Documentation
¶
Overview ¶
Package spicedb provides SpiceDB-based authorization for CoreForge.
Index ¶
- Constants
- func ResourceSchema(resourceType string) string
- type CheckRequest
- type Client
- func (c *Client) Check(ctx context.Context, req *CheckRequest) (bool, error)
- func (c *Client) Close() error
- func (c *Client) DeleteRelationship(ctx context.Context, rel *Relationship) error
- func (c *Client) IsEmbedded() bool
- func (c *Client) LookupResources(ctx context.Context, req *LookupResourcesRequest) ([]string, error)
- func (c *Client) LookupSubjects(ctx context.Context, req *LookupSubjectsRequest) ([]string, error)
- func (c *Client) ReadSchema(ctx context.Context) (string, error)
- func (c *Client) WriteRelationship(ctx context.Context, rel *Relationship) error
- func (c *Client) WriteRelationships(ctx context.Context, rels []*Relationship) error
- func (c *Client) WriteSchema(ctx context.Context, schema string) error
- type Config
- type LookupResourcesRequest
- type LookupSubjectsRequest
- type Provider
- func (p *Provider) AddOrgMember(ctx context.Context, principalID string, orgID uuid.UUID, role string) error
- func (p *Provider) AddRelationship(ctx context.Context, ...) error
- func (p *Provider) Can(ctx context.Context, principal authz.Principal, action authz.Action, ...) (bool, error)
- func (p *Provider) CanAll(ctx context.Context, principal authz.Principal, actions []authz.Action, ...) (bool, error)
- func (p *Provider) CanAny(ctx context.Context, principal authz.Principal, actions []authz.Action, ...) (bool, error)
- func (p *Provider) CanForOrg(ctx context.Context, principal authz.Principal, orgID uuid.UUID, ...) (bool, error)
- func (p *Provider) Client() *Client
- func (p *Provider) Close() error
- func (p *Provider) Filter(ctx context.Context, principal authz.Principal, action authz.Action, ...) ([]authz.Resource, error)
- func (p *Provider) GetRole(ctx context.Context, principal authz.Principal, orgID uuid.UUID) (string, error)
- func (p *Provider) IsMember(ctx context.Context, principal authz.Principal, orgID uuid.UUID) (bool, error)
- func (p *Provider) IsPlatformAdmin(ctx context.Context, principal authz.Principal) (bool, error)
- func (p *Provider) RemoveOrgMember(ctx context.Context, principalID string, orgID uuid.UUID, role string) error
- func (p *Provider) RemoveRelationship(ctx context.Context, ...) error
- type Relationship
- type Syncer
- func (s *Syncer) AddOrgMembership(ctx context.Context, principalID, orgID uuid.UUID, role string) error
- func (s *Syncer) RegisterOrganization(ctx context.Context, orgID, ownerID uuid.UUID) error
- func (s *Syncer) RegisterPrincipal(_ context.Context, _ uuid.UUID) error
- func (s *Syncer) RemoveOrgMembership(ctx context.Context, principalID, orgID uuid.UUID, role string) error
- func (s *Syncer) SetPlatformAdmin(ctx context.Context, principalID uuid.UUID, isAdmin bool) error
- func (s *Syncer) UnregisterOrganization(ctx context.Context, orgID uuid.UUID) error
- func (s *Syncer) UnregisterPrincipal(ctx context.Context, principalID uuid.UUID) error
- func (s *Syncer) UpdateOrgMembership(ctx context.Context, principalID, orgID uuid.UUID, oldRole, newRole string) error
Constants ¶
const ( // TypePrincipal represents a principal (user, service, agent). TypePrincipal = "principal" // TypeOrganization represents an organization. TypeOrganization = "organization" // TypeUser represents a user. TypeUser = "user" )
Common resource type constants.
const ( // PermView allows viewing a resource. PermView = "view" // PermEdit allows editing a resource. PermEdit = "edit" // PermManage allows managing a resource (admin operations). PermManage = "manage" // PermDelete allows deleting a resource. PermDelete = "delete" // PermCreate allows creating resources. PermCreate = "create" )
Common permission constants.
const ( // RelOwner represents the owner relation. RelOwner = "owner" // RelAdmin represents the admin relation. RelAdmin = "admin" // RelMember represents the member relation. RelMember = "member" // RelViewer represents the viewer relation. RelViewer = "viewer" // RelEditor represents the editor relation. RelEditor = "editor" )
Common relation constants.
const BaseSchema = `` /* 661-byte string literal not displayed */
BaseSchema provides a minimal SpiceDB schema for CoreForge applications. Applications can extend this with their own resource types.
Variables ¶
This section is empty.
Functions ¶
func ResourceSchema ¶
ResourceSchema returns a SpiceDB schema definition for a custom resource type. This can be used to define app-specific resources that integrate with organizations.
Types ¶
type CheckRequest ¶
type CheckRequest struct {
// ResourceType is the type of the resource (e.g., "organization", "project")
ResourceType string
// ResourceID is the ID of the resource
ResourceID string
// Permission is the permission to check (e.g., "view", "edit", "manage")
Permission string
// SubjectType is the type of the subject (e.g., "principal", "user")
SubjectType string
// SubjectID is the ID of the subject
SubjectID string
}
CheckRequest represents a permission check request.
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client provides authorization operations backed by SpiceDB.
func (*Client) DeleteRelationship ¶
func (c *Client) DeleteRelationship(ctx context.Context, rel *Relationship) error
DeleteRelationship deletes a relationship tuple.
func (*Client) IsEmbedded ¶
IsEmbedded returns true if this client is using an embedded SpiceDB instance.
func (*Client) LookupResources ¶
func (c *Client) LookupResources(ctx context.Context, req *LookupResourcesRequest) ([]string, error)
LookupResources finds all resources a subject has permission on.
func (*Client) LookupSubjects ¶
LookupSubjects finds all subjects with a given permission on a resource.
func (*Client) ReadSchema ¶
ReadSchema reads the current authorization schema.
func (*Client) WriteRelationship ¶
func (c *Client) WriteRelationship(ctx context.Context, rel *Relationship) error
WriteRelationship writes a relationship tuple.
func (*Client) WriteRelationships ¶
func (c *Client) WriteRelationships(ctx context.Context, rels []*Relationship) error
WriteRelationships writes multiple relationship tuples atomically.
type Config ¶
type Config struct {
// Mode: "embedded" or "remote"
Mode string `json:"mode" yaml:"mode"`
// Embedded mode settings
// DatastoreEngine: "memory" or "postgres"
DatastoreEngine string `json:"datastore_engine,omitempty" yaml:"datastore_engine,omitempty"`
// DatastoreURI: connection string for postgres
DatastoreURI string `json:"datastore_uri,omitempty" yaml:"datastore_uri,omitempty"`
// Remote mode settings
// Endpoint: SpiceDB gRPC endpoint (e.g., "localhost:50051")
Endpoint string `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`
// Token: preshared key for authentication
Token string `json:"token,omitempty" yaml:"token,omitempty"`
// Insecure: skip TLS verification
Insecure bool `json:"insecure,omitempty" yaml:"insecure,omitempty"`
}
Config holds SpiceDB client configuration.
func DefaultConfig ¶
func DefaultConfig() Config
DefaultConfig returns a default configuration for embedded mode.
type LookupResourcesRequest ¶
type LookupResourcesRequest struct {
// ResourceType is the type of resources to look up
ResourceType string
// Permission is the permission to check
Permission string
// SubjectType is the type of the subject
SubjectType string
// SubjectID is the ID of the subject
SubjectID string
}
LookupResourcesRequest represents a request to find resources a subject can access.
type LookupSubjectsRequest ¶
type LookupSubjectsRequest struct {
// ResourceType is the type of the resource
ResourceType string
// ResourceID is the ID of the resource
ResourceID string
// Permission is the permission to check
Permission string
// SubjectType is the type of subjects to look up
SubjectType string
}
LookupSubjectsRequest represents a request to find subjects with a permission.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements the authz.Authorizer interface using SpiceDB.
func NewProvider ¶
NewProvider creates a new SpiceDB authorization provider.
func (*Provider) AddOrgMember ¶
func (p *Provider) AddOrgMember(ctx context.Context, principalID string, orgID uuid.UUID, role string) error
AddOrgMember adds a principal as a member of an organization with a specific role.
func (*Provider) AddRelationship ¶
func (p *Provider) AddRelationship(ctx context.Context, subjectType, subjectID, relation, resourceType, resourceID string) error
AddRelationship adds a relationship between a subject and a resource.
func (*Provider) Can ¶
func (p *Provider) Can(ctx context.Context, principal authz.Principal, action authz.Action, resource authz.Resource) (bool, error)
Can checks if a principal can perform an action on a resource.
func (*Provider) CanAll ¶
func (p *Provider) CanAll(ctx context.Context, principal authz.Principal, actions []authz.Action, resource authz.Resource) (bool, error)
CanAll checks if a principal can perform all specified actions on a resource.
func (*Provider) CanAny ¶
func (p *Provider) CanAny(ctx context.Context, principal authz.Principal, actions []authz.Action, resource authz.Resource) (bool, error)
CanAny checks if a principal can perform any of the specified actions on a resource.
func (*Provider) CanForOrg ¶
func (p *Provider) CanForOrg(ctx context.Context, principal authz.Principal, orgID uuid.UUID, action authz.Action, resource authz.Resource) (bool, error)
CanForOrg checks permission scoped to a specific organization.
func (*Provider) Filter ¶
func (p *Provider) Filter(ctx context.Context, principal authz.Principal, action authz.Action, resources []authz.Resource) ([]authz.Resource, error)
Filter returns only the resources the principal can access with the given action.
func (*Provider) GetRole ¶
func (p *Provider) GetRole(ctx context.Context, principal authz.Principal, orgID uuid.UUID) (string, error)
GetRole returns the principal's role in an organization.
func (*Provider) IsMember ¶
func (p *Provider) IsMember(ctx context.Context, principal authz.Principal, orgID uuid.UUID) (bool, error)
IsMember checks if a principal is a member of an organization.
func (*Provider) IsPlatformAdmin ¶
IsPlatformAdmin checks if a principal has platform-wide admin access.
type Relationship ¶
type Relationship struct {
// ResourceType is the type of the resource
ResourceType string
// ResourceID is the ID of the resource
ResourceID string
// Relation is the relationship type (e.g., "owner", "member", "admin")
Relation string
// SubjectType is the type of the subject
SubjectType string
// SubjectID is the ID of the subject
SubjectID string
}
Relationship represents a relationship tuple.
type Syncer ¶
type Syncer struct {
// contains filtered or unexported fields
}
Syncer implements RelationshipSyncer using SpiceDB as the authorization backend.
func (*Syncer) AddOrgMembership ¶
func (s *Syncer) AddOrgMembership(ctx context.Context, principalID, orgID uuid.UUID, role string) error
AddOrgMembership adds a principal's membership in an organization.
func (*Syncer) RegisterOrganization ¶
RegisterOrganization creates an organization with an initial owner.
func (*Syncer) RegisterPrincipal ¶
RegisterPrincipal creates a principal entity in SpiceDB. SpiceDB doesn't require explicit entity creation - entities are created implicitly when relationships are added. This is a no-op but kept for interface compliance.
func (*Syncer) RemoveOrgMembership ¶
func (s *Syncer) RemoveOrgMembership(ctx context.Context, principalID, orgID uuid.UUID, role string) error
RemoveOrgMembership removes a principal's membership from an organization.
func (*Syncer) SetPlatformAdmin ¶
SetPlatformAdmin grants or revokes platform admin privileges.
func (*Syncer) UnregisterOrganization ¶
UnregisterOrganization removes an organization and all its membership relationships.
func (*Syncer) UnregisterPrincipal ¶
UnregisterPrincipal removes all relationships involving a principal.
func (*Syncer) UpdateOrgMembership ¶
func (s *Syncer) UpdateOrgMembership(ctx context.Context, principalID, orgID uuid.UUID, oldRole, newRole string) error
UpdateOrgMembership changes a principal's role in an organization. This is implemented as an atomic batch operation: remove old role, add new role.