abac

type Condition interface {
	// contains filtered or unexported methods
}

type ConditionDocument struct {
	// Operator selects one supported expression operation; unrelated fields may remain unused.
	Operator string `json:"operator"`
	// Source selects the request fact map, not an external data provider.
	Source string `json:"source,omitempty"`
	// Attribute names an exact map key for a leaf operation.
	Attribute authorization.AttributeName `json:"attribute,omitempty"`
	// Value supplies the comparison literal for equal/greater/less operations.
	Value *ValueDocument `json:"value,omitempty"`
	// Values supplies the same-kind membership candidates for in.
	Values []ValueDocument `json:"values,omitempty"`
	// Conditions supplies ordered children for all/any; Build validates visited children.
	Conditions []ConditionDocument `json:"conditions,omitempty"`
	// Condition supplies the single child for not; other operators do not consume it.
	Condition *ConditionDocument `json:"condition,omitempty"`
	// Text supplies the string operand for set/string operations, not executable input.
	Text string `json:"text,omitempty"`
	// Prefix is the CIDR operand for ip_in, normalized by IPIn.
	Prefix string `json:"prefix,omitempty"`
}

type Decoder struct{}

type Document struct {
	// Version is the application model version; Build requires DocumentVersion (1).
	Version uint64 `json:"version"`
	// Limits supplies positive count/depth/cost overrides; non-positive fields retain model defaults.
	Limits Limits `json:"limits,omitempty"`
	// Rules supplies editable rule definitions; Build/New validates and sorts them.
	Rules []RuleDocument `json:"rules"`
	// NamedConditions supplies editable named/versioned expression definitions.
	NamedConditions []NamedConditionDocument `json:"named_conditions"`
}

type Evaluator struct {
	// contains filtered or unexported fields
}

type Limits struct {
	// MaxRules admits rule count; default is 1000.
	MaxRules int `json:"max_rules,omitempty"`
	// MaxDepth admits expression depth; default is 32.
	MaxDepth int `json:"max_depth,omitempty"`
	// MaxCost caps node visits per evaluation; default is 1000, not CPU/string-time admission.
	MaxCost int `json:"max_cost,omitempty"`
	// MaxMatches caps collected matching entries/permissions/rules; default is 100.
	MaxMatches int `json:"max_matches,omitempty"`
	// MaxSetSize admits selected literal/runtime collection cardinality; default is 1000, not total bytes.
	MaxSetSize int `json:"max_set_size,omitempty"`
	// MaxBatchSize admits request count before result allocation; default is 1000.
	MaxBatchSize int `json:"max_batch_size,omitempty"`
	// MaxNamedConditions admits named definition count; default is 1000.
	MaxNamedConditions int `json:"max_named_conditions,omitempty"`
}

type NamedCondition struct {
	// Name is the exact application label; do not place secrets in error-visible names.
	Name string
	// Version is a nonzero exact named-condition identity, independent of model format version.
	Version uint64
	// Condition is the selected expression; use built-in constructors and avoid nil/embedded unsafe state.
	Condition Condition
}

type NamedConditionDocument struct {
	// Name is the exact application label; do not place secrets in error-visible names.
	Name string `json:"name"`
	// Version is a nonzero named-condition version, independent of DocumentVersion.
	Version uint64 `json:"version"`
	// Condition supplies editable inline expression data; Build validates the selected tree.
	Condition ConditionDocument `json:"condition"`
}

type Option func(*Evaluator)

type Reference struct {
	// Source selects the request fact map, not an external data provider.
	Source Source
	// Name is the exact application label; do not place secrets in error-visible names.
	Name authorization.AttributeName
}

type Result struct {
	// Matched reports predicate truth, not a final authorization grant.
	Matched bool
	// Status distinguishes predicate match, missing, null and type mismatch.
	Status Status
	// Cost reports consumed expression-node visits, not string-byte work or wall time.
	Cost int
}

type Rule struct {
	// ID is an exact application-defined label; keep diagnostic identifiers non-secret.
	ID authorization.PolicyID
	// Priority orders higher values first where the selected model supports ordering.
	Priority int
	// Tenant is exact scope; empty means global, not inferred tenant membership.
	Tenant authorization.TenantID
	// Action is matched byte-for-byte; no wildcard, normalization or permission discovery is implied.
	Action authorization.Action
	// ResourceType is matched exactly; no wildcard or external lookup is implied.
	ResourceType authorization.ResourceType
	// ResourceID is exact when nonempty; empty makes the grant/rule type-wide.
	ResourceID authorization.ResourceID
	// Effect must select an explicit allow or deny; model construction rejects other outcomes.
	Effect authorization.Outcome
	// Condition is the selected expression; use built-in constructors and avoid nil/embedded unsafe state.
	Condition Condition
	// ConditionName selects an exact named condition instead of an inline Condition.
	ConditionName string
	// ConditionVersion must be nonzero with ConditionName, otherwise zero.
	ConditionVersion uint64
}

type RuleDocument struct {
	// ID is an exact application-defined label; keep diagnostic identifiers non-secret.
	ID authorization.PolicyID `json:"id"`
	// Priority orders higher values first where the selected model supports ordering.
	Priority int `json:"priority,omitempty"`
	// Tenant is exact scope; empty means global, not inferred tenant membership.
	Tenant authorization.TenantID `json:"tenant,omitempty"`
	// Action is matched byte-for-byte; no wildcard, normalization or permission discovery is implied.
	Action authorization.Action `json:"action"`
	// ResourceType is matched exactly; no wildcard or external lookup is implied.
	ResourceType authorization.ResourceType `json:"resource_type"`
	// ResourceID is exact when nonempty; empty makes the grant/rule type-wide.
	ResourceID authorization.ResourceID `json:"resource_id,omitempty"`
	// Effect must select an explicit allow or deny; model construction rejects other outcomes.
	Effect string `json:"effect"`
	// Condition supplies editable inline expression data; Build validates the selected tree.
	Condition *ConditionDocument `json:"condition,omitempty"`
	// ConditionName selects an exact named condition instead of an inline Condition.
	ConditionName string `json:"condition_name,omitempty"`
	// ConditionVersion must be nonzero with ConditionName, otherwise zero.
	ConditionVersion uint64 `json:"condition_version,omitempty"`
}

type Source uint8

type Status uint8

type ValueDocument struct {
	// Kind selects one supported serialized literal representation; unrelated fields are unused.
	Kind string `json:"kind"`
	// String supplies the string literal when Kind selects string; it is retained plaintext.
	String string `json:"string,omitempty"`
	// Bool supplies the boolean literal when Kind selects bool.
	Bool bool `json:"bool,omitempty"`
	// Int supplies the signed int64 literal when Kind selects int.
	Int int64 `json:"int,omitempty"`
	// Float supplies the finite floating literal when Kind selects float.
	Float float64 `json:"float,omitempty"`
	// Time is parsed as RFC3339Nano then normalized to UTC when Kind selects time.
	Time string `json:"time,omitempty"`
	// IP supplies the parseable address literal when Kind selects ip.
	IP string `json:"ip,omitempty"`
	// StringSet supplies copied/sorted/deduplicated literals when Kind selects string_set.
	StringSet []string `json:"string_set,omitempty"`
}