authz

package

v2.4.1 Latest Latest Go to latest Published: Oct 7, 2026 License: MIT Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/lleontor705/cortex

Links

Open Source Insights

Documentation ¶

Overview ¶

Package authz contains the server authorization port. It is deliberately independent of transports and repositories so every use-case can enforce BOLA/BFLA before touching storage.

Index ¶

Constants
Variables
func DeriveTenantContext(p domain.Principal, requested Tenant) (domain.TenantContext, error)
func Enforce(ctx context.Context, a Authorizer, req Request) error
func WithAuthorizedContext(ctx context.Context, a AuthorizedContext) context.Context
type Action
type AuditEvent
type AuditSink
type AuditedAuthorizer
type AuthorizedContext
- func AuthorizedFromContext(ctx context.Context) (AuthorizedContext, bool)
- func NewAuthorizedContext(ctx context.Context, a Authorizer, req Request) (AuthorizedContext, error)
type Authorizer
type Decision
type MemoryAudit
- func (a *MemoryAudit) Record(_ context.Context, e AuditEvent) error
type OpaqueResolver
- func NewOpaqueResolver() *OpaqueResolver
- func (r *OpaqueResolver) Put(tenant, kind, opaque, internal string)
- func (r *OpaqueResolver) Resolve(tenant, kind, opaque string) (string, error)
type Policy
- func NewPolicy() *Policy
- func (p *Policy) Authorize(ctx context.Context, req Request) Decision
- func (p *Policy) AuthorizeWithAudit(ctx context.Context, req Request) (Decision, error)
type Request
type Resource
type ResourceRef
type Role
type Tenant

Constants ¶

View Source

const (
	DenyUnauthenticated  = "unauthenticated"
	DenyUnknownAction    = "unknown_action"
	DenyRole             = "role_not_permitted"
	DenyScope            = "scope_not_granted"
	DenyTenantMismatch   = "tenant_mismatch"
	DenyWorkspace        = "workspace_not_granted"
	DenyProject          = "project_not_granted"
	DenyOwnership        = "ownership_required"
	DenyClassification   = "classification_not_allowed"
	DenyResourceNotFound = "resource_not_found"
	DenyRevoked          = "credential_revoked"
)

Variables ¶

View Source

var ErrForbidden = errors.New("forbidden")

View Source

var ErrResourceNotFound = errors.New(DenyResourceNotFound)

Functions ¶

func DeriveTenantContext ¶

func DeriveTenantContext(p domain.Principal, requested Tenant) (domain.TenantContext, error)

DeriveTenantContext ignores all client-provided tenant fields. requested is retained only to detect an attempted spoof; the authenticated org wins.

func Enforce ¶

func Enforce(ctx context.Context, a Authorizer, req Request) error

Enforce is the mandatory use-case seam. Repositories must not be called until this check succeeds. The stable reason is safe for audit/metrics and never includes a resource's existence or contents.

func WithAuthorizedContext ¶

func WithAuthorizedContext(ctx context.Context, a AuthorizedContext) context.Context

Types ¶

type Action ¶

type Action string

const (
	ActionRead   Action = "read"
	ActionWrite  Action = "write"
	ActionDelete Action = "delete"
	ActionManage Action = "manage"
	ActionSearch Action = "search"
)

type AuditEvent ¶

type AuditEvent struct {
	CorrelationID, Actor, Action, Resource, ResourceID, Reason string
	Allowed                                                    bool
}

type AuditSink ¶

type AuditSink interface {
	Record(context.Context, AuditEvent) error
}

type AuditedAuthorizer ¶

type AuditedAuthorizer interface {
	AuthorizeWithAudit(context.Context, Request) (Decision, error)
}

type AuthorizedContext ¶

type AuthorizedContext struct {
	Principal   domain.Principal
	Tenant      domain.TenantContext
	GrantDigest string
}

func AuthorizedFromContext ¶

func AuthorizedFromContext(ctx context.Context) (AuthorizedContext, bool)

func NewAuthorizedContext ¶

func NewAuthorizedContext(ctx context.Context, a Authorizer, req Request) (AuthorizedContext, error)

NewAuthorizedContext binds only verified principal data to a request. A caller cannot construct a server context by supplying an arbitrary tenant.

type Authorizer ¶

type Authorizer interface {
	Authorize(context.Context, Request) Decision
}

type Decision ¶

type Decision struct {
	Allowed bool
	Reason  string
}

type MemoryAudit ¶

type MemoryAudit struct {
	Events []AuditEvent
	// contains filtered or unexported fields
}

func (*MemoryAudit) Record ¶

func (a *MemoryAudit) Record(_ context.Context, e AuditEvent) error

type OpaqueResolver ¶

type OpaqueResolver struct {
	// contains filtered or unexported fields
}

func NewOpaqueResolver ¶

func NewOpaqueResolver() *OpaqueResolver

func (*OpaqueResolver) Put ¶

func (r *OpaqueResolver) Put(tenant, kind, opaque, internal string)

func (*OpaqueResolver) Resolve ¶

func (r *OpaqueResolver) Resolve(tenant, kind, opaque string) (string, error)

type Policy ¶

type Policy struct{ Audit AuditSink }

func NewPolicy ¶

func NewPolicy() *Policy

func (*Policy) Authorize ¶

func (p *Policy) Authorize(ctx context.Context, req Request) Decision

func (*Policy) AuthorizeWithAudit ¶

func (p *Policy) AuthorizeWithAudit(ctx context.Context, req Request) (Decision, error)

AuthorizeWithAudit makes audit persistence part of privileged authorization. A failed audit denies writes, deletes, and management operations.

type Request ¶

type Request struct {
	Principal     domain.Principal
	Tenant        Tenant
	Resource      ResourceRef
	ResourceType  Resource
	Action        Action
	CorrelationID string
}

type Resource ¶

type Resource string

const (
	ResourceMemory     Resource = "memory"
	ResourceCode       Resource = "code"
	ResourceSearch     Resource = "search"
	ResourceGraph      Resource = "graph"
	ResourceTokens     Resource = "tokens"
	ResourceUsers      Resource = "users"
	ResourceWorkspaces Resource = "workspaces"
	ResourceAdmin      Resource = "admin"
)

type ResourceRef ¶

type ResourceRef struct{ TenantID, WorkspaceID, ProjectID, OwnerSubject, Classification, OpaqueID string }

type Role ¶

type Role string

const (
	RoleOwner          Role = "owner"
	RoleAdmin          Role = "admin"
	RoleMember         Role = "member"
	RoleDeveloper      Role = "developer"
	RoleAgent          Role = "agent"
	RoleViewer         Role = "viewer"
	RoleServiceAccount Role = "service-account"
)

type Tenant ¶

type Tenant struct{ ID, WorkspaceID, ProjectID string }

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL