null;index:idx_relation_tuples_object,priority:2"`
	Relation        string `gorm:"primaryKey;column:relation;type:text;not null;index:idx_relation_tuples_object,priority:3"`
	SubjectType     string `gorm:"primaryKey;column:subject_type;type:text;not null;index:idx_relation_tuples_subject,priority:1"`
	SubjectID       string `gorm:"primaryKey;column:subject_id;type:text;not null;index:idx_relation_tuples_subject,priority:2"`
	SubjectRelation string `gorm:"primaryKey;column:subject_relation;type:text;not null;default:''"`
}

RelationTuple is the GORM row backing the Postgres tuple store. The six-column tuple is the composite PK, doubling as the uniqueness constraint (a tuple is present or absent; no duplicates). Two secondary indexes serve Check's hot reads:

• idx_relation_tuples_object (object_type, object_id, relation) -> forward expansion / this + tuple_to_userset
• idx_relation_tuples_subject (subject_type, subject_id) -> reverse lookup / ReadBySubject

SubjectRelation is "" for direct (user/wildcard) subjects, the relation name for usersets.

func (RelationTuple) TableName() string

type Rewrite ¶

type Rewrite struct {
	Kind RewriteKind

	// Relation is the sibling relation to evaluate (RewriteComputedUserset).
	Relation string

	// Tupleset is the parent-edge relation read on the object; ComputedRelation
	// is evaluated on each referenced parent (RewriteTupleToUserset).
	Tupleset         string
	ComputedRelation string
}

Rewrite is a single child of a relation's union rewrite rule.

type RewriteKind ¶

type RewriteKind int

RewriteKind identifies one child of a relation's userset-rewrite union.

const (
	// RewriteThis: direct tuples on (object, relation), including a user:* wildcard.
	RewriteThis RewriteKind = iota
	// RewriteComputedUserset: subjects with Relation on the SAME object (sibling
	// relation, e.g. "member" includes "admin").
	RewriteComputedUserset
	// RewriteTupleToUserset: follow a parent edge — read (object, Tupleset) tuples
	// for parent objects, then eval ComputedRelation on each (e.g. doc editor ==
	// "member from tenant").
	RewriteTupleToUserset
)

type Store ¶

type Store interface {
	// Write persists t. If an identical tuple already exists it is a no-op.
	Write(ctx context.Context, t Tuple) error
	// Delete removes t. Deleting an absent tuple is a no-op.
	Delete(ctx context.Context, t Tuple) error
	// ReadByObjectRelation returns every tuple on (objType, objID, relation),
	// including wildcard and userset subjects.
	ReadByObjectRelation(ctx context.Context, objType, objID, relation string) ([]Tuple, error)
	// ReadBySubject returns every tuple whose subject is (subjType, subjID),
	// regardless of subject relation.
	ReadBySubject(ctx context.Context, subjType, subjID string) ([]Tuple, error)
}

Store is the tuple persistence contract Check depends on. Small by design: Check needs only the two reads; Write/Delete serve out-of-band writers. Writes are idempotent — re-writing an existing tuple is a no-op, never an error.

type Tuple ¶

type Tuple struct {
	ObjectType      string
	ObjectID        string
	Relation        string
	SubjectType     string
	SubjectID       string
	SubjectRelation string
}

Tuple is a single relation tuple:

<ObjectType>:<ObjectID>#<Relation>@<SubjectType>:<SubjectID>[#<SubjectRelation>]

SubjectRelation is "" for a direct subject (concrete user or user:* wildcard) and non-empty when the subject is a userset (type:id#relation): "everyone who has <SubjectRelation> on <SubjectType>:<SubjectID>". Plain value type; the GORM row lives in model.go.

func (t Tuple) IsUserset() bool

func (t Tuple) IsWildcard() bool

type TypeDef ¶

type TypeDef struct {
	Name      string
	Relations map[string]RelationDef
}

TypeDef is the set of relations defined on an object type.