Documentation
¶
Index ¶
- Variables
- func BuildListOptions(opts ListOptions) ([]client.ListOption, error)
- func ExtractValidationMessage(err error) string
- func FormatDualScopedResourceName(namespace, name string, isClusterScoped bool) string
- type AuthzChecker
- type CheckRequest
- type GenerateAuthzCheckRequest
- type ItemFilter
- type ListOptions
- type ListResource
- type ListResult
- type ValidationError
Constants ¶
This section is empty.
Variables ¶
var ErrForbidden = errors.New("insufficient permissions to perform this action")
Functions ¶
func BuildListOptions ¶ added in v1.0.0
func BuildListOptions(opts ListOptions) ([]client.ListOption, error)
BuildListOptions converts ListOptions into controller-runtime client.ListOption slice containing pagination (limit, cursor) and label selector options. Callers should prepend namespace-scoping or other options as needed.
func ExtractValidationMessage ¶ added in v0.17.0
ExtractValidationMessage extracts cause messages from a K8s StatusError, falling back to a generic message to avoid leaking internal details.
func FormatDualScopedResourceName ¶ added in v1.1.0
FormatDualScopedResourceName returns the authz-engine identifier for a dual-scoped resource. Namespace-scoped resources use "{namespace}/{name}"; cluster-scoped resources use plain "{name}".
Types ¶
type AuthzChecker ¶ added in v0.16.0
type AuthzChecker struct {
// contains filtered or unexported fields
}
AuthzChecker provides authorization checking for service authz wrappers.
func NewAuthzChecker ¶ added in v0.16.0
func NewAuthzChecker(pdp authz.PDP, logger *slog.Logger) *AuthzChecker
NewAuthzChecker creates a new AuthzChecker.
func (*AuthzChecker) BatchCheck ¶ added in v0.16.0
func (c *AuthzChecker) BatchCheck(ctx context.Context, requests []CheckRequest) ([]bool, error)
BatchCheck performs a batch authorization check and returns a boolean slice
func (*AuthzChecker) Check ¶ added in v0.16.0
func (c *AuthzChecker) Check(ctx context.Context, req CheckRequest) error
Check performs a single authorization check.
type CheckRequest ¶ added in v0.16.0
type CheckRequest struct {
Action string
ResourceType string
ResourceID string
Hierarchy authz.ResourceHierarchy
Context authz.Context
}
CheckRequest represents a resource authorization check.
type GenerateAuthzCheckRequest ¶ added in v0.16.0
type GenerateAuthzCheckRequest[T any] func(item T) CheckRequest
GenerateAuthzCheckRequest builds a CheckRequest for an individual item.
type ItemFilter ¶ added in v0.16.0
ItemFilter is a predicate that returns true if the item should be included.
type ListOptions ¶ added in v0.16.0
type ListOptions struct {
// Limit is the maximum number of items to return per page.
Limit int
// Cursor is an opaque pagination cursor from a previous response.
Cursor string
// LabelSelector is an optional label selector string to filter resources server-side
// (e.g., "app=frontend,tier=backend").
LabelSelector string
}
ListOptions controls pagination and filtering for list operations.
type ListResource ¶ added in v0.16.0
type ListResource[T any] func(ctx context.Context, opts ListOptions) (*ListResult[T], error)
ListResource fetches a single page of items from the underlying data source.
func PreFilteredList ¶ added in v0.16.0
func PreFilteredList[T any]( listResource ListResource[T], filters ...ItemFilter[T], ) ListResource[T]
PreFilteredList wraps a ListResource with in-memory predicate filters. It returns a new ListResource that over-fetches and filters items while maintaining correct pagination using an internal cursor. This can be composed with FilteredList for layered filtering (e.g., project filter + authz filter). When no filters are provided, the original listResource is returned unchanged.
type ListResult ¶ added in v0.16.0
type ListResult[T any] struct { // Items is the list of resources in this page. Items []T // NextCursor is an opaque cursor for fetching the next page. // Empty when there are no more items. NextCursor string // RemainingCount is an approximate count of items remaining after this page. // Nil when the count is unknown (e.g. authz-filtered queries). RemainingCount *int64 }
ListResult holds a page of items along with pagination metadata.
func FilteredList ¶ added in v0.16.0
func FilteredList[T any]( ctx context.Context, opts ListOptions, authzChecker *AuthzChecker, listResource ListResource[T], generateAuthzCheckRequest GenerateAuthzCheckRequest[T], ) (*ListResult[T], error)
FilteredList implements the generic authz-filtered over-fetch loop. It fetches pages from the data source, filters items through the authz checker, and accumulates results until the requested limit is reached or all items are exhausted.
type ValidationError ¶ added in v0.17.0
ValidationError represents a request validation failure. StatusCode carries the originating HTTP status when the error came from kube-apiserver (typically 422 for a webhook or CRD CEL denial). It is unset for openchoreo-api's own pre-kube input checks, which the handler maps to HTTP 400.
func ExtractValidationError ¶ added in v1.1.0
func ExtractValidationError(err error) *ValidationError
ExtractValidationError wraps a Kubernetes Invalid StatusError as a *ValidationError, carrying through the originating HTTP status (typically 422). Returns nil for any error that is not a Kubernetes Invalid status, including nil input.
func (*ValidationError) Error ¶ added in v0.17.0
func (e *ValidationError) Error() string