authz

type Action ¶

type Action int32

Action represents a permission action that can be checked.

const (
	Action_empty_action            Action = 0
	Action_can_view                Action = 1
	Action_can_edit                Action = 2
	Action_can_edit_members        Action = 3
	Action_can_create_org          Action = 4
	Action_can_delete_org          Action = 5
	Action_can_create_feed_version Action = 6
	Action_can_delete_feed_version Action = 7
	Action_can_create_feed         Action = 8
	Action_can_delete_feed         Action = 9
	Action_can_set_group           Action = 10
	Action_can_set_tenant          Action = 11
)

func ActionString(v string) (Action, error)

func (a Action) MarshalText() ([]byte, error)

func (a Action) String() string

func (a *Action) UnmarshalText(text []byte) error

type ActionSet ¶ added in v1.3.3

type ActionSet = map[Action]bool

ActionSet is the result of checking what a user can do on an object.

type AdminManager ¶ added in v1.3.3

type AdminManager interface {
	PermissionManager
	UserList(ctx context.Context, req *UserListRequest) (*UserListResponse, error)
	User(ctx context.Context, req *UserRequest) (*UserResponse, error)
	TenantSave(ctx context.Context, req *TenantSaveRequest) (*TenantSaveResponse, error)
	TenantCreateGroup(ctx context.Context, req *TenantCreateGroupRequest) (*GroupSaveResponse, error)
	GroupSave(ctx context.Context, req *GroupSaveRequest) (*GroupSaveResponse, error)
}

AdminManager extends PermissionManager with admin-specific DB write operations for managing tenants and groups. These are not expressible through the generic permission interface because they create/update database entities, not just authorization tuples.

Implementations that expose user search (e.g., for assigning users to tenants/groups) must handle visibility scoping in the UserProvider layer. The GraphQL resolvers gate access via can_edit_members but do not filter results — the UserProvider is responsible for limiting which users are returned based on deployment-specific rules (e.g., Auth0 organization boundaries, tenant membership, etc.).

type AllowAllChecker ¶ added in v1.3.3

type AllowAllChecker struct{}

AllowAllChecker is the explicit "allow all" Checker — install it when a deployment wants to opt out of authorization. Pairs with DenyAllChecker. Use only in demo binaries or tests; never in a deployment that enforces per-feed permissions. When no authn user is present, Me() returns a synthetic identity with the "admin" role, so anonymous callers also pass any handler gated on RoleRequired("admin").

func (c *AllowAllChecker) Check(ctx context.Context, obj ObjectRef, action Action) (bool, error)

func (c *AllowAllChecker) IsGlobalAdmin(ctx context.Context) (bool, error)

func (c *AllowAllChecker) ListObjects(ctx context.Context, objType ObjectType) ([]ObjectRef, error)

func (c *AllowAllChecker) Me(ctx context.Context) (*UserInfo, error)

type Checker ¶ added in v1.3.3

type Checker interface {
	Me(ctx context.Context) (*UserInfo, error)
	IsGlobalAdmin(ctx context.Context) (bool, error)
	ListObjects(ctx context.Context, objType ObjectType) ([]ObjectRef, error)
	Check(ctx context.Context, obj ObjectRef, action Action) (bool, error)
}

Checker is the read-only query interface used by the data path (perm_filter, actions, dbfinder mutations, GraphQL resolvers).

type DenyAllChecker ¶ added in v1.3.3

type DenyAllChecker struct{}

DenyAllChecker is the explicit "deny all" Checker — install it when callers should have no per-feed access. Read paths still see public feeds via the unconditional public clause in pfJoinCheck.

func (c *DenyAllChecker) Check(ctx context.Context, obj ObjectRef, action Action) (bool, error)

func (c *DenyAllChecker) IsGlobalAdmin(ctx context.Context) (bool, error)

func (c *DenyAllChecker) ListObjects(ctx context.Context, objType ObjectType) ([]ObjectRef, error)

func (c *DenyAllChecker) Me(ctx context.Context) (*UserInfo, error)

type EntityKey ¶

type EntityKey struct {
	Type   ObjectType `json:"type"`
	Name   string     `json:"name"`
	RefRel Relation   `json:"ref_rel"`
}

func NewEntityKey(t ObjectType, name string) EntityKey

func (ek EntityKey) Equals(other EntityKey) bool

func (ek EntityKey) ID() int64

func (ek EntityKey) String() string

func (ek EntityKey) WithRefRel(r Relation) EntityKey

type EntityRelation ¶

type EntityRelation struct {
	Type        ObjectType `json:"type,omitempty"`
	Id          string     `json:"id,omitempty"`
	Name        string     `json:"name,omitempty"`
	RefRelation Relation   `json:"ref_relation,omitempty"`
	Relation    Relation   `json:"relation,omitempty"`
}

func NewEntityRelation(ek EntityKey, rel Relation) *EntityRelation

func (x *EntityRelation) GetId() string

func (x *EntityRelation) GetName() string

func (x *EntityRelation) GetRefRelation() Relation

func (x *EntityRelation) GetRelation() Relation

func (x *EntityRelation) GetType() ObjectType

func (er *EntityRelation) Int64() int64

func (er *EntityRelation) WithObject(ek EntityKey) TupleKey

type Feed ¶

type Feed struct {
	Id        int64  `json:"id,omitempty"`
	OnestopId string `json:"onestop_id,omitempty"`
	Name      string `json:"name,omitempty"`
}

func (x *Feed) GetId() int64

func (x *Feed) GetName() string

func (x *Feed) GetOnestopId() string

type FeedVersion ¶

type FeedVersion struct {
	Id     int64  `json:"id,omitempty"`
	Name   string `json:"name,omitempty"`
	Sha1   string `json:"sha1,omitempty"`
	FeedId int64  `json:"feed_id,omitempty"`
}

func (x *FeedVersion) GetFeedId() int64

func (x *FeedVersion) GetId() int64

func (x *FeedVersion) GetName() string

func (x *FeedVersion) GetSha1() string

type Group ¶

type Group struct {
	Id   int64  `json:"id,omitempty"`
	Name string `json:"name,omitempty"`
}

func (x *Group) GetId() int64

func (x *Group) GetName() string

type GroupSaveRequest ¶

type GroupSaveRequest struct {
	Group *Group `json:"group,omitempty"`
}

func (x *GroupSaveRequest) GetGroup() *Group

type GroupSaveResponse ¶

type GroupSaveResponse struct {
	Group *Group `json:"group,omitempty"`
}

type ObjectPermissions ¶ added in v1.3.3

type ObjectPermissions struct {
	Ref      ObjectRef    `json:"ref"`
	Actions  ActionSet    `json:"actions"`
	Subjects []SubjectRef `json:"subjects"`
	Parent   *ObjectRef   `json:"parent,omitempty"`
	Children []ObjectRef  `json:"children,omitempty"`
}

ObjectPermissions is the generic return from a permissions query.

type ObjectRef ¶ added in v1.3.3

type ObjectRef struct {
	Type ObjectType `json:"type"`
	ID   int64      `json:"id"`
	Name string     `json:"name,omitempty"`
}

ObjectRef identifies an entity in the authorization system.

type ObjectType ¶

type ObjectType int32

ObjectType represents the type of an entity in the authorization model.

const (
	ObjectType_empty_object ObjectType = 0
	ObjectType_tenant       ObjectType = 1
	ObjectType_org          ObjectType = 2
	ObjectType_feed         ObjectType = 3
	ObjectType_feed_version ObjectType = 4
	ObjectType_user         ObjectType = 5
)

func ObjectTypeString(v string) (ObjectType, error)

func (o ObjectType) MarshalText() ([]byte, error)

func (o ObjectType) String() string

func (o *ObjectType) UnmarshalText(text []byte) error

type PermissionManager ¶ added in v1.3.3

type PermissionManager interface {
	Checker
	ObjectPermissions(ctx context.Context, obj ObjectRef) (*ObjectPermissions, error)
	SetParent(ctx context.Context, child ObjectRef, parent ObjectRef) error
	AddPermission(ctx context.Context, obj ObjectRef, subject EntityKey, relation Relation) error
	RemovePermission(ctx context.Context, obj ObjectRef, subject EntityKey, relation Relation) error
}

PermissionManager extends Checker with write operations for managing permissions, parents, and viewing detailed permission info. Implementations must enforce authorization checks internally — callers (e.g., GraphQL resolvers) delegate all access control to these methods.

type Relation ¶

type Relation int32

Relation represents a relationship between entities.

const (
	Relation_empty_relation Relation = 0
	Relation_admin          Relation = 1
	Relation_member         Relation = 2
	Relation_manager        Relation = 3
	Relation_viewer         Relation = 4
	Relation_editor         Relation = 5
	Relation_parent         Relation = 6
)

func RelationString(v string) (Relation, error)

func (r Relation) MarshalText() ([]byte, error)

func (r Relation) String() string

func (r *Relation) UnmarshalText(text []byte) error

type SubjectRef ¶ added in v1.3.3

type SubjectRef struct {
	Subject  EntityKey `json:"subject"`
	Relation Relation  `json:"relation"`
	Name     string    `json:"name"`
}

SubjectRef describes who has a relationship to an object.

type Tenant ¶

type Tenant struct {
	Id   int64  `json:"id,omitempty"`
	Name string `json:"name,omitempty"`
}

func (x *Tenant) GetId() int64

func (x *Tenant) GetName() string

type TenantCreateGroupRequest ¶

type TenantCreateGroupRequest struct {
	Id    int64  `json:"id,omitempty"`
	Group *Group `json:"group,omitempty"`
}

func (x *TenantCreateGroupRequest) GetGroup() *Group

func (x *TenantCreateGroupRequest) GetId() int64

type TenantSaveRequest ¶

type TenantSaveRequest struct {
	Tenant *Tenant `json:"tenant,omitempty"`
}

func (x *TenantSaveRequest) GetTenant() *Tenant

type TenantSaveResponse ¶

type TenantSaveResponse struct{}

type TupleKey ¶

type TupleKey struct {
	Subject  EntityKey
	Object   EntityKey
	Action   Action   `json:"action"`
	Relation Relation `json:"relation"`
}

func NewTupleKey() TupleKey

func (tk TupleKey) ActionOrRelation() string

func (tk TupleKey) Equals(other TupleKey) bool

func (tk TupleKey) IsValid() bool

func (tk TupleKey) String() string

func (tk TupleKey) Validate() error

func (tk TupleKey) WithAction(action Action) TupleKey

func (tk TupleKey) WithObject(objectType ObjectType, objectName string) TupleKey

func (tk TupleKey) WithObjectID(objectType ObjectType, objectId int64) TupleKey

func (tk TupleKey) WithRelation(relation Relation) TupleKey

func (tk TupleKey) WithSubject(userType ObjectType, userName string) TupleKey

func (tk TupleKey) WithSubjectID(userType ObjectType, userId int64) TupleKey

func (tk TupleKey) WithUser(user string) TupleKey

type User ¶

type User struct {
	Id    string `json:"id,omitempty"`
	Name  string `json:"name,omitempty"`
	Email string `json:"email,omitempty"`
}

func (x *User) GetEmail() string

func (x *User) GetId() string

func (x *User) GetName() string

type UserInfo ¶ added in v1.3.3

type UserInfo struct {
	ID             string            `json:"id"`
	Name           string            `json:"name"`
	Email          string            `json:"email"`
	Roles          []string          `json:"roles"`
	Groups         []Group           `json:"groups"`
	ExpandedGroups []Group           `json:"expanded_groups"`
	ExternalData   map[string]string `json:"external_data"`
}

UserInfo is the return from Checker.Me().

type UserListRequest ¶

type UserListRequest struct {
	Q string `json:"q,omitempty"`
}

func (x *UserListRequest) GetQ() string

type UserListResponse ¶

type UserListResponse struct {
	Users []*User `json:"users,omitempty"`
}

type UserRequest ¶

type UserRequest struct {
	Id string `json:"id,omitempty"`
}

func (x *UserRequest) GetId() string

type UserResponse ¶

type UserResponse struct {
	User *User `json:"user,omitempty"`
}