authz

type AuthzClientOption func(*ClientImpl)

type BatchCheckItem struct {
	Name      string
	Folder    string
	Group     string
	Resource  string
	Verb      string
	Namespace string
	// FreshnessTimestamp is when the resource was last modified.
	// If provided, the server will skip cache for this item if the cached result
	// is older than this timestamp.
	FreshnessTimestamp time.Time
}

type Checker func(resources ...Resource) bool

type ClientImpl struct {
	// contains filtered or unexported fields
}

type ClientOption func(*EnforcementClientImpl) error

type Config struct {
	APIURL  string
	Token   string
	JWKsURL string
}

type EnforcementClient interface {
	// Compile generates a function to check whether the user has access to any scope of a given list of scopes.
	// This is particularly useful when you want to verify access to a list of resources.
	Compile(ctx context.Context, idToken string, action string, kinds ...string) (Checker, error)

	// HasAccess checks whether the user can perform the given action on any of the given resources.
	// If the scope is empty, it checks whether the user can perform the action.
	HasAccess(ctx context.Context, idToken string, action string, resources ...Resource) (bool, error)

	// Experimental: LookupResources returns the resources that the user has access to for the given action.
	LookupResources(ctx context.Context, idToken string, action string) ([]Resource, error)
}

type EnforcementClientImpl struct {
	// contains filtered or unexported fields
}

type FilterOption func(*FilterOptions)

type FilterOptions struct {
	Tracer trace.Tracer
}

type HTTPRequestDoer interface {
	Do(req *http.Request) (*http.Response, error)
}

type Resource struct {
	// Kind is the type of resource. Ex: "teams", "dashboards", "datasources"
	Kind string
	// The attribute is required for compatibility with the way scopes are defined in Grafana. Ex: "id", "uid"
	Attr string
	// ID is the unique identifier of the resource. Ex: "2", "YYxUSd7ik", "test-datasource"
	ID string
}

type ServiceEvaluationResult struct {
	// ServiceCall indicates if the call was made by a service (access policy) identity
	// False indicates an on-behalf-of call (delegated permissions), user permissions should be checked.
	ServiceCall bool
	// Allowed indicates if the permission check passed. This does not imply that the user is allowed,
	// only that the service has the required permissions (itself or acting on behalf of a user)
	// If false, the caller should reject the request immediately.
	// If true, the caller can proceed to check user permissions as needed.
	Allowed bool
	// Permissions lists the permissions present in the token used for the check
	Permissions []string
}

type TimestampZookie struct {
	// contains filtered or unexported fields
}