acl

package
v1.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 26, 2026 License: MIT Imports: 8 Imported by: 0

Documentation

Overview

Package acl provides typed subject-to-resource access control lists.

Example 
package main

import (
	"context"
	"fmt"

	authorization "github.com/faustbrian/go-authorization"
	"github.com/faustbrian/go-authorization/acl"
)

func main() {
	accessList, err := acl.New([]acl.Entry{
		{
			ID: "reader",
			Subject: authorization.Subject{
				Kind: authorization.SubjectUser,
				ID:   "alice",
			},
			Action:       "document.read",
			ResourceType: "document",
			Effect:       authorization.Allow,
		},
	})
	if err != nil {
		panic(err)
	}

	decision, err := accessList.Evaluate(context.Background(), authorization.Request{
		Subject: authorization.Subject{
			Kind: authorization.SubjectUser,
			ID:   "alice",
		},
		Action: "document.read",
		Resource: authorization.Resource{
			Type: "document",
			ID:   "document-1",
		},
	})
	if err != nil {
		panic(err)
	}

	fmt.Println(decision.Outcome == authorization.Allow)
}

Output:
true

Index

Examples

Constants

View Source 
const (
	ReasonAllow         authorization.ReasonCode = "acl-allow"
	ReasonExplicitDeny  authorization.ReasonCode = "acl-explicit-deny"
	ReasonLimitExceeded authorization.ReasonCode = "acl-limit-exceeded"
)
View Source 
const (
	EffectAllow = "allow"
	EffectDeny  = "deny"
)
View Source 
const DocumentVersion uint64 = 1

Variables

View Source 
var (
	ErrInvalidEntry         = errors.New("invalid ACL entry")
	ErrDuplicateEntry       = errors.New("duplicate ACL entry")
	ErrEntryLimitExceeded   = errors.New("ACL entry limit exceeded")
	ErrGroupLimitExceeded   = errors.New("ACL group limit exceeded")
	ErrMatchLimitExceeded   = errors.New("ACL match limit exceeded")
	ErrBatchLimitExceeded   = errors.New("ACL batch limit exceeded")
	ErrUnboundedResourceSet = errors.New("ACL resource set is unbounded")
)
View Source 
var (
	ErrInvalidDocument            = errors.New("invalid ACL document")
	ErrUnsupportedDocumentVersion = errors.New("unsupported ACL document version")
	ErrDocumentLimitExceeded      = errors.New("ACL document size limit exceeded")
)

Functions

func EncodeDocument 

func EncodeDocument(document Document) ([]byte, error)

Types

type Decoder 

type Decoder struct{}

func (Decoder) Decode 

func (Decoder) Decode(document json.RawMessage) (authorization.Evaluator, error)

type Document 

type Document struct {
	Version           uint64          `json:"version"`
	GlobalInheritance bool            `json:"global_inheritance,omitempty"`
	Limits            Limits          `json:"limits,omitempty"`
	Entries           []EntryDocument `json:"entries"`
}

func (Document) Build 

func (document Document) Build() (*Evaluator, error)

type Entry 

type Entry struct {
	ID           EntryID
	Subject      authorization.Subject
	Action       authorization.Action
	ResourceType authorization.ResourceType
	ResourceID   authorization.ResourceID
	Tenant       authorization.TenantID
	Effect       authorization.Outcome
}

Entry grants or denies one subject an action on a resource type or instance.

type EntryDocument 

type EntryDocument struct {
	ID           EntryID                    `json:"id"`
	SubjectKind  authorization.SubjectKind  `json:"subject_kind"`
	SubjectID    authorization.SubjectID    `json:"subject_id"`
	Action       authorization.Action       `json:"action"`
	ResourceType authorization.ResourceType `json:"resource_type"`
	ResourceID   authorization.ResourceID   `json:"resource_id,omitempty"`
	Tenant       authorization.TenantID     `json:"tenant,omitempty"`
	Effect       string                     `json:"effect"`
}

type EntryID 

type EntryID = authorization.PolicyID

type Evaluator 

type Evaluator struct {
	// contains filtered or unexported fields
}

Evaluator resolves immutable ACL entries without external I/O.

func DecodeDocument 

func DecodeDocument(encoded []byte) (*Evaluator, error)

func New 

func New(entries []Entry, options ...Option) (*Evaluator, error)

New validates and indexes ACL entries.

func (*Evaluator) Evaluate 

func (evaluator *Evaluator) Evaluate(
	ctx context.Context,
	request authorization.Request,
) (authorization.Decision, error)

Evaluate checks matching type and instance entries for one request.

func (*Evaluator) EvaluateBatch 

func (evaluator *Evaluator) EvaluateBatch(
	ctx context.Context,
	requests []authorization.Request,
) ([]authorization.Decision, error)

EvaluateBatch evaluates a bounded request set against the evaluator's immutable ACL view.

func (*Evaluator) ListResourceIDs 

func (evaluator *Evaluator) ListResourceIDs(
	ctx context.Context,
	subject authorization.Subject,
	action authorization.Action,
	resourceType authorization.ResourceType,
	tenant authorization.TenantID,
) ([]authorization.ResourceID, error)

ListResourceIDs returns only explicitly enumerable instance grants. A resource-type allow is reported as unbounded instead of triggering a scan.

type Limits 

type Limits struct {
	MaxEntries   int `json:"max_entries,omitempty"`
	MaxGroups    int `json:"max_groups,omitempty"`
	MaxMatches   int `json:"max_matches,omitempty"`
	MaxBatchSize int `json:"max_batch_size,omitempty"`
}

Limits bounds ACL construction and per-request evaluation work.

type Option 

type Option func(*Evaluator)

func WithGlobalInheritance 

func WithGlobalInheritance() Option

WithGlobalInheritance makes global entries apply to tenant-scoped requests. Without this option, global and tenant scopes are isolated.

func WithLimits 

func WithLimits(limits Limits) Option

WithLimits configures positive bounds while retaining safe defaults for zero-valued fields.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.