opaclient

type Action string

type AllowedProjectsRequest struct {
	Input AllowedProjectsRequestInput `json:"input,omitempty"`
}

type AllowedProjectsRequestInput struct {
	Ids []string `json:"ids,omitempty"`
}

type AllowedProjectsResponse struct {
	Result []string `json:"result,omitempty"`
}

type Client interface {
	// QueryPermissions queries permission for a single resource.
	QueryPermissions(context.Context, string, Action, *PermissionOptions) (bool, error)

	// QueryPermissionsMultiResources queries permissions for multiple resources at once.
	// Returns a slice of booleans where each index corresponds to the resource at the same index.
	QueryPermissionsMultiResources(context.Context, []string, Action, *PermissionOptions) ([]bool, error)

	// QueryAllowedProjects returns the set of project names the caller (identified by
	// PermissionOptions.MemberIds) is allowed to read or list. A returned slice
	// containing "*" signals that all projects are accessible — callers are responsible
	// for treating "*" as a wildcard; no concrete names are returned alongside it.
	QueryAllowedProjects(context.Context, *PermissionOptions) ([]string, error)
}

type ClientKind string

type Config struct {

	// OPA server address
	Address string `json:"address,omitempty"`

	// client kind to use (nop | http | mock)
	ClientKind ClientKind `json:"clientKind,omitempty"`

	// timeout period when querying opa server
	RequestTimeout int `json:"requestTimeout,omitempty"`

	// the path used when querying single resource against opa server (e.g.: /v1/data/somewhere/authz/allow)
	PermissionQueryPath string `json:"permissionQueryPath,omitempty"`

	// the path used when querying multiple resources against opa server (e.g.: /v1/data/somewhere/authz/filter_allowed)
	PermissionFilterPath string `json:"permissionFilterPath,omitempty"`

	// the path used when querying allowed projects against opa server (e.g.: /v1/data/platform/authz/allowed_projects)
	AllowedProjectsQueryPath string `json:"allowedProjectsQueryPath,omitempty"`

	// for extra verbosity
	Verbose bool `json:"verbose,omitempty"`

	// the header value for bypassing OPA if needed
	OverrideHeaderValue string `json:"overrideHeaderValue,omitempty"`

	// SkipTLSVerify indicates whether to skip TLS verification for the OPA server
	SkipTLSVerify bool `json:"skipTLSVerify,omitempty"`
}

type HTTPClient struct {
	// contains filtered or unexported fields
}

type MockClient struct {
	mock.Mock
}

type NopClient struct {
	// contains filtered or unexported fields
}

type PermissionFilterRequest struct {
	Input PermissionFilterRequestInput `json:"input,omitempty"`
}

type PermissionFilterRequestInput struct {
	Resources []string `json:"resources,omitempty"`
	Action    string   `json:"action,omitempty"`
	Ids       []string `json:"ids,omitempty"`
}

type PermissionFilterResponse struct {
	Result []string `json:"result,omitempty"`
}

type PermissionOptions struct {
	MemberIds            []string
	RaiseForbidden       bool
	OverrideHeaderValue  string
	SkipLoggingForbidden bool
}

type PermissionQueryRequest struct {
	Input PermissionQueryRequestInput `json:"input,omitempty"`
}

type PermissionQueryRequestInput struct {
	Resource string   `json:"resource,omitempty"`
	Action   string   `json:"action,omitempty"`
	Ids      []string `json:"ids,omitempty"`
}

type PermissionQueryResponse struct {
	Result bool `json:"result,omitempty"`
}