Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrForbidden = errors.New("insufficient permissions to perform this action")
Functions ¶
func BuildListOptions ¶ added in v1.0.0
func BuildListOptions(opts ListOptions) ([]client.ListOption, error)
BuildListOptions converts ListOptions into controller-runtime client.ListOption slice containing pagination (limit, cursor) and label selector options. Callers should prepend namespace-scoping or other options as needed.
func ExtractValidationMessage ¶ added in v0.17.0
ExtractValidationMessage extracts cause messages from a K8s StatusError, falling back to a generic message to avoid leaking internal details.
Types ¶
type AuthzChecker ¶ added in v0.16.0
type AuthzChecker struct {
// contains filtered or unexported fields
}
AuthzChecker provides authorization checking for service authz wrappers.
func NewAuthzChecker ¶ added in v0.16.0
func NewAuthzChecker(pdp authz.PDP, logger *slog.Logger) *AuthzChecker
NewAuthzChecker creates a new AuthzChecker.
func (*AuthzChecker) BatchCheck ¶ added in v0.16.0
func (c *AuthzChecker) BatchCheck(ctx context.Context, requests []CheckRequest) ([]bool, error)
BatchCheck performs a batch authorization check and returns a boolean slice
func (*AuthzChecker) Check ¶ added in v0.16.0
func (c *AuthzChecker) Check(ctx context.Context, req CheckRequest) error
Check performs a single authorization check.
type CheckRequest ¶ added in v0.16.0
type CheckRequest struct {
Action string
ResourceType string
ResourceID string
Hierarchy authz.ResourceHierarchy
}
CheckRequest represents a resource authorization check.
type GenerateAuthzCheckRequest ¶ added in v0.16.0
type GenerateAuthzCheckRequest[T any] func(item T) CheckRequest
GenerateAuthzCheckRequest builds a CheckRequest for an individual item.
type ItemFilter ¶ added in v0.16.0
ItemFilter is a predicate that returns true if the item should be included.
type ListOptions ¶ added in v0.16.0
type ListOptions struct {
// Limit is the maximum number of items to return per page.
Limit int
// Cursor is an opaque pagination cursor from a previous response.
Cursor string
// LabelSelector is an optional label selector string to filter resources server-side
// (e.g., "app=frontend,tier=backend").
LabelSelector string
}
ListOptions controls pagination and filtering for list operations.
type ListResource ¶ added in v0.16.0
type ListResource[T any] func(ctx context.Context, opts ListOptions) (*ListResult[T], error)
ListResource fetches a single page of items from the underlying data source.
func PreFilteredList ¶ added in v0.16.0
func PreFilteredList[T any]( listResource ListResource[T], filters ...ItemFilter[T], ) ListResource[T]
PreFilteredList wraps a ListResource with in-memory predicate filters. It returns a new ListResource that over-fetches and filters items while maintaining correct pagination using an internal cursor. This can be composed with FilteredList for layered filtering (e.g., project filter + authz filter). When no filters are provided, the original listResource is returned unchanged.
type ListResult ¶ added in v0.16.0
type ListResult[T any] struct { // Items is the list of resources in this page. Items []T // NextCursor is an opaque cursor for fetching the next page. // Empty when there are no more items. NextCursor string // RemainingCount is an approximate count of items remaining after this page. // Nil when the count is unknown (e.g. authz-filtered queries). RemainingCount *int64 }
ListResult holds a page of items along with pagination metadata.
func FilteredList ¶ added in v0.16.0
func FilteredList[T any]( ctx context.Context, opts ListOptions, authzChecker *AuthzChecker, listResource ListResource[T], generateAuthzCheckRequest GenerateAuthzCheckRequest[T], ) (*ListResult[T], error)
FilteredList implements the generic authz-filtered over-fetch loop. It fetches pages from the data source, filters items through the authz checker, and accumulates results until the requested limit is reached or all items are exhausted.
type ValidationError ¶ added in v0.17.0
type ValidationError struct {
Msg string
}
ValidationError represents a request validation failure.
func (*ValidationError) Error ¶ added in v0.17.0
func (e *ValidationError) Error() string
Source Files
Directories