authz

package

v0.10.0 Latest Latest Go to latest Published: Jan 9, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/openchoreo/openchoreo

Links

Documentation ¶

Index ¶

Variables
func CheckAuthorization(ctx context.Context, logger *slog.Logger, pdp authzcore.PDP, action Action, ...) error
type Action
type AuthzResponse
type BatchAuthzResponse
type Client
- func NewClient(cfg *config.AuthzConfig, logger *slog.Logger) (*Client, error)
type ResourceType

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrAuthzServiceUnavailable = errors.New("authorization service unavailable")
	ErrAuthzTimeout            = errors.New("authorization request timeout")
	ErrAuthzInvalidResponse    = errors.New("invalid authorization response")
	ErrAuthzForbidden          = errors.New("insufficient permissions to perform this action")
	ErrAuthzUnauthorized       = errors.New("unauthorized request")
)

Functions ¶

func CheckAuthorization ¶

func CheckAuthorization(
	ctx context.Context,
	logger *slog.Logger,
	pdp authzcore.PDP,
	action Action,
	resourceType ResourceType,
	resourceID string,
	hierarchy authzcore.ResourceHierarchy,
) error

CheckAuthorization performs a complete authorization check for observer operations

Types ¶

type Action ¶

type Action string

const (
	ActionViewLogs    Action = "logs:view"
	ActionViewTraces  Action = "traces:view"
	ActionViewMetrics Action = "metrics:view"
)

type AuthzResponse ¶

type AuthzResponse struct {
	Success bool               `json:"success"`
	Data    authzcore.Decision `json:"data"`
}

AuthzResponse represents the wrapped response from the authz service

type BatchAuthzResponse ¶

type BatchAuthzResponse struct {
	Success bool                            `json:"success"`
	Data    authzcore.BatchEvaluateResponse `json:"data"`
}

BatchAuthzResponse represents the wrapped response from the authz service for batch evaluate

type Client ¶

type Client struct {
	// contains filtered or unexported fields
}

func NewClient ¶

func NewClient(cfg *config.AuthzConfig, logger *slog.Logger) (*Client, error)

NewClient creates a new authz HTTP client

func (*Client) BatchEvaluate ¶

func (c *Client) BatchEvaluate(ctx context.Context, request *authzcore.BatchEvaluateRequest) (*authzcore.BatchEvaluateResponse, error)

BatchEvaluate evaluates multiple authorization requests

func (*Client) Evaluate ¶

func (c *Client) Evaluate(ctx context.Context, request *authzcore.EvaluateRequest) (*authzcore.Decision, error)

Evaluate evaluates a single authorization request

func (*Client) GetSubjectProfile ¶

func (c *Client) GetSubjectProfile(ctx context.Context, request *authzcore.ProfileRequest) (*authzcore.UserCapabilitiesResponse, error)

GetSubjectProfile is not implemented for observer API

type ResourceType ¶

type ResourceType string

const (
	ResourceTypeComponent            ResourceType = "component"
	ResourceTypeProject              ResourceType = "project"
	ResourceTypeOrg                  ResourceType = "organization"
	ResourceTypeComponentWorkflowRun ResourceType = "componentWorkflowRun"
)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL