rbac

type Authorizer interface {
	Authorize(ctx context.Context, req Request) (Decision, error)
}

type Decision struct {
	Allowed   bool
	Reason    string
	Fields    []string
	RowFilter relalg.Predicate
	Grants    []string
	// FieldScopes is set on an ambiguous-field-scope denial: each entry is a
	// field set one grant covers, so the caller can retry with explicit fields.
	FieldScopes [][]string
}

type Grant struct {
	ID      string
	Actions []entity.Action
	Fields  *entity.FieldPermissions
	Rows    relalg.Predicate
}

type GrantAuthorizer struct {
	// contains filtered or unexported fields
}

type Policy struct {
	Roles      map[string]map[string][]Grant
	Principals map[string]Principal
}

type Principal struct {
	Roles  []string
	Grants map[string][]Grant
}

type Request struct {
	Role        string
	Entity      string
	Action      entity.Action
	Fields      []string         // requested fields; nil/empty means all visible
	ReadFields  []string         // fields used by projections, filters, grouping, or aggregates
	WriteFields []string         // fields assigned by create/update
	Subject     map[string]any   // caller attributes for ${subject.x} row-policy resolution
	Predicate   relalg.Predicate // the request's own filter (for context, not mutated here)
}