types

package
v1.1.7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 24, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type APIKeyPrefix 

type APIKeyPrefix string
const (
	APIKeyPrefixSecretKey APIKeyPrefix = "mrp_sk_"
)

type Action 

type Action string
const (
	ActionCreate Action = "create"
	ActionRead   Action = "read"
	ActionUpdate Action = "update"
	ActionDelete Action = "delete"
)

type AnyOfPermissions 

type AnyOfPermissions []Permission

AnyOfPermissions lists permissions where holding any one satisfies the requirement. API gateway endpoints declare this shape on RequiredPermissions: the coarse gate rejects callers who hold none of the listed permissions; handlers may still apply finer per-resource checks (for example unified search skips types the caller cannot read).

type Identity 

type Identity struct {
	Type               IdentityActorType
	Target             *IdentityTarget
	Actor              *IdentityActor
	AccountMode        constants.AccountMode
	SubscriptionStatus *string
}

func GetUnauthenticatedIdentity 

func GetUnauthenticatedIdentity(targetAccountID *string) *Identity

func GetUnauthenticatedIdentityWithMode 

func GetUnauthenticatedIdentityWithMode(targetAccountID *string, accountMode constants.AccountMode) *Identity

func IdentityFromProto 

func IdentityFromProto(pbIdentity *pb.Identity) *Identity

func (*Identity) ActorAccountID 

func (i *Identity) ActorAccountID() *string

ActorAccountID returns the actor's account ID, or nil if unavailable.

func (*Identity) CheckAPIKeyAccess 

func (i *Identity) CheckAPIKeyAccess() *apierror.APIError

CheckAPIKeyAccess verifies that the identity is an internal admin with a target account set — the standard gate for API key CRUD operations.

func (*Identity) CheckHasAnyPermission 

func (i *Identity) CheckHasAnyPermission(perms ...Permission) *apierror.APIError

CheckHasAnyPermission passes if the identity holds AT LEAST ONE of the given permissions (or is an admin). It is the coarse "OR" gate used by the api-gateway to fast-reject callers that hold none of an endpoint's declared permissions; the precise, possibly relation-dependent check still happens in the downstream service.

Relation actors (customer/supplier) always fail this check: their carried role permissions apply to their OWN account, not the target/owner account this check authorizes against, so they hold no permissions here. Customer/supplier-side capabilities (e.g. a portal order) are authorized separately via CheckHasRelationCapability, which reads those same carried permissions.

func (*Identity) CheckHasPermission 

func (i *Identity) CheckHasPermission(domain PermissionDomain, action Action) *apierror.APIError

CheckHasPermission checks that the identity has a specific permission. It is the single-permission case of CheckHasAnyPermission, so the gateway gate and the internal-service checks run the exact same logic.

func (*Identity) CheckHasRelationCapability 

func (i *Identity) CheckHasRelationCapability(domain PermissionDomain, action Action) *apierror.APIError

CheckHasRelationCapability reports whether a customer/supplier relation actor holds the given permission in their OWN account (from their carried role). Use this ONLY for explicitly customer/supplier-side authorization (e.g. a portal order create); never for operations scoped to the target/owner account — for those a relation actor holds no permissions (see CheckHasAnyPermission). Non-relation actors are rejected so callers don't accidentally use it as a general permission check.

func (*Identity) CheckHasRoleType 

func (i *Identity) CheckHasRoleType(roleType constants.RoleType) *apierror.APIError

CheckHasRoleType passes if the identity has the given role type (or is an admin, who may do anything).

func (*Identity) CheckHasUserActor 

func (i *Identity) CheckHasUserActor() *apierror.APIError

CheckHasUserActor checks that the identity is an authenticated user, without requiring an assigned account. Use this for account-agnostic user endpoints (e.g. tenancy discovery) where the user may not yet have selected an account.

func (*Identity) CheckIsAPIKey 

func (i *Identity) CheckIsAPIKey() *apierror.APIError

CheckIsAPIKey checks that the identity is an API key

func (*Identity) CheckIsAdmin 

func (i *Identity) CheckIsAdmin() *apierror.APIError

CheckIsAdmin checks that the identity is an admin

func (*Identity) CheckIsAgent 

func (i *Identity) CheckIsAgent() *apierror.APIError

func (*Identity) CheckIsAssignedActor 

func (i *Identity) CheckIsAssignedActor() *apierror.APIError

CheckIsAssignedActor verifies that the identity is authenticated and is an internal, customer, or supplier actor (i.e. assigned to some account). This mirrors the legacy dashboard's checkIsAssignedActor.

func (*Identity) CheckIsAuthenticated 

func (i *Identity) CheckIsAuthenticated() *apierror.APIError

CheckIsAuthenticated checks that the identity is authenticated

func (*Identity) CheckIsInternalActor 

func (i *Identity) CheckIsInternalActor() *apierror.APIError

CheckIsInternalActor checks that the identity is an internal user

func (*Identity) CheckIsSandboxMode 

func (i *Identity) CheckIsSandboxMode() *apierror.APIError

CheckIsSandboxMode checks that the identity is in sandbox mode

func (*Identity) CheckIsTargetAccountSet 

func (i *Identity) CheckIsTargetAccountSet() *apierror.APIError

func (*Identity) CheckIsUser 

func (i *Identity) CheckIsUser() *apierror.APIError

CheckIsUser checks that the identity is a user

func (*Identity) CheckNotSandboxMode 

func (i *Identity) CheckNotSandboxMode() *apierror.APIError

CheckNotSandboxMode checks that the identity is not in sandbox mode

func (*Identity) HasUserActor 

func (i *Identity) HasUserActor() bool

HasUserActor checks that the identity is an authenticated user with a valid actor ID, regardless of whether an account is assigned. Unlike IsUser, this does not require an actor account, so it suits account-agnostic user endpoints (e.g. tenancy discovery, called before an account is selected).

func (*Identity) IsAPIKey 

func (i *Identity) IsAPIKey() bool

IsAPIKey checks that the identity is an API key and a valid actor was found

func (*Identity) IsActorSet 

func (i *Identity) IsActorSet() bool

IsActorSet checks that the identity is authenticated, has a valid actor, and has a valid actor account

func (*Identity) IsAdmin 

func (i *Identity) IsAdmin() bool

IsAdmin checks that the identity is authenticated, has a valid actor, a valid role, and is of type admin

func (*Identity) IsAuthenticated 

func (i *Identity) IsAuthenticated() bool

IsAuthenticated checks that the identity exists and is not unauthenticated

func (*Identity) IsCustomerUser 

func (i *Identity) IsCustomerUser() bool

IsCustomerUser checks that the identity is authenticated, has a valid actor, is of type customer

func (*Identity) IsExternalTarget 

func (i *Identity) IsExternalTarget() bool

IsExternalTarget checks that the identity has a valid actor, a valid actor account, and a valid target account, and that the actor's account differs from the target account

func (*Identity) IsInternalActor 

func (i *Identity) IsInternalActor() bool

IsInternalActor checks that the identity has a valid actor of type internal, regardless of target account.

func (*Identity) IsInternalUser 

func (i *Identity) IsInternalUser() bool

IsInternalUser checks that the identity is authenticated, has a valid actor, is of type internal, and has a valid actor account

func (*Identity) IsNotSandbox 

func (i *Identity) IsNotSandbox() bool

IsNotSandbox checks that the target account is not a sandbox

func (*Identity) IsRelationActor 

func (i *Identity) IsRelationActor() bool

IsRelationActor reports whether the actor reaches the target account through a customer or supplier account relation rather than as an internal member. Such actors may carry their OWN-account role permissions (used by downstream services to authorize customer-side capabilities, e.g. purchase_orders:create for a portal order); those permissions apply to the actor's own account, not the target owner's. Their RoleID/RoleType are cleared (no admin bypass). The coarse gateway permission gate declares owner-side domains, so it must not reject relation actors — their access is authorized in the downstream service.

func (*Identity) IsRoleSet 

func (i *Identity) IsRoleSet() bool

IsRoleSet checks that the identity has a valid actor and a valid role

func (*Identity) IsSalesRep 

func (i *Identity) IsSalesRep() bool

IsSalesRep checks that the identity is authenticated, has a valid actor, a valid role, and is of type sales rep

func (*Identity) IsSandbox 

func (i *Identity) IsSandbox() bool

IsSandbox checks that the target account is a sandbox

func (*Identity) IsScanner 

func (i *Identity) IsScanner() bool

IsScanner checks that the identity is authenticated, has a valid actor, a valid role, and is of type scanner

func (*Identity) IsSupplierUser 

func (i *Identity) IsSupplierUser() bool

IsSupplierUser checks that the identity is authenticated, has a valid actor, is of type supplier

func (*Identity) IsTargetAccountSet 

func (i *Identity) IsTargetAccountSet() bool

IsTargetAccountSet returns true when a target account ID is present.

func (*Identity) IsTargetCustomerAccount 

func (i *Identity) IsTargetCustomerAccount() bool

IsTargetCustomerAccount returns true when the target account is a customer account relative to the actor.

func (*Identity) IsTargetSupplierAccount 

func (i *Identity) IsTargetSupplierAccount() bool

IsTargetSupplierAccount returns true when the target account is a supplier account relative to the actor.

func (*Identity) IsUnassignedUser 

func (i *Identity) IsUnassignedUser() bool

IsUnassignedUser checks that the identity is authenticated, has a valid actor, and is of type unassigned

func (*Identity) IsUser 

func (i *Identity) IsUser() bool

IsUser checks that the identity is a user and a valid actor was found

func (*Identity) ToProto 

func (i *Identity) ToProto() *pb.Identity

type IdentityActor 

type IdentityActor struct {
	RelationType IdentityRelationType
	ID           string
	Name         *string
	AccountID    *string
	RoleID       *string
	RoleType     *string
	RoleName     *string
	Permissions  map[string]bool
}

type IdentityActorType 

type IdentityActorType string
const (
	IdentityActorTypeUser            IdentityActorType = "user"
	IdentityActorTypeAPIKey          IdentityActorType = "api_key"
	IdentityActorTypeAgent           IdentityActorType = "agent"
	IdentityActorTypeUnauthenticated IdentityActorType = "unauthenticated"
)

type IdentityRelationType 

type IdentityRelationType string
const (
	IdentityRelationTypeInternal   IdentityRelationType = "internal"
	IdentityRelationTypeCustomer   IdentityRelationType = "customer"
	IdentityRelationTypeSupplier   IdentityRelationType = "supplier"
	IdentityRelationTypeUnassigned IdentityRelationType = "unassigned"
)

func ParseIdentityRelationType 

func ParseIdentityRelationType(code string) (IdentityRelationType, bool)

func (IdentityRelationType) EnumValues 

func (t IdentityRelationType) EnumValues() []string

func (IdentityRelationType) IsValid 

func (t IdentityRelationType) IsValid() bool

type IdentityTarget 

type IdentityTarget struct {
	AccountID    string
	RelationType *IdentityRelationType
}

type Permission 

type Permission struct {
	Domain PermissionDomain
	Action Action
}

Permission is a single required permission: a domain paired with an action. Declaring permissions with these typed constants (instead of raw "<domain>:<action>" strings) is checked by the compiler, preventing typos.

func (Permission) String 

func (p Permission) String() string

String renders the permission in canonical "<domain>:<action>" form.

type PermissionDomain 

type PermissionDomain string
const (
	PermissionDomainAgents                        PermissionDomain = "agents"
	PermissionDomainAgentRuns                     PermissionDomain = "agent_runs"
	PermissionDomainAgentMemories                 PermissionDomain = "agent_memories"
	PermissionDomainAlerts                        PermissionDomain = "alerts"
	PermissionDomainAccount                       PermissionDomain = "self"
	PermissionDomainDeliveries                    PermissionDomain = "deliveries"
	PermissionDomainLocations                     PermissionDomain = "locations"
	PermissionDomainSettlements                   PermissionDomain = "settlements"
	PermissionDomainTransactions                  PermissionDomain = "transactions"
	PermissionDomainBatches                       PermissionDomain = "batches"
	PermissionDomainCarriers                      PermissionDomain = "carriers"
	PermissionDomainCustomerGroups                PermissionDomain = "customer_groups"
	PermissionDomainCustomers                     PermissionDomain = "customers"
	PermissionDomainCustomerUsers                 PermissionDomain = "contacts"
	PermissionDomainDepartmentPicks               PermissionDomain = "department_picks"
	PermissionDomainDepartments                   PermissionDomain = "departments"
	PermissionDomainDiscounts                     PermissionDomain = "discounts"
	PermissionDomainEdiLocations                  PermissionDomain = "edi_locations"
	PermissionDomainEdiRuns                       PermissionDomain = "edi_runs"
	PermissionDomainEmailLogs                     PermissionDomain = "email_logs"
	PermissionDomainErrorLogs                     PermissionDomain = "error_logs"
	PermissionDomainProducts                      PermissionDomain = "products"
	PermissionDomainInventory                     PermissionDomain = "inventory"
	PermissionDomainInventoryChangeLogs           PermissionDomain = "inventory_change_logs"
	PermissionDomainInventoryLogs                 PermissionDomain = "inventory_logs"
	PermissionDomainInvoices                      PermissionDomain = "invoices"
	PermissionDomainCategories                    PermissionDomain = "item_categories"
	PermissionDomainMachines                      PermissionDomain = "machines"
	PermissionDomainMachineDowntime               PermissionDomain = "machine_downtime"
	PermissionDomainProductionSchedules           PermissionDomain = "production_schedules"
	PermissionDomainDemandOverrides               PermissionDomain = "demand_overrides"
	PermissionDomainMaterials                     PermissionDomain = "materials"
	PermissionDomainOrganization                  PermissionDomain = "accounts"
	PermissionDomainPaymentTerms                  PermissionDomain = "payment_terms"
	PermissionDomainPermissions                   PermissionDomain = "permissions"
	PermissionDomainParts                         PermissionDomain = "parts"
	PermissionDomainPicks                         PermissionDomain = "picks"
	PermissionDomainReceivingOrders               PermissionDomain = "receiving_orders"
	PermissionDomainProductGroups                 PermissionDomain = "product_groups"
	PermissionDomainItems                         PermissionDomain = "items"
	PermissionDomainProductionRuns                PermissionDomain = "production_runs"
	PermissionDomainProductionStepTransformations PermissionDomain = "production_step_transformations"
	PermissionDomainProductionSteps               PermissionDomain = "production_steps"
	PermissionDomainProductLines                  PermissionDomain = "product_lines"
	PermissionDomainProductVariations             PermissionDomain = "product_variations"
	PermissionDomainProperties                    PermissionDomain = "properties"
	PermissionDomainPurchaseOrders                PermissionDomain = "purchase_orders"
	PermissionDomainSuppliers                     PermissionDomain = "suppliers"
	PermissionDomainReceiving                     PermissionDomain = "receiving"
	PermissionDomainProductLineAccess             PermissionDomain = "relevant_products"
	PermissionDomainRoles                         PermissionDomain = "roles"
	PermissionDomainSalesOrders                   PermissionDomain = "sales_orders"
	PermissionDomainTerritories                   PermissionDomain = "sales_rep_territories"
	PermissionDomainSalesTargets                  PermissionDomain = "sales_targets"
	PermissionDomainScanningStations              PermissionDomain = "scanners"
	PermissionDomainScanningErrorLogs             PermissionDomain = "scanning_error_logs"
	PermissionDomainShifts                        PermissionDomain = "shifts"
	PermissionDomainShipments                     PermissionDomain = "shipments"
	PermissionDomainShippingCases                 PermissionDomain = "shipping_cases"
	PermissionDomainShippingTerms                 PermissionDomain = "shipping_terms"
	PermissionDomainSupplies                      PermissionDomain = "supplies"
	PermissionDomainSystemProperties              PermissionDomain = "system_properties"
	PermissionDomainTeamUsers                     PermissionDomain = "team"
	PermissionDomainUnits                         PermissionDomain = "units"
	PermissionDomainUnitGroups                    PermissionDomain = "unit_groups"
	PermissionDomainRequestLogs                   PermissionDomain = "request_logs"
	PermissionDomainAuditEvents                   PermissionDomain = "audit_events"
	PermissionDomainAPIKeys                       PermissionDomain = "api_keys"
	PermissionDomainSandbox                       PermissionDomain = "sandboxes"
	PermissionDomainAddresses                     PermissionDomain = "addresses"
	PermissionDomainIntegrations                  PermissionDomain = "integrations"
	PermissionDomainAdjustmentTypes               PermissionDomain = "adjustment_types"
	PermissionDomainPriorities                    PermissionDomain = "priorities"
	PermissionDomainProductTypes                  PermissionDomain = "product_types"
	PermissionDomainJobs                          PermissionDomain = "jobs"
	PermissionDomainMessaging                     PermissionDomain = "messaging"
)

func AllPermissionDomains added in v1.1.7 

func AllPermissionDomains() []PermissionDomain

AllPermissionDomains lists every permission domain the platform recognizes, so a role's `<domain>:<action>` grant can be checked against a real domain instead of persisting an unusable one. Kept beside the constants it enumerates: adding a domain without adding it here makes that domain unassignable through the roles API.

func (PermissionDomain) IsValid added in v1.1.7 

func (d PermissionDomain) IsValid() bool

IsValid reports whether the domain is one the platform recognizes.

type User 

type User struct {
	ID             string
	Email          *string
	Name           *string
	Username       *string
	HashedPassword *string `json:"-"`
	EmailVerified  *time.Time
	ImageUrl       *string
	StatusCode     string
	CreatedAt      time.Time
	UpdatedAt      time.Time
}

func (*User) ToProto 

func (u *User) ToProto() *pb.User

type UserStatus 

type UserStatus string
const (
	UserStatusActive   UserStatus = "active"
	UserStatusDisabled UserStatus = "disabled"
	UserStatusDeleted  UserStatus = "deleted"
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.