core

package
v1.1.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 22, 2026 License: Apache-2.0 Imports: 9 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// Namespace actions
	ActionCreateNamespace = "namespace:create"
	ActionViewNamespace   = "namespace:view"
	ActionUpdateNamespace = "namespace:update"
	ActionDeleteNamespace = "namespace:delete"

	// Project actions
	ActionCreateProject = "project:create"
	ActionViewProject   = "project:view"
	ActionUpdateProject = "project:update"
	ActionDeleteProject = "project:delete"

	// Component actions
	ActionCreateComponent = "component:create"
	ActionViewComponent   = "component:view"
	ActionUpdateComponent = "component:update"
	ActionDeleteComponent = "component:delete"
	ActionExecComponent   = "component:exec"

	// Resource actions
	ActionCreateResource = "resource:create"
	ActionViewResource   = "resource:view"
	ActionUpdateResource = "resource:update"
	ActionDeleteResource = "resource:delete"

	// ComponentRelease actions
	ActionCreateComponentRelease = "componentrelease:create"
	ActionViewComponentRelease   = "componentrelease:view"
	ActionDeleteComponentRelease = "componentrelease:delete"

	// ResourceRelease actions
	ActionCreateResourceRelease = "resourcerelease:create"
	ActionViewResourceRelease   = "resourcerelease:view"
	ActionDeleteResourceRelease = "resourcerelease:delete"

	// ReleaseBinding actions
	ActionCreateReleaseBinding = "releasebinding:create"
	ActionViewReleaseBinding   = "releasebinding:view"
	ActionUpdateReleaseBinding = "releasebinding:update"
	ActionDeleteReleaseBinding = "releasebinding:delete"

	// ResourceReleaseBinding actions
	ActionCreateResourceReleaseBinding = "resourcereleasebinding:create"
	ActionViewResourceReleaseBinding   = "resourcereleasebinding:view"
	ActionUpdateResourceReleaseBinding = "resourcereleasebinding:update"
	ActionDeleteResourceReleaseBinding = "resourcereleasebinding:delete"

	// ComponentType actions
	ActionCreateComponentType = "componenttype:create"
	ActionViewComponentType   = "componenttype:view"
	ActionUpdateComponentType = "componenttype:update"
	ActionDeleteComponentType = "componenttype:delete"

	// ResourceType actions
	ActionCreateResourceType = "resourcetype:create"
	ActionViewResourceType   = "resourcetype:view"
	ActionUpdateResourceType = "resourcetype:update"
	ActionDeleteResourceType = "resourcetype:delete"

	// Workflow actions
	ActionCreateWorkflow = "workflow:create"
	ActionViewWorkflow   = "workflow:view"
	ActionUpdateWorkflow = "workflow:update"
	ActionDeleteWorkflow = "workflow:delete"

	// WorkflowRun actions
	ActionCreateWorkflowRun = "workflowrun:create"
	ActionViewWorkflowRun   = "workflowrun:view"
	ActionUpdateWorkflowRun = "workflowrun:update"
	ActionDeleteWorkflowRun = "workflowrun:delete"

	// Trait actions
	ActionCreateTrait = "trait:create"
	ActionViewTrait   = "trait:view"
	ActionUpdateTrait = "trait:update"
	ActionDeleteTrait = "trait:delete"

	// Environment actions
	ActionCreateEnvironment = "environment:create"
	ActionViewEnvironment   = "environment:view"
	ActionUpdateEnvironment = "environment:update"
	ActionDeleteEnvironment = "environment:delete"

	// DataPlane actions
	ActionCreateDataPlane = "dataplane:create"
	ActionViewDataPlane   = "dataplane:view"
	ActionUpdateDataPlane = "dataplane:update"
	ActionDeleteDataPlane = "dataplane:delete"

	// WorkflowPlane actions
	ActionCreateWorkflowPlane = "workflowplane:create"
	ActionViewWorkflowPlane   = "workflowplane:view"
	ActionUpdateWorkflowPlane = "workflowplane:update"
	ActionDeleteWorkflowPlane = "workflowplane:delete"

	// ObservabilityPlane actions
	ActionCreateObservabilityPlane = "observabilityplane:create"
	ActionViewObservabilityPlane   = "observabilityplane:view"
	ActionUpdateObservabilityPlane = "observabilityplane:update"
	ActionDeleteObservabilityPlane = "observabilityplane:delete"

	// ClusterComponentType actions
	ActionCreateClusterComponentType = "clustercomponenttype:create"
	ActionViewClusterComponentType   = "clustercomponenttype:view"
	ActionUpdateClusterComponentType = "clustercomponenttype:update"
	ActionDeleteClusterComponentType = "clustercomponenttype:delete"

	// ClusterResourceType actions
	ActionCreateClusterResourceType = "clusterresourcetype:create"
	ActionViewClusterResourceType   = "clusterresourcetype:view"
	ActionUpdateClusterResourceType = "clusterresourcetype:update"
	ActionDeleteClusterResourceType = "clusterresourcetype:delete"

	// ClusterTrait actions
	ActionCreateClusterTrait = "clustertrait:create"
	ActionViewClusterTrait   = "clustertrait:view"
	ActionUpdateClusterTrait = "clustertrait:update"
	ActionDeleteClusterTrait = "clustertrait:delete"

	// ClusterWorkflow actions
	ActionCreateClusterWorkflow = "clusterworkflow:create"
	ActionViewClusterWorkflow   = "clusterworkflow:view"
	ActionUpdateClusterWorkflow = "clusterworkflow:update"
	ActionDeleteClusterWorkflow = "clusterworkflow:delete"

	// ClusterDataPlane actions
	ActionCreateClusterDataPlane = "clusterdataplane:create"
	ActionViewClusterDataPlane   = "clusterdataplane:view"
	ActionUpdateClusterDataPlane = "clusterdataplane:update"
	ActionDeleteClusterDataPlane = "clusterdataplane:delete"

	// ClusterWorkflowPlane actions
	ActionCreateClusterWorkflowPlane = "clusterworkflowplane:create"
	ActionViewClusterWorkflowPlane   = "clusterworkflowplane:view"
	ActionUpdateClusterWorkflowPlane = "clusterworkflowplane:update"
	ActionDeleteClusterWorkflowPlane = "clusterworkflowplane:delete"

	// ClusterObservabilityPlane actions
	ActionCreateClusterObservabilityPlane = "clusterobservabilityplane:create"
	ActionViewClusterObservabilityPlane   = "clusterobservabilityplane:view"
	ActionUpdateClusterObservabilityPlane = "clusterobservabilityplane:update"
	ActionDeleteClusterObservabilityPlane = "clusterobservabilityplane:delete"

	// DeploymentPipeline actions
	ActionCreateDeploymentPipeline = "deploymentpipeline:create"
	ActionViewDeploymentPipeline   = "deploymentpipeline:view"
	ActionUpdateDeploymentPipeline = "deploymentpipeline:update"
	ActionDeleteDeploymentPipeline = "deploymentpipeline:delete"

	// ObservabilityAlertsNotificationChannel actions
	ActionCreateObservabilityAlertsNotificationChannel = "observabilityalertsnotificationchannel:create"
	ActionViewObservabilityAlertsNotificationChannel   = "observabilityalertsnotificationchannel:view"
	ActionUpdateObservabilityAlertsNotificationChannel = "observabilityalertsnotificationchannel:update"
	ActionDeleteObservabilityAlertsNotificationChannel = "observabilityalertsnotificationchannel:delete"

	// SecretReference actions
	ActionCreateSecretReference = "secretreference:create"
	ActionViewSecretReference   = "secretreference:view"
	ActionUpdateSecretReference = "secretreference:update"
	ActionDeleteSecretReference = "secretreference:delete"

	// Secret actions
	ActionCreateSecret = "secret:create"
	ActionViewSecret   = "secret:view"
	ActionUpdateSecret = "secret:update"
	ActionDeleteSecret = "secret:delete"

	// Workload actions
	ActionCreateWorkload = "workload:create"
	ActionViewWorkload   = "workload:view"
	ActionUpdateWorkload = "workload:update"
	ActionDeleteWorkload = "workload:delete"

	// ClusterAuthzRole actions
	ActionCreateClusterAuthzRole = "clusterauthzrole:create"
	ActionViewClusterAuthzRole   = "clusterauthzrole:view"
	ActionUpdateClusterAuthzRole = "clusterauthzrole:update"
	ActionDeleteClusterAuthzRole = "clusterauthzrole:delete"

	// AuthzRole actions
	ActionCreateAuthzRole = "authzrole:create"
	ActionViewAuthzRole   = "authzrole:view"
	ActionUpdateAuthzRole = "authzrole:update"
	ActionDeleteAuthzRole = "authzrole:delete"

	// ClusterAuthzRoleBinding actions
	ActionCreateClusterAuthzRoleBinding = "clusterauthzrolebinding:create"
	ActionViewClusterAuthzRoleBinding   = "clusterauthzrolebinding:view"
	ActionUpdateClusterAuthzRoleBinding = "clusterauthzrolebinding:update"
	ActionDeleteClusterAuthzRoleBinding = "clusterauthzrolebinding:delete"

	// AuthzRoleBinding actions
	ActionCreateAuthzRoleBinding = "authzrolebinding:create"
	ActionViewAuthzRoleBinding   = "authzrolebinding:view"
	ActionUpdateAuthzRoleBinding = "authzrolebinding:update"
	ActionDeleteAuthzRoleBinding = "authzrolebinding:delete"

	// Logs actions
	ActionViewLogs = "logs:view"

	// Metrics actions
	ActionViewMetrics = "metrics:view"

	// Traces actions
	ActionViewTraces = "traces:view"

	// Alerts actions
	ActionViewAlerts = "alerts:view"

	// Incidents actions
	ActionViewIncidents   = "incidents:view"
	ActionUpdateIncidents = "incidents:update"

	// RCA Report actions
	ActionViewRCAReport   = "rcareport:view"
	ActionUpdateRCAReport = "rcareport:update"

	// FinOps Report actions
	ActionViewFinOpsReport   = "finopsreport:view"
	ActionUpdateFinOpsReport = "finopsreport:update"
)

Action name constants for use in authorization checks.

Variables

View Source 
var (
	ErrAuthzDisabled             = fmt.Errorf("authorization is disabled - policy management operations are not available")
	ErrRoleAlreadyExists         = fmt.Errorf("role already exists")
	ErrRoleNotFound              = fmt.Errorf("role not found")
	ErrRoleInUse                 = fmt.Errorf("role is in use and cannot be deleted")
	ErrRoleMappingAlreadyExists  = fmt.Errorf("role mapping already exists")
	ErrRoleMappingNotFound       = fmt.Errorf("role mapping not found")
	ErrCannotDeleteSystemMapping = fmt.Errorf("cannot delete system mapping")
	ErrCannotModifySystemMapping = fmt.Errorf("cannot modify system mapping")
	ErrInvalidRequest            = fmt.Errorf("invalid request")
)
View Source 
var AttrResourceEnvironment = AttributeSpec{
	Key:         "resource.environment",
	Description: "Environment associated with the resource",
	CELType:     cel.StringType,
}

AttrResourceEnvironment declares resource.environment — the environment associated with the resource being acted upon (e.g. "dev", "staging", "prod").

View Source 
var KnownCELRoots = map[string]bool{
	// contains filtered or unexported fields
}

KnownCELRoots is the set of CEL root variable names declared in the shared env. Add new roots here when extending the ABAC attribute model.

Functions

func ExpandActionPattern added in v1.1.0 

func ExpandActionPattern(pattern string) []string

ExpandActionPattern expands one (possibly wildcarded) action pattern to the concrete public action names it matches.

  • "*" -> every concrete public action
  • "<resource>:*" -> every concrete public action with that resource prefix
  • "resource:op" -> [resource:op] if it is a known concrete public action, else nil

func GetCELEnv added in v1.1.0 

func GetCELEnv() (*cel.Env, error)

GetCELEnv returns the shared CEL environment used by both the runtime evaluator and the admission webhook, so validation matches evaluation exactly.

Types

type Action added in v0.14.0 

type Action struct {
	Name string
	// LowestScope indicates the lowest resource hierarchy level at which this action is evaluated
	LowestScope ActionScope
	// IsInternal indicates if the action is internal (not publicly visible)
	IsInternal bool
	// Conditions holds the ABAC attributes available for CEL condition expressions on this action
	Conditions []AttributeSpec
}

Action represents a system action with metadata

func AllActions added in v0.14.0 

func AllActions() []Action

AllActions returns all system-defined actions

func ConcretePublicActions added in v0.14.0 

func ConcretePublicActions() []Action

ConcretePublicActions returns only concrete (non-wildcarded) public actions, sorted by name, with Conditions populated.

func PublicActions added in v0.14.0 

func PublicActions() []Action

PublicActions returns all public (non-internal) actions, sorted by name, with conditions populated.

type ActionCapability added in v0.8.0 

type ActionCapability struct {
	Allowed []*CapabilityResource `json:"allowed"`
	Denied  []*CapabilityResource `json:"denied"`
}

ActionCapability represents capabilities for a specific action

type ActionScope added in v1.0.0 

type ActionScope string

ActionScope represents the resource hierarchy level at which an action is evaluated. 

const (
	// ScopeCluster indicates the action is evaluated at the cluster level (no hierarchy).
	ScopeCluster ActionScope = "cluster"
	// ScopeNamespace indicates the action is evaluated at the namespace level.
	ScopeNamespace ActionScope = "namespace"
	// ScopeProject indicates the action is evaluated at the project level.
	ScopeProject ActionScope = "project"
	// ScopeComponent indicates the action is evaluated at the component level.
	ScopeComponent ActionScope = "component"
	// ScopeResource indicates the action is evaluated at the resource level.
	// Resource is a sibling sub-scope under Project, parallel to Component.
	ScopeResource ActionScope = "resource"
)

type AttributeSpec added in v1.1.0 

type AttributeSpec struct {
	// Key is the full dotted path (e.g. "resource.environment").
	Key string
	// Description is a short human-readable description used in error messages.
	Description string
	// CELType is the expected CEL type for the attribute at the leaf.
	CELType *cel.Type
}

AttributeSpec describes one ABAC attribute that can be referenced in CEL condition expressions.

func IntersectConditionsForActions added in v1.1.0 

func IntersectConditionsForActions(actions []string) []AttributeSpec

IntersectConditionsForActions returns the attribute specs allowed for every action in the input list. Wildcard patterns ("*", "<resource>:*") are expanded to their concrete actions before intersection, so a condition targeting "releasebinding:*" is treated as targeting every concrete releasebinding action.

Returns an empty (non-nil) slice if any pattern matches no known public action, or if the expanded action set has no common attributes.

func LookupConditions added in v1.1.0 

func LookupConditions(action string) []AttributeSpec

LookupConditions returns the attribute specs available for a given concrete action. Returns nil if the action has no registered attributes.

func (AttributeSpec) Leaf added in v1.1.0 

func (s AttributeSpec) Leaf() string

Leaf returns the leaf field name (portion after the first '.').

func (AttributeSpec) Root added in v1.1.0 

func (s AttributeSpec) Root() string

Root returns the CEL root variable name (portion before the first '.').

type BatchEvaluateRequest 

type BatchEvaluateRequest struct {
	Requests []EvaluateRequest `json:"requests"`
}

BatchEvaluateRequest represents a batch of authorization requests

type BatchEvaluateResponse 

type BatchEvaluateResponse struct {
	Decisions []Decision `json:"decisions"`
}

BatchEvaluateResponse represents a batch of authorization decisions

type CapabilityResource added in v0.8.0 

type CapabilityResource struct {
	Path        string       `json:"path"`                  // Full resource path: "namespace/acme/project/payment"
	Constraints *Constraints `json:"constraints,omitempty"` // nil means unconditionally granted
}

CapabilityResource represents a resource with permission details

type Constraints added in v1.1.0 

type Constraints struct {
	Expressions []string `json:"expressions"`
}

Constraints holds the CEL expressions that restrict access for a given action+path. Multiple expressions are OR'd — access is granted if any one of them evaluates to true.

type Context 

type Context struct {
	// Resource holds attributes of the target resource instance.
	Resource ResourceAttribute `json:"resource,omitempty"`
}

Context carries root-namespaced ABAC attributes available to CEL condition expressions. Each root corresponds to a CEL variable (e.g. resource.environment) and maps to a Go field here. Adding new roots (principal, request) is a non-breaking additive change.

type Decision 

type Decision struct {
	Decision bool             `json:"decision"`
	Context  *DecisionContext `json:"context,omitempty"`
}

Decision represents the authorization decision response

type DecisionContext 

type DecisionContext struct {
	Reason string `json:"reason,omitempty"`
}

DecisionContext contains additional context about the decision

type Entitlement added in v0.8.0 

type Entitlement struct {
	// Claim is the JWT claim name (e.g., "group", "sub")
	Claim string `json:"claim" yaml:"claim"`

	// Value is the entitlement value (e.g., "admin-group", "service-123")
	Value string `json:"value" yaml:"value"`
}

Entitlement represents an entitlement with its claim and value

type EvaluateRequest 

type EvaluateRequest struct {
	SubjectContext *SubjectContext `json:"subject_context"`
	Resource       Resource        `json:"resource"`
	Action         string          `json:"action"`
	Context        Context         `json:"context"`
}

EvaluateRequest represents a single authorization request

type PAP 

type PAP interface {
	// ListActions lists all public actions in the system
	ListActions(ctx context.Context) ([]Action, error)

	// CreateClusterRole creates a new cluster-scoped role and returns the full CRD object
	CreateClusterRole(ctx context.Context, role *openchoreov1alpha1.ClusterAuthzRole) (*openchoreov1alpha1.ClusterAuthzRole, error)
	// GetClusterRole retrieves a cluster-scoped role by name
	GetClusterRole(ctx context.Context, name string) (*openchoreov1alpha1.ClusterAuthzRole, error)
	// ListClusterRoles lists all cluster-scoped roles
	ListClusterRoles(ctx context.Context, limit int, cursor string) (*PaginatedList[openchoreov1alpha1.ClusterAuthzRole], error)
	// UpdateClusterRole updates a cluster-scoped role and returns the updated CRD object
	UpdateClusterRole(ctx context.Context, role *openchoreov1alpha1.ClusterAuthzRole) (*openchoreov1alpha1.ClusterAuthzRole, error)
	// DeleteClusterRole deletes a cluster-scoped role by name
	DeleteClusterRole(ctx context.Context, name string) error

	// CreateNamespacedRole creates a new namespace-scoped role and returns the full CRD object
	CreateNamespacedRole(ctx context.Context, role *openchoreov1alpha1.AuthzRole) (*openchoreov1alpha1.AuthzRole, error)
	// GetNamespacedRole retrieves a namespace-scoped role by name and namespace
	GetNamespacedRole(ctx context.Context, name string, namespace string) (*openchoreov1alpha1.AuthzRole, error)
	// ListNamespacedRoles lists namespace-scoped roles in the given namespace
	ListNamespacedRoles(ctx context.Context, namespace string, limit int, cursor string) (*PaginatedList[openchoreov1alpha1.AuthzRole], error)
	// UpdateNamespacedRole updates a namespace-scoped role and returns the updated CRD object
	UpdateNamespacedRole(ctx context.Context, role *openchoreov1alpha1.AuthzRole) (*openchoreov1alpha1.AuthzRole, error)
	// DeleteNamespacedRole deletes a namespace-scoped role by name and namespace
	DeleteNamespacedRole(ctx context.Context, name string, namespace string) error

	// CreateClusterRoleBinding creates a new cluster-scoped role binding and returns the full CRD object
	CreateClusterRoleBinding(ctx context.Context, binding *openchoreov1alpha1.ClusterAuthzRoleBinding) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)
	// GetClusterRoleBinding retrieves a cluster-scoped role binding by name
	GetClusterRoleBinding(ctx context.Context, name string) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)
	// ListClusterRoleBindings lists all cluster-scoped role bindings
	ListClusterRoleBindings(ctx context.Context, limit int, cursor string) (*PaginatedList[openchoreov1alpha1.ClusterAuthzRoleBinding], error)
	// UpdateClusterRoleBinding updates a cluster-scoped role binding and returns the updated CRD object
	UpdateClusterRoleBinding(ctx context.Context, binding *openchoreov1alpha1.ClusterAuthzRoleBinding) (*openchoreov1alpha1.ClusterAuthzRoleBinding, error)
	// DeleteClusterRoleBinding deletes a cluster-scoped role binding by name
	DeleteClusterRoleBinding(ctx context.Context, name string) error

	// CreateNamespacedRoleBinding creates a new namespace-scoped role binding and returns the full CRD object
	CreateNamespacedRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzRoleBinding) (*openchoreov1alpha1.AuthzRoleBinding, error)
	// GetNamespacedRoleBinding retrieves a namespace-scoped role binding by name and namespace
	GetNamespacedRoleBinding(ctx context.Context, name string, namespace string) (*openchoreov1alpha1.AuthzRoleBinding, error)
	// ListNamespacedRoleBindings lists namespace-scoped role bindings in the given namespace
	ListNamespacedRoleBindings(ctx context.Context, namespace string, limit int, cursor string) (*PaginatedList[openchoreov1alpha1.AuthzRoleBinding], error)
	// UpdateNamespacedRoleBinding updates a namespace-scoped role binding and returns the updated CRD object
	UpdateNamespacedRoleBinding(ctx context.Context, binding *openchoreov1alpha1.AuthzRoleBinding) (*openchoreov1alpha1.AuthzRoleBinding, error)
	// DeleteNamespacedRoleBinding deletes a namespace-scoped role binding by name and namespace
	DeleteNamespacedRoleBinding(ctx context.Context, name string, namespace string) error
}

PAP (Policy Administration Point) interface defines the contract for policy management

type PDP 

type PDP interface {
	// Evaluate evaluates a single authorization request and returns a decision
	Evaluate(ctx context.Context, request *EvaluateRequest) (*Decision, error)

	// BatchEvaluate evaluates multiple authorization requests and returns corresponding decisions
	BatchEvaluate(ctx context.Context, request *BatchEvaluateRequest) (*BatchEvaluateResponse, error)

	// GetSubjectProfile retrieves the authorization profile for a given subject
	GetSubjectProfile(ctx context.Context, request *ProfileRequest) (*UserCapabilitiesResponse, error)
}

PDP (Policy Decision Point) interface defines the contract for authorization evaluation

type PaginatedList added in v0.17.0 

type PaginatedList[T any] struct {
	Items      []T
	NextCursor string
}

PaginatedList holds a page of items along with pagination metadata. This type is used by the PAP layer to return paginated results

type PolicyEffectType 

type PolicyEffectType string

PolicyEffectType defines the effect of a policy: allow or deny 

const (
	PolicyEffectAllow PolicyEffectType = "allow"
	PolicyEffectDeny  PolicyEffectType = "deny"
)

type ProfileRequest 

type ProfileRequest struct {
	// SubjectContext is the authenticated subject whose profile is being requested
	SubjectContext *SubjectContext `json:"subject_context"`

	// Scope is the resource hierarchy scope for the profile
	Scope ResourceHierarchy `json:"scope"`
}

ProfileRequest represents a request to retrieve a subject's authorization profile

type Resource 

type Resource struct {
	Type      string            `json:"type"`
	ID        string            `json:"id,omitempty"`
	Hierarchy ResourceHierarchy `json:"hierarchy"`
}

Resource represents a resource in the authorization request

type ResourceAttribute added in v1.1.0 

type ResourceAttribute struct {
	// Environment is the target environment (e.g. "dev", "staging", "prod").
	Environment string `json:"environment,omitempty"`
}

ResourceAttribute holds target-resource attributes exposed to CEL under the "resource" root.

type ResourceHierarchy 

type ResourceHierarchy struct {
	Namespace string `json:"namespace,omitempty"`
	Project   string `json:"project,omitempty"`
	Component string `json:"component,omitempty"`
	Resource  string `json:"resource,omitempty"`
}

ResourceHierarchy represents a single item in a resource hierarchy. Component and Resource are sibling sub-scopes under Project; a hierarchy must not set both. The sibling invariant is enforced at the CRD layer via kubebuilder XValidation on TargetScope / ClusterTargetScope.

type RoleRef added in v0.12.0 

type RoleRef struct {
	// Name is the role name
	Name string `json:"name" yaml:"name"`

	// Namespace identifies the role scope:
	// - Empty string ("") = cluster-scoped role
	// - Non-empty = namespace-scoped role in the specified namespace
	Namespace string `json:"namespace,omitempty" yaml:"namespace"`
}

RoleRef uniquely identifies a role by name and namespace

type SubjectContext 

type SubjectContext struct {
	Type              string   `json:"type"`
	EntitlementClaim  string   `json:"entitlement_claim"`
	EntitlementValues []string `json:"entitlement_values"`
}

SubjectContext represents the authenticated subject making the authorization request

func GetAuthzSubjectContext added in v0.9.0 

func GetAuthzSubjectContext(authCtx *auth.SubjectContext) *SubjectContext

GetAuthzSubjectContext converts auth.SubjectContext to authz SubjectContext

type UserCapabilitiesResponse added in v0.8.0 

type UserCapabilitiesResponse struct {
	User         *SubjectContext              `json:"user"`
	Capabilities map[string]*ActionCapability `json:"capabilities"`
	GeneratedAt  time.Time                    `json:"evaluatedAt"`
}

UserCapabilitiesResponse represents the complete capabilities response

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.