Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrScopeResolverRequired = errors.New("go-users: strict scope guard requires a resolver") ErrAuthorizationPolicyRequired = errors.New("go-users: strict scope guard requires an authorization policy") ErrStrictGuardRequired = errors.New("go-users: a validated strict scope guard is required") ErrPolicyActionRequired = errors.New("go-users: strict scope guard requires a policy action") )
Functions ¶
func ValidateStrict ¶ added in v0.27.0
ValidateStrict verifies built-in strict guard wiring. A nonnil permissive or custom guard does not establish this contract. Policies still own access rules.
Types ¶
type Guard ¶
type Guard interface {
Enforce(ctx context.Context, actor types.ActorRef, requested types.ScopeFilter, action types.PolicyAction, target uuid.UUID) (types.ScopeFilter, error)
}
Guard enforces resolved scopes and authorization policies for commands and queries. It is intentionally small so callers can swap custom guards in tests if needed.
func Ensure ¶
Ensure returns a non-nil guard so command/query constructors can accept nil guards when tests instantiate them directly.
func NewGuard ¶
func NewGuard(resolver types.ScopeResolver, policy types.AuthorizationPolicy) Guard
NewGuard builds a Guard from the supplied resolver and policy. Nil dependencies are treated as no-ops.
type StrictGuard ¶ added in v0.27.0
type StrictGuard struct {
// contains filtered or unexported fields
}
StrictGuard requires explicit resolution and authorization dependencies. Its zero and nil values deny enforcement. Use NewStrictGuard to validate at startup.
func NewStrictGuard ¶ added in v0.27.0
func NewStrictGuard(resolver types.ScopeResolver, policy types.AuthorizationPolicy) (*StrictGuard, error)
NewStrictGuard constructs a guard that requires both dependencies. It rejects typed nil pointers/functions as well as nil interfaces. On error, the returned guard denies enforcement even if a caller accidentally ignores the error.
func (*StrictGuard) Enforce ¶ added in v0.27.0
func (g *StrictGuard) Enforce(ctx context.Context, actor types.ActorRef, requested types.ScopeFilter, action types.PolicyAction, target uuid.UUID) (types.ScopeFilter, error)
Enforce validates configuration before resolving and authorizing the scope.
Source Files