directory

type AuditEvent ¶ added in v0.35.0

type AuditEvent struct {
	Sequence   AuditSequence
	Revision   uint64
	Time       time.Time
	Actor      string
	Action     string
	ID         string
	Alias      string
	PreviousID string
}

type AuditSequence ¶ added in v0.35.0

type AuditSequence uint64

AuditSequence identifies one audit event, independently of directory revisions: several events can belong to the same mutation. Zero starts at the beginning.

type BindingSnapshot ¶ added in v0.35.0

type BindingSnapshot struct {
	Revision uint64
	Groups   []GroupBinding
}

BindingSnapshot lets administrators bind a review to the exact directory revision they inspected. Deleted bindings retain the former group ID.

type Directory ¶

type Directory interface {
	LookupUser(context.Context, string) (*User, Revision, error)
}

Directory resolves users within one configured identity provider. LookupUser returns the user and revision from one coherent snapshot. Missing users return nil with a nonempty revision; storage failure is an error, never a missing user.

type Group ¶ added in v0.35.0

type Group struct {
	Metadata
	ExternalID  string
	DisplayName string
	MemberIDs   []string // Stored user IDs, not provider ExternalIDs.
}

Group owns direct user memberships. DisplayName can change independently of the stable policy alias, whose binding is managed separately by the store.

type GroupBinding ¶ added in v0.35.0

type GroupBinding struct {
	ID          string
	DisplayName string
	Alias       string
	Status      string
}

type ManagedUser ¶ added in v0.35.0

type ManagedUser struct {
	Metadata
	ExternalID   string
	UserName     string
	Active       bool
	UserType     string
	Department   string
	Organization string
}

ManagedUser contains the identity and attributes used by authorization. Active is explicit at the storage boundary; the HTTP adapter supplies the SCIM default. Group membership is owned by Group, not by the user.

type Metadata ¶ added in v0.35.0

type Metadata struct {
	ID       string
	Version  uint64
	Created  time.Time
	Modified time.Time
}

Metadata is assigned by storage. ID identifies the provisioned user or group; it is distinct from the provider's ExternalID used for authentication. Version changes on mutations, including membership cleanup after user deletion.

func (m Metadata) ETag() string

type Revision ¶ added in v0.35.0

type Revision string

Revision identifies an opaque, coherent directory snapshot. Callers may compare revisions for equality but must not interpret their contents.

type Store ¶ added in v0.35.0

type Store interface {
	Directory
	UserLister
	CreateUser(context.Context, ManagedUser) (ManagedUser, error)
	ReplaceUser(ctx context.Context, id string, user ManagedUser, match string) (ManagedUser, error)
	DeleteUser(ctx context.Context, id, match string) error
	GetUser(context.Context, string) (ManagedUser, error)
	ListUsers(ctx context.Context, start, count int) ([]ManagedUser, int, error)
	CreateGroup(context.Context, Group) (Group, error)
	ReplaceGroup(ctx context.Context, id string, group Group, match string) (Group, error)
	DeleteGroup(ctx context.Context, id, match string) error
	GetGroup(context.Context, string) (Group, error)
	ListGroups(ctx context.Context, start, count int) ([]Group, int, error)
	Bindings(context.Context) (BindingSnapshot, error)
	Rebind(ctx context.Context, actor, alias, id string, expected uint64, authorizationRevision Revision) error
	// Audit returns at most limit events after the exclusive sequence cursor,
	// in sequence order. Zero limit uses DefaultAuditLimit; limits above
	// MaxAuditLimit are invalid. An empty result means the cursor is caught up.
	Audit(ctx context.Context, after AuditSequence, limit int) ([]AuditEvent, error)
	Close() error
}

Store owns directory persistence and all changes to authorization indexes. Each mutation commits the user or group, memberships, aliases, audit and revision together. No database handles or multi-call transaction protocol escape here. Get methods return independent snapshots; each List returns a typed slice and total count from one snapshot (start is one-based). LookupUser resolves identity, memberships and aliases in a single read. Backend failures stay errors.

Replace/Delete accept an optional resource ETag ("*" requires existence). A stale precondition never changes state. Rebind requires an exact directory revision and the snapshot revision used to authorize the administrator. A concurrent change to that authorization snapshot also invalidates the write.

type User ¶

type User struct {
	UserName     string
	ID           string
	Active       bool
	Groups       []string
	UserType     string
	Department   string
	Organization string
}

type UserLister ¶ added in v0.36.0

type UserLister interface {
	ListUserFacts(context.Context) ([]User, Revision, error)
}

UserLister supplies administration with all users, including inactive users, and their policy-visible groups from one snapshot. IDs are authentication identities, not provisioning resource IDs. Results are ordered by userName then ID; users and group slices are independent copies, with groups sorted by name. Authorization consumers need only Directory.LookupUser.