rbac

type Adapter func(ctx context.Context, main *gormadapter.Adapter) persist.Adapter

type ExplainedRule struct {
	// Principal is who the rule is filed under: the subject itself, or a role the subject holds.
	Principal string `json:"principal"`

	// Paths are the shortest chains of roles from the subject to Principal, one through each principal that holds
	// Principal directly, each with Principal last. It's empty when the rule is filed under the subject itself.
	Paths [][]string `json:"paths,omitempty"`

	Object    string `json:"object"`
	Action    string `json:"action"`
	Effect    string `json:"effect"`
	Condition string `json:"condition,omitempty"`

	// ID is the id the rule was loaded with, e.g. the binding and rule that produced it.
	ID string `json:"id,omitempty"`

	// Matches reports whether the rule matches the check. A rule that doesn't is for the same action and object,
	// but its condition doesn't hold, e.g. the resource isn't in the rule's Scopes.
	Matches bool `json:"matches"`
}

type Explanation struct {
	// Allowed is the answer: some matching rule allows the check, and none denies it.
	Allowed bool

	// Rules are every rule the subject holds, directly or through its roles, for the action and object.
	Rules []ExplainedRule
}

type NamespacedNameIDSelector struct {
	ID        string `json:"id,omitempty"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name,omitempty"`
}

type PolicySnapshot struct {
	// contains filtered or unexported fields
}

type Selectors struct {
	Playbooks   []types.ResourceSelector `json:"playbooks,omitempty"`
	Connections []types.ResourceSelector `json:"connections,omitempty"`
	Configs     []types.ResourceSelector `json:"configs,omitempty"`
	Components  []types.ResourceSelector `json:"components,omitempty"`
	Views       []ViewRef                `json:"views,omitempty"`
}

type SubjectAccessReviewRequest struct {
	Resource SubjectAccessReviewResource `json:"resource"`
	Action   string                      `json:"action"`

	// Supports ["*"], in which case we iterate over all permission subjects in the database.
	Subjects []string `json:"subjects"`
}

type SubjectAccessReviewResource struct {
	Playbook   string `json:"playbook,omitempty"`
	Config     string `json:"config,omitempty"`
	Check      string `json:"check,omitempty"`
	View       string `json:"view,omitempty"`
	Connection string `json:"connection,omitempty"`
	Global     string `json:"global,omitempty"`
}

type SubjectAccessReviewResult struct {
	Subject string `json:"subject"`
	Allowed bool   `json:"allowed"`
	Error   string `json:"error,omitempty"`
}

type SubjectAccessSearchRequest struct {
	Subject       string   `json:"subject"`
	Action        string   `json:"action"`
	ResourceTypes []string `json:"resource_types,omitempty"`
}

type SubjectAccessSearchResponse struct {
	Subject       string                      `json:"subject"`
	Action        string                      `json:"action"`
	ResourceTypes []string                    `json:"resource_types"`
	Total         int                         `json:"total"`
	Results       []SubjectAccessSearchResult `json:"results"`
}

type SubjectAccessSearchResult struct {
	ResourceType string `json:"resource_type"`
	ID           string `json:"id"`
}

type ViewRef NamespacedNameIDSelector