authorization

type Action string

type AttributeName string

type Attributes map[AttributeName]Value

type Authorizer interface {
	// Decide returns a valid outcome or error; map errors to failure, never allow.
	Decide(context.Context, Request) (Decision, error)
}

type BeginInstrumenter interface {
	// Begin returns an optional derived context and completion callback; preserve caller cancellation.
	Begin(context.Context) (context.Context, func(Event))
}

type CombiningAlgorithm uint8

type Decision struct {
	// Outcome is Allow, Deny or NotApplicable; Engine validates and default-denies.
	Outcome Outcome
	// Reason is caller/model-defined diagnostic text; it must not contain secrets.
	Reason ReasonCode
	// MatchedPolicyIDs preserves match order; count caps do not bound identifier bytes.
	MatchedPolicyIDs []PolicyID
	// MatchedPolicyIDsTruncated signals incomplete identifier diagnostics, not changed outcome.
	MatchedPolicyIDsTruncated bool
	// Revision identifies the declared policy/view generation; it is not an authenticity signature.
	Revision Revision
	// Trace contains evaluation-order metadata without dedicated request-value fields.
	Trace []TraceEntry
	// TraceTruncated signals incomplete trace diagnostics.
	TraceTruncated bool
}

type DecisionContext struct {
	// Request is the complete policy input; callers keep it stable while copied.
	Request Request
	// CorrelationID is optional diagnostic correlation, never policy authority.
	CorrelationID string
	// PolicyRevision is the exact positive revision that may authorize this call.
	PolicyRevision Revision
}

type Engine struct {
	// contains filtered or unexported fields
}

type EngineOption func(*Engine)

type Environment struct {
	// Time is caller-supplied evaluation time; zero lets Engine sample its clock.
	Time time.Time
	// Attributes is the caller-owned fact map; sensitivity/authority is not inferred.
	Attributes Attributes
}

type Evaluator interface {
	// Evaluate returns a valid outcome or an error, using immutable borrowed
	// request data. Decision identifiers/reasons must be non-secret application text.
	Evaluate(context.Context, Request) (Decision, error)
}

type Event struct {
	// Outcome is Allow, Deny or NotApplicable; Engine validates and default-denies.
	Outcome Outcome
	// Reason is caller/model-defined diagnostic text; it must not contain secrets.
	Reason ReasonCode
	// Revision identifies the declared policy/view generation; it is not an authenticity signature.
	Revision Revision
	// MatchedPolicyIDs preserves match order; count caps do not bound identifier bytes.
	MatchedPolicyIDs []PolicyID
	// MatchedPolicyIDsTruncated signals incomplete identifier diagnostics, not changed outcome.
	MatchedPolicyIDsTruncated bool
	// TraceCount is the observed number of retained trace entries, not every evaluated policy.
	TraceCount int
	// TraceTruncated signals incomplete trace diagnostics.
	TraceTruncated bool
	// Duration is elapsed instrumentation clock time, clamped nonnegative by the wrapper.
	Duration time.Duration
	// Failed reports a non-nil authorizer error; it does not inspect sensitive cause text.
	Failed bool
}

type InstrumentationConfig struct {
	// Clock is borrowed time policy and must be prompt/concurrency-safe; no lifecycle is owned.
	Clock func() time.Time
	// MaxPolicyIDs caps copied event identifiers; zero selects 100, negative is invalid.
	MaxPolicyIDs int
}

type Instrumented struct {
	// contains filtered or unexported fields
}

type Instrumenter interface {
	// Start returns an optional derived context and completion callback, without owning authorization.
	Start(context.Context) (context.Context, func(Event))
}

type Limits struct {
	// MaxBatchSize admits request count before result allocation; default is 1000.
	MaxBatchSize int
	// MaxPolicies admits policy count; default is 1000, not a total byte budget.
	MaxPolicies int
	// MaxTraceSize caps trace entry count; default is 100.
	MaxTraceSize int
	// MaxMatchedPolicyIDs caps accumulated identifier count; default is 100.
	MaxMatchedPolicyIDs int
}

type Outcome uint8

type PolicyDefinition struct {
	// ID is an exact application-defined label; keep diagnostic identifiers non-secret.
	ID PolicyID
	// Revision identifies the declared policy/view generation; it is not an authenticity signature.
	Revision Revision
	// Priority orders higher values first where the selected model supports ordering.
	Priority int
	// ActiveFrom starts the inclusive activation window; absent/zero means unbounded.
	ActiveFrom time.Time
	// ActiveUntil ends the exclusive activation window; absent/zero means unbounded.
	ActiveUntil time.Time
	// Metadata contains editable application labels, not authenticated/private storage.
	Metadata map[string]string
	// Evaluator is borrowed and must be immutable/concurrency-safe/cooperative when shared.
	Evaluator Evaluator
}

type PolicyEvaluationError struct {
	// PolicyID is the exact non-secret policy diagnostic identity.
	PolicyID PolicyID
	// Err is a borrowed error cause; deliberate unwrapping/fixture use can expose its text/type.
	Err error
}

type PolicyID string

type PolicyInfo struct {
	// ID is an exact application-defined label; keep diagnostic identifiers non-secret.
	ID PolicyID
	// Revision identifies the declared policy/view generation; it is not an authenticity signature.
	Revision Revision
	// Priority orders higher values first where the selected model supports ordering.
	Priority int
	// ActiveFrom starts the inclusive activation window; absent/zero means unbounded.
	ActiveFrom time.Time
	// ActiveUntil ends the exclusive activation window; absent/zero means unbounded.
	ActiveUntil time.Time
	// Metadata contains editable application labels, not authenticated/private storage.
	Metadata map[string]string
}

type ReasonCode string

type Request struct {
	// Subject supplies trusted kind/ID and optional group/fact state; it is not authenticated here.
	Subject Subject
	// Action is matched byte-for-byte; no wildcard, normalization or permission discovery is implied.
	Action Action
	// Resource carries exact type/optional instance ID and borrowed application facts.
	Resource Resource
	// Tenant is exact scope; empty means global, not inferred tenant membership.
	Tenant TenantID
	// Environment supplies caller-mapped time/facts; Engine does not authenticate them.
	Environment Environment
	// Attributes is the caller-owned fact map; sensitivity/authority is not inferred.
	Attributes Attributes
}

type Resource struct {
	// Type is the exact application resource-type label, not an external schema lookup.
	Type ResourceType
	// ID is an exact application-defined label; keep diagnostic identifiers non-secret.
	ID ResourceID
	// Attributes is the caller-owned fact map; sensitivity/authority is not inferred.
	Attributes Attributes
}

type ResourceID string

type ResourceType string

type Revision uint64

type Service interface {
	// Decide returns only revision-matched Allow or Deny; errors never authorize.
	Decide(context.Context, DecisionContext) (Decision, error)
}

type Snapshot struct {
	// contains filtered or unexported fields
}

type Subject struct {
	// Kind is the caller-selected representation/category, not an authentication assertion.
	Kind SubjectKind
	// ID is an exact application-defined label; keep diagnostic identifiers non-secret.
	ID SubjectID
	// Groups is trusted mapped membership; request slices are borrowed during evaluation.
	Groups []SubjectID
	// Attributes is the caller-owned fact map; sensitivity/authority is not inferred.
	Attributes Attributes
}

type SubjectID string

type SubjectKind string

type TenantID string

type TraceEntry struct {
	// PolicyID is the exact non-secret policy diagnostic identity.
	PolicyID PolicyID
	// Outcome is Allow, Deny or NotApplicable; Engine validates and default-denies.
	Outcome Outcome
	// Reason is caller/model-defined diagnostic text; it must not contain secrets.
	Reason ReasonCode
}

type ValidationError struct {
	// Field is the failed-input path printed by Error; keep manually supplied text non-secret.
	Field string
}

type Value struct {
	// contains filtered or unexported fields
}

type ValueKind uint8