directory

type AuditEvent ¶ added in v0.35.0

type AuditEvent struct {
	Sequence   AuditSequence
	Revision   uint64
	Time       time.Time
	Actor      string
	Action     string
	ID         string
	Alias      string
	PreviousID string
}

type AuditSequence ¶ added in v0.35.0

type AuditSequence uint64

AuditSequence identifies one audit event, independently of directory revisions: several events can belong to the same mutation. Zero starts at the beginning.

type BindingSnapshot ¶ added in v0.35.0

type BindingSnapshot struct {
	Revision uint64
	Groups   []GroupBinding
}

BindingSnapshot lets administrators bind a review to the exact directory revision they inspected. Deleted bindings retain the former group ID.

type Directory ¶

type Directory interface {
	LookupUser(context.Context, string) (*User, Revision, error)
}

Directory resolves users within one configured identity provider. LookupUser returns the user and revision from one coherent snapshot. Missing users return nil with a nonempty revision; storage failure is an error, never a missing user.

type Group ¶ added in v0.35.0

type Group struct {
	Metadata
	ExternalID  string
	DisplayName string
	MemberIDs   []string // Stored user IDs, not provider ExternalIDs.
}

Group owns direct user memberships. DisplayName can change independently of the stable policy alias, whose binding is managed separately by the store.

type GroupBinding ¶ added in v0.35.0

type GroupBinding struct {
	ID          string
	DisplayName string
	Alias       string
	Status      string
}

type ManagedUser ¶ added in v0.35.0

type ManagedUser struct {
	Metadata
	ExternalID   string
	UserName     string
	Active       bool
	UserType     string
	Department   string
	Organization string
}

ManagedUser contains the identity and attributes used by authorization. Active is explicit at the storage boundary; the HTTP adapter supplies the SCIM default. Group membership is owned by Group, not by the user.

type Metadata ¶ added in v0.35.0

type Metadata struct {
	ID       string
	Version  uint64
	Created  time.Time
	Modified time.Time
}

Metadata is assigned by storage. ID identifies the provisioned user or group; it is distinct from the provider's ExternalID used for authentication. Version changes on mutations, including membership cleanup after user deletion.

func (m Metadata) ETag() string

type Revision ¶ added in v0.35.0

type Revision string

Revision identifies an opaque, coherent directory snapshot. Callers may compare revisions for equality but must not interpret their contents.

type Store ¶ added in v0.35.0

type Store interface {
	Directory
	CreateUser(context.Context, ManagedUser) (ManagedUser, error)
	ReplaceUser(ctx context.Context, id string, user ManagedUser, match string) (ManagedUser, error)
	DeleteUser(ctx context.Context, id, match string) error
	GetUser(context.Context, string) (ManagedUser, error)
	ListUsers(ctx context.Context, start, count int) ([]ManagedUser, int, error)
	CreateGroup(context.Context, Group) (Group, error)
	ReplaceGroup(ctx context.Context, id string, group Group, match string) (Group, error)
	DeleteGroup(ctx context.Context, id, match string) error
	GetGroup(context.Context, string) (Group, error)
	ListGroups(ctx context.Context, start, count int) ([]Group, int, error)
	Bindings(context.Context) (BindingSnapshot, error)
	Rebind(ctx context.Context, actor, alias, id string, expected uint64, authorizationRevision Revision) error
	// Audit returns at most limit events after the exclusive sequence cursor,
	// in sequence order. Zero limit uses DefaultAuditLimit; limits above
	// MaxAuditLimit are invalid. An empty result means the cursor is caught up.
	Audit(ctx context.Context, after AuditSequence, limit int) ([]AuditEvent, error)
	Close() error
}

Store owns directory persistence and all changes to authorization indexes. Each mutation commits the user or group, memberships, aliases, audit and revision together. No database handles or multi-call transaction protocol escape here. Get methods return independent snapshots; each List returns a typed slice and total count from one snapshot (start is one-based). LookupUser resolves identity, memberships and aliases in a single read. Backend failures stay errors.

Replace/Delete accept an optional resource ETag ("*" requires existence). A stale precondition never changes state. Rebind requires an exact directory revision and the snapshot revision used to authorize the administrator. A concurrent change to that authorization snapshot also invalidates the write.

type User ¶

type User struct {
	UserName     string
	ID           string
	Active       bool
	Groups       []string
	UserType     string
	Department   string
	Organization string
}