authz

package

v1.1.3 Latest Latest Go to latest Published: Jul 22, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/openchoreo/openchoreo

Links

Documentation ¶

Index ¶

Variables
func CheckAuthorization(ctx context.Context, logger *slog.Logger, pdp authzcore.PDP, action Action, ...) error
func FormatDualScopedResourceName(namespace, name string, isClusterScoped bool) string
type Action
type Client
- func NewClient(cfg *config.AuthzConfig, logger *slog.Logger) (*Client, error)
type ResourceType
- func ComponentScopeAuthz(namespace, project, component string) (ResourceType, string, authzcore.ResourceHierarchy)
- func LogsScopeAuthz(req *types.LogsQueryRequest) (ResourceType, string, authzcore.ResourceHierarchy, error)

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	ErrAuthzServiceUnavailable = errors.New("authorization service unavailable")
	ErrAuthzTimeout            = errors.New("authorization request timeout")
	ErrAuthzInvalidResponse    = errors.New("invalid authorization response")
	ErrAuthzForbidden          = errors.New("insufficient permissions to perform this action")
	ErrAuthzUnauthorized       = errors.New("unauthorized request")
)

Functions ¶

func CheckAuthorization ¶

func CheckAuthorization(
	ctx context.Context,
	logger *slog.Logger,
	pdp authzcore.PDP,
	action Action,
	resourceType ResourceType,
	resourceID string,
	hierarchy authzcore.ResourceHierarchy,
	authzCtx authzcore.Context,
) error

CheckAuthorization performs a complete authorization check for observer operations.

func FormatDualScopedResourceName ¶ added in v1.1.0

func FormatDualScopedResourceName(namespace, name string, isClusterScoped bool) string

FormatDualScopedResourceName returns the authz-engine identifier for a dual-scoped resource. Namespace-scoped resources use "{namespace}/{name}"; cluster-scoped resources use plain "{name}". An empty name returns "" so callers can omit the attribute when the scope is not provided.

Types ¶

type Action ¶

type Action string

const (
	ActionViewLogs        Action = "logs:view"
	ActionViewTraces      Action = "traces:view"
	ActionViewMetrics     Action = "metrics:view"
	ActionViewAlerts      Action = "alerts:view"
	ActionViewIncidents   Action = "incidents:view"
	ActionUpdateIncidents Action = "incidents:update"
)

type Client ¶

type Client struct {
	// contains filtered or unexported fields
}

func NewClient ¶

func NewClient(cfg *config.AuthzConfig, logger *slog.Logger) (*Client, error)

NewClient creates a new authz HTTP client

func (*Client) BatchEvaluate ¶

func (c *Client) BatchEvaluate(ctx context.Context, request *authzcore.BatchEvaluateRequest) (*authzcore.BatchEvaluateResponse, error)

BatchEvaluate evaluates multiple authorization requests via the unified evaluates endpoint.

func (*Client) Evaluate ¶

func (c *Client) Evaluate(ctx context.Context, request *authzcore.EvaluateRequest) (*authzcore.Decision, error)

Evaluate evaluates a single authorization request via the unified evaluates endpoint.

func (*Client) GetSubjectProfile ¶

func (c *Client) GetSubjectProfile(ctx context.Context, request *authzcore.ProfileRequest) (*authzcore.UserCapabilitiesResponse, error)

GetSubjectProfile is not implemented for observer API

type ResourceType ¶

type ResourceType string

const (
	ResourceTypeUnknown     ResourceType = "unknown"
	ResourceTypeComponent   ResourceType = "component"
	ResourceTypeProject     ResourceType = "project"
	ResourceTypeNamespace   ResourceType = "namespace"
	ResourceTypeWorkflowRun ResourceType = "workflowRun"
)

func ComponentScopeAuthz ¶ added in v0.17.0

func ComponentScopeAuthz(namespace, project, component string) (ResourceType, string, authzcore.ResourceHierarchy)

ComponentScopeAuthz determines the authorization resource type, name, and hierarchy from a component search scope (namespace/project/component). The most specific non-empty field determines the resource type.

func LogsScopeAuthz ¶ added in v0.17.0

func LogsScopeAuthz(req *types.LogsQueryRequest) (ResourceType, string, authzcore.ResourceHierarchy, error)

LogsScopeAuthz determines the authorization resource type, name, and hierarchy from a logs query request's search scope.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL