types

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 23, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type APIKeyPrefix 

type APIKeyPrefix string
const (
	APIKeyPrefixSecretKey APIKeyPrefix = "mrp_sk_"
)

type Action 

type Action string
const (
	ActionCreate Action = "create"
	ActionRead   Action = "read"
	ActionUpdate Action = "update"
	ActionDelete Action = "delete"
)

type AnyOfPermissions 

type AnyOfPermissions []Permission

AnyOfPermissions lists permissions where holding any one satisfies the requirement. API gateway endpoints declare this shape on RequiredPermissions: the coarse gate rejects callers who hold none of the listed permissions; handlers may still apply finer per-resource checks (for example unified search skips types the caller cannot read).

type Identity 

type Identity struct {
	Type               IdentityActorType
	Target             *IdentityTarget
	Actor              *IdentityActor
	AccountMode        constants.AccountMode
	SubscriptionStatus *string
}

func GetUnauthenticatedIdentity 

func GetUnauthenticatedIdentity(targetAccountID *string) *Identity

func GetUnauthenticatedIdentityWithMode 

func GetUnauthenticatedIdentityWithMode(targetAccountID *string, accountMode constants.AccountMode) *Identity

func IdentityFromProto 

func IdentityFromProto(pbIdentity *pb.Identity) *Identity

func (*Identity) ActorAccountID 

func (i *Identity) ActorAccountID() *string

ActorAccountID returns the actor's account ID, or nil if unavailable.

func (*Identity) CheckAPIKeyAccess 

func (i *Identity) CheckAPIKeyAccess() *apierror.APIError

CheckAPIKeyAccess verifies that the identity is an internal admin with a target account set — the standard gate for API key CRUD operations.

func (*Identity) CheckHasAnyPermission 

func (i *Identity) CheckHasAnyPermission(perms ...Permission) *apierror.APIError

CheckHasAnyPermission passes if the identity holds AT LEAST ONE of the given permissions (or is an admin). It is the coarse "OR" gate used by the api-gateway to fast-reject callers that hold none of an endpoint's declared permissions; the precise, possibly relation-dependent check still happens in the downstream service.

Relation actors (customer/supplier) always fail this check: their carried role permissions apply to their OWN account, not the target/owner account this check authorizes against, so they hold no permissions here. Customer/supplier-side capabilities (e.g. a portal order) are authorized separately via CheckHasRelationCapability, which reads those same carried permissions.

func (*Identity) CheckHasPermission 

func (i *Identity) CheckHasPermission(domain PermissionDomain, action Action) *apierror.APIError

CheckHasPermission checks that the identity has a specific permission. It is the single-permission case of CheckHasAnyPermission, so the gateway gate and the internal-service checks run the exact same logic.

func (*Identity) CheckHasRelationCapability 

func (i *Identity) CheckHasRelationCapability(domain PermissionDomain, action Action) *apierror.APIError

CheckHasRelationCapability reports whether a customer/supplier relation actor holds the given permission in their OWN account (from their carried role). Use this ONLY for explicitly customer/supplier-side authorization (e.g. a portal order create); never for operations scoped to the target/owner account — for those a relation actor holds no permissions (see CheckHasAnyPermission). Non-relation actors are rejected so callers don't accidentally use it as a general permission check.

func (*Identity) CheckHasRoleType 

func (i *Identity) CheckHasRoleType(roleType constants.RoleType) *apierror.APIError

CheckHasRoleType passes if the identity has the given role type (or is an admin, who may do anything).

func (*Identity) CheckHasUserActor 

func (i *Identity) CheckHasUserActor() *apierror.APIError

CheckHasUserActor checks that the identity is an authenticated user, without requiring an assigned account. Use this for account-agnostic user endpoints (e.g. tenancy discovery) where the user may not yet have selected an account.

func (*Identity) CheckIsAPIKey 

func (i *Identity) CheckIsAPIKey() *apierror.APIError

CheckIsAPIKey checks that the identity is an API key

func (*Identity) CheckIsAdmin 

func (i *Identity) CheckIsAdmin() *apierror.APIError

CheckIsAdmin checks that the identity is an admin

func (*Identity) CheckIsAgent 

func (i *Identity) CheckIsAgent() *apierror.APIError

func (*Identity) CheckIsAssignedActor 

func (i *Identity) CheckIsAssignedActor() *apierror.APIError

CheckIsAssignedActor verifies that the identity is authenticated and is an internal, customer, or supplier actor (i.e. assigned to some account). This mirrors the legacy dashboard's checkIsAssignedActor.

func (*Identity) CheckIsAuthenticated 

func (i *Identity) CheckIsAuthenticated() *apierror.APIError

CheckIsAuthenticated checks that the identity is authenticated

func (*Identity) CheckIsInternalActor 

func (i *Identity) CheckIsInternalActor() *apierror.APIError

CheckIsInternalActor checks that the identity is an internal user

func (*Identity) CheckIsSandboxMode 

func (i *Identity) CheckIsSandboxMode() *apierror.APIError

CheckIsSandboxMode checks that the identity is in sandbox mode

func (*Identity) CheckIsTargetAccountSet 

func (i *Identity) CheckIsTargetAccountSet() *apierror.APIError

func (*Identity) CheckIsUser 

func (i *Identity) CheckIsUser() *apierror.APIError

CheckIsUser checks that the identity is a user

func (*Identity) CheckNotSandboxMode 

func (i *Identity) CheckNotSandboxMode() *apierror.APIError

CheckNotSandboxMode checks that the identity is not in sandbox mode

func (*Identity) HasUserActor 

func (i *Identity) HasUserActor() bool

HasUserActor checks that the identity is an authenticated user with a valid actor ID, regardless of whether an account is assigned. Unlike IsUser, this does not require an actor account, so it suits account-agnostic user endpoints (e.g. tenancy discovery, called before an account is selected).

func (*Identity) IsAPIKey 

func (i *Identity) IsAPIKey() bool

IsAPIKey checks that the identity is an API key and a valid actor was found

func (*Identity) IsActorSet 

func (i *Identity) IsActorSet() bool

IsActorSet checks that the identity is authenticated, has a valid actor, and has a valid actor account

func (*Identity) IsAdmin 

func (i *Identity) IsAdmin() bool

IsAdmin checks that the identity is authenticated, has a valid actor, a valid role, and is of type admin

func (*Identity) IsAuthenticated 

func (i *Identity) IsAuthenticated() bool

IsAuthenticated checks that the identity exists and is not unauthenticated

func (*Identity) IsCustomerUser 

func (i *Identity) IsCustomerUser() bool

IsCustomerUser checks that the identity is authenticated, has a valid actor, is of type customer

func (*Identity) IsExternalTarget 

func (i *Identity) IsExternalTarget() bool

IsExternalTarget checks that the identity has a valid actor, a valid actor account, and a valid target account, and that the actor's account differs from the target account

func (*Identity) IsInternalActor 

func (i *Identity) IsInternalActor() bool

IsInternalActor checks that the identity has a valid actor of type internal, regardless of target account.

func (*Identity) IsInternalUser 

func (i *Identity) IsInternalUser() bool

IsInternalUser checks that the identity is authenticated, has a valid actor, is of type internal, and has a valid actor account

func (*Identity) IsNotSandbox 

func (i *Identity) IsNotSandbox() bool

IsNotSandbox checks that the target account is not a sandbox

func (*Identity) IsRelationActor 

func (i *Identity) IsRelationActor() bool

IsRelationActor reports whether the actor reaches the target account through a customer or supplier account relation rather than as an internal member. Such actors may carry their OWN-account role permissions (used by downstream services to authorize customer-side capabilities, e.g. purchase_orders:create for a portal order); those permissions apply to the actor's own account, not the target owner's. Their RoleID/RoleType are cleared (no admin bypass). The coarse gateway permission gate declares owner-side domains, so it must not reject relation actors — their access is authorized in the downstream service.

func (*Identity) IsRoleSet 

func (i *Identity) IsRoleSet() bool

IsRoleSet checks that the identity has a valid actor and a valid role

func (*Identity) IsSalesRep 

func (i *Identity) IsSalesRep() bool

IsSalesRep checks that the identity is authenticated, has a valid actor, a valid role, and is of type sales rep

func (*Identity) IsSandbox 

func (i *Identity) IsSandbox() bool

IsSandbox checks that the target account is a sandbox

func (*Identity) IsScanner 

func (i *Identity) IsScanner() bool

IsScanner checks that the identity is authenticated, has a valid actor, a valid role, and is of type scanner

func (*Identity) IsSupplierUser 

func (i *Identity) IsSupplierUser() bool

IsSupplierUser checks that the identity is authenticated, has a valid actor, is of type supplier

func (*Identity) IsTargetAccountSet 

func (i *Identity) IsTargetAccountSet() bool

IsTargetAccountSet returns true when a target account ID is present.

func (*Identity) IsTargetCustomerAccount 

func (i *Identity) IsTargetCustomerAccount() bool

IsTargetCustomerAccount returns true when the target account is a customer account relative to the actor.

func (*Identity) IsTargetSupplierAccount 

func (i *Identity) IsTargetSupplierAccount() bool

IsTargetSupplierAccount returns true when the target account is a supplier account relative to the actor.

func (*Identity) IsUnassignedUser 

func (i *Identity) IsUnassignedUser() bool

IsUnassignedUser checks that the identity is authenticated, has a valid actor, and is of type unassigned

func (*Identity) IsUser 

func (i *Identity) IsUser() bool

IsUser checks that the identity is a user and a valid actor was found

func (*Identity) ToProto 

func (i *Identity) ToProto() *pb.Identity

type IdentityActor 

type IdentityActor struct {
	RelationType IdentityRelationType
	ID           string
	Name         *string
	AccountID    *string
	RoleID       *string
	RoleType     *string
	RoleName     *string
	Permissions  map[string]bool
}

type IdentityActorType 

type IdentityActorType string
const (
	IdentityActorTypeUser            IdentityActorType = "user"
	IdentityActorTypeAPIKey          IdentityActorType = "api_key"
	IdentityActorTypeAgent           IdentityActorType = "agent"
	IdentityActorTypeUnauthenticated IdentityActorType = "unauthenticated"
)

type IdentityRelationType 

type IdentityRelationType string
const (
	IdentityRelationTypeInternal   IdentityRelationType = "internal"
	IdentityRelationTypeCustomer   IdentityRelationType = "customer"
	IdentityRelationTypeSupplier   IdentityRelationType = "supplier"
	IdentityRelationTypeUnassigned IdentityRelationType = "unassigned"
)

func ParseIdentityRelationType 

func ParseIdentityRelationType(code string) (IdentityRelationType, bool)

func (IdentityRelationType) EnumValues 

func (t IdentityRelationType) EnumValues() []string

func (IdentityRelationType) IsValid 

func (t IdentityRelationType) IsValid() bool

type IdentityTarget 

type IdentityTarget struct {
	AccountID    string
	RelationType *IdentityRelationType
}

type Permission 

type Permission struct {
	Domain PermissionDomain
	Action Action
}

Permission is a single required permission: a domain paired with an action. Declaring permissions with these typed constants (instead of raw "<domain>:<action>" strings) is checked by the compiler, preventing typos.

func (Permission) String 

func (p Permission) String() string

String renders the permission in canonical "<domain>:<action>" form.

type PermissionDomain 

type PermissionDomain string
const (
	PermissionDomainAgents                        PermissionDomain = "agents"
	PermissionDomainAgentRuns                     PermissionDomain = "agent_runs"
	PermissionDomainAgentMemories                 PermissionDomain = "agent_memories"
	PermissionDomainAlerts                        PermissionDomain = "alerts"
	PermissionDomainAccount                       PermissionDomain = "self"
	PermissionDomainDeliveries                    PermissionDomain = "deliveries"
	PermissionDomainLocations                     PermissionDomain = "locations"
	PermissionDomainSettlements                   PermissionDomain = "settlements"
	PermissionDomainTransactions                  PermissionDomain = "transactions"
	PermissionDomainBatches                       PermissionDomain = "batches"
	PermissionDomainCarriers                      PermissionDomain = "carriers"
	PermissionDomainCustomerGroups                PermissionDomain = "customer_groups"
	PermissionDomainCustomers                     PermissionDomain = "customers"
	PermissionDomainCustomerUsers                 PermissionDomain = "contacts"
	PermissionDomainDepartmentPicks               PermissionDomain = "department_picks"
	PermissionDomainDepartments                   PermissionDomain = "departments"
	PermissionDomainDiscounts                     PermissionDomain = "discounts"
	PermissionDomainEdiLocations                  PermissionDomain = "edi_locations"
	PermissionDomainEdiRuns                       PermissionDomain = "edi_runs"
	PermissionDomainEmailLogs                     PermissionDomain = "email_logs"
	PermissionDomainErrorLogs                     PermissionDomain = "error_logs"
	PermissionDomainProducts                      PermissionDomain = "products"
	PermissionDomainInventory                     PermissionDomain = "inventory"
	PermissionDomainInventoryChangeLogs           PermissionDomain = "inventory_change_logs"
	PermissionDomainInventoryLogs                 PermissionDomain = "inventory_logs"
	PermissionDomainInvoices                      PermissionDomain = "invoices"
	PermissionDomainCategories                    PermissionDomain = "item_categories"
	PermissionDomainMachines                      PermissionDomain = "machines"
	PermissionDomainMachineDowntime               PermissionDomain = "machine_downtime"
	PermissionDomainProductionSchedules           PermissionDomain = "production_schedules"
	PermissionDomainDemandOverrides               PermissionDomain = "demand_overrides"
	PermissionDomainMaterials                     PermissionDomain = "materials"
	PermissionDomainOrganization                  PermissionDomain = "accounts"
	PermissionDomainPaymentTerms                  PermissionDomain = "payment_terms"
	PermissionDomainPermissions                   PermissionDomain = "permissions"
	PermissionDomainParts                         PermissionDomain = "parts"
	PermissionDomainPicks                         PermissionDomain = "picks"
	PermissionDomainReceivingOrders               PermissionDomain = "receiving_orders"
	PermissionDomainProductGroups                 PermissionDomain = "product_groups"
	PermissionDomainItems                         PermissionDomain = "items"
	PermissionDomainProductionRuns                PermissionDomain = "production_runs"
	PermissionDomainProductionStepTransformations PermissionDomain = "production_step_transformations"
	PermissionDomainProductionSteps               PermissionDomain = "production_steps"
	PermissionDomainProductLines                  PermissionDomain = "product_lines"
	PermissionDomainProductVariations             PermissionDomain = "product_variations"
	PermissionDomainProperties                    PermissionDomain = "properties"
	PermissionDomainPurchaseOrders                PermissionDomain = "purchase_orders"
	PermissionDomainSuppliers                     PermissionDomain = "suppliers"
	PermissionDomainReceiving                     PermissionDomain = "receiving"
	PermissionDomainProductLineAccess             PermissionDomain = "relevant_products"
	PermissionDomainRoles                         PermissionDomain = "roles"
	PermissionDomainSalesOrders                   PermissionDomain = "sales_orders"
	PermissionDomainTerritories                   PermissionDomain = "sales_rep_territories"
	PermissionDomainSalesTargets                  PermissionDomain = "sales_targets"
	PermissionDomainScanningStations              PermissionDomain = "scanners"
	PermissionDomainScanningErrorLogs             PermissionDomain = "scanning_error_logs"
	PermissionDomainShifts                        PermissionDomain = "shifts"
	PermissionDomainShipments                     PermissionDomain = "shipments"
	PermissionDomainShippingCases                 PermissionDomain = "shipping_cases"
	PermissionDomainShippingTerms                 PermissionDomain = "shipping_terms"
	PermissionDomainSupplies                      PermissionDomain = "supplies"
	PermissionDomainSystemProperties              PermissionDomain = "system_properties"
	PermissionDomainTeamUsers                     PermissionDomain = "team"
	PermissionDomainUnits                         PermissionDomain = "units"
	PermissionDomainUnitGroups                    PermissionDomain = "unit_groups"
	PermissionDomainRequestLogs                   PermissionDomain = "request_logs"
	PermissionDomainAuditEvents                   PermissionDomain = "audit_events"
	PermissionDomainAPIKeys                       PermissionDomain = "api_keys"
	PermissionDomainSandbox                       PermissionDomain = "sandboxes"
	PermissionDomainAddresses                     PermissionDomain = "addresses"
	PermissionDomainIntegrations                  PermissionDomain = "integrations"
	PermissionDomainAdjustmentTypes               PermissionDomain = "adjustment_types"
	PermissionDomainPriorities                    PermissionDomain = "priorities"
	PermissionDomainProductTypes                  PermissionDomain = "product_types"
	PermissionDomainJobs                          PermissionDomain = "jobs"
	PermissionDomainMessaging                     PermissionDomain = "messaging"
)

type User 

type User struct {
	ID             string
	Email          *string
	Name           *string
	Username       *string
	HashedPassword *string `json:"-"`
	EmailVerified  *time.Time
	ImageUrl       *string
	StatusCode     string
	CreatedAt      time.Time
	UpdatedAt      time.Time
}

func (*User) ToProto 

func (u *User) ToProto() *pb.User

type UserStatus 

type UserStatus string
const (
	UserStatusActive   UserStatus = "active"
	UserStatusDisabled UserStatus = "disabled"
	UserStatusDeleted  UserStatus = "deleted"
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.