Documentation
¶
Overview ¶
Package authorizationcache provides explicit advisory cache adapters for portable policy manifests. Cached manifests never replace repository verification. New composes go-cache/v4 and borrows backend/clock/observer lifecycle. Namespace/revision keys do not authenticate tenant/content identity. RepositoryLoader checks equality on load; an existing cache hit does not perform a fresh repository verification. No refresh policy or backend shutdown is added.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrManifestTooLarge reports that an encoded manifest exceeds the configured bound. ErrManifestTooLarge = errors.New("authorization cached manifest is too large") // ErrInvalidRevision reports that a zero revision cannot be used as a cache key. ErrInvalidRevision = errors.New("authorization cached revision is invalid") // ErrNilRepository reports that RepositoryLoader received no policy repository. ErrNilRepository = errors.New("authorization cached repository is nil") )
Functions ¶
func RepositoryLoader ¶
func RepositoryLoader( repository policy.Repository, ) (cache.Loader[authorization.Revision, policy.Manifest], error)
RepositoryLoader reports Found only when a fresh repository read has the exact requested revision. Literal nil is rejected; typed-nil/blocked/panicking repositories are trusted. It neither validates model content nor sanitizes returned raw errors; cache.GetOrLoad supplies its separate protected boundary.
Types ¶
type Config ¶
type Config struct {
// Namespace isolates keys owned by this application.
Namespace string
// Backend stores encoded cache entries and retains ownership of its resources.
Backend cache.Backend
// TTL controls entry expiration.
TTL cache.TTLPolicy
// Clock supplies cache time behavior.
Clock cache.Clock
// Observer receives bounded cache operation observations.
Observer cache.Observer
// MaxValue bounds an encoded manifest; zero uses the package default.
MaxValue int
// MaxBatch bounds multi-key cache operations.
MaxBatch int
// MaxKeySize bounds encoded cache keys; zero uses the package default.
MaxKeySize int
}
Config configures an advisory manifest cache and its resource bounds.
type ManifestCodec ¶
type ManifestCodec struct {
// MaxEncodedSize is the byte limit; non-positive values use the package default.
MaxEncodedSize int
}
ManifestCodec encodes and decodes policy manifests with a bounded encoded size.
type RevisionKeyEncoder ¶
type RevisionKeyEncoder struct{}
RevisionKeyEncoder encodes non-zero policy revisions as stable decimal cache keys.
func (RevisionKeyEncoder) EncodeKey ¶
func (RevisionKeyEncoder) EncodeKey(revision authorization.Revision) ([]byte, error)
EncodeKey returns revision's decimal representation or ErrInvalidRevision for zero.
Source Files