The highest tagged major version is
Documentation
¶
Overview ¶
Package authz maps an already authenticated context principal to scoped authorization decisions. New borrows a DecisionMaker; Authorize requires the actor to equal the principal subject and refuses every non-Allow outcome. It does not extract credentials, authenticate tenants, own provider shutdown or interrupt a blocking evaluator; caller context and shared-use safety remain collaborator obligations.
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var ( // ErrInvalidConfiguration reports an unusable authorization dependency. ErrInvalidConfiguration = errors.New("control-plane authorization: invalid configuration") // ErrUnauthenticated reports a missing authenticated principal. ErrUnauthenticated = errors.New("control-plane authorization: unauthenticated") // ErrActorMismatch reports an actor that differs from the authenticated ID. ErrActorMismatch = errors.New("control-plane authorization: actor mismatch") // ErrDenied reports a fail-closed non-allow decision. ErrDenied = errors.New("control-plane authorization: denied") )
Functions ¶
This section is empty.
Types ¶
type Authorizer ¶
type Authorizer struct {
// contains filtered or unexported fields
}
Authorizer maps authenticated identities into tenant-scoped decisions.
func New ¶
func New(evaluator DecisionMaker, subjectKind authorization.SubjectKind) (*Authorizer, error)
New creates a fail-closed control-plane authorizer.
func (*Authorizer) Authorize ¶
func (a *Authorizer) Authorize( ctx context.Context, tenant string, actor string, permission controlplane.Permission, target controlplane.Target, ) error
Authorize verifies actor attribution and evaluates the requested permission.
type DecisionMaker ¶
type DecisionMaker interface {
// Decide evaluates the scoped request; Authorizer treats errors and every
// non-Allow outcome as refusal.
Decide(context.Context, authorization.Request) (authorization.Decision, error)
}
DecisionMaker is the stable authorization evaluation seam.
Source Files
Click to show internal directories.
Click to hide internal directories.