services

package
v1.1.3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 22, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var ErrForbidden = errors.New("insufficient permissions to perform this action")

Functions

func BuildListOptions added in v1.0.0

func BuildListOptions(opts ListOptions) ([]client.ListOption, error)

BuildListOptions converts ListOptions into controller-runtime client.ListOption slice containing pagination (limit, cursor) and label selector options. Callers should prepend namespace-scoping or other options as needed.

func ExtractValidationMessage added in v0.17.0

func ExtractValidationMessage(err error) string

ExtractValidationMessage extracts cause messages from a K8s StatusError, falling back to a generic message to avoid leaking internal details.

func FormatDualScopedResourceName added in v1.1.0

func FormatDualScopedResourceName(namespace, name string, isClusterScoped bool) string

FormatDualScopedResourceName returns the authz-engine identifier for a dual-scoped resource. Namespace-scoped resources use "{namespace}/{name}"; cluster-scoped resources use plain "{name}".

Types

type AuthzChecker added in v0.16.0

type AuthzChecker struct {
	// contains filtered or unexported fields
}

AuthzChecker provides authorization checking for service authz wrappers.

func NewAuthzChecker added in v0.16.0

func NewAuthzChecker(pdp authz.PDP, logger *slog.Logger) *AuthzChecker

NewAuthzChecker creates a new AuthzChecker.

func (*AuthzChecker) BatchCheck added in v0.16.0

func (c *AuthzChecker) BatchCheck(ctx context.Context, requests []CheckRequest) ([]bool, error)

BatchCheck performs a batch authorization check and returns a boolean slice

func (*AuthzChecker) Check added in v0.16.0

func (c *AuthzChecker) Check(ctx context.Context, req CheckRequest) error

Check performs a single authorization check.

type CheckRequest added in v0.16.0

type CheckRequest struct {
	Action       string
	ResourceType string
	ResourceID   string
	Hierarchy    authz.ResourceHierarchy
	Context      authz.Context
}

CheckRequest represents a resource authorization check.

type GenerateAuthzCheckRequest added in v0.16.0

type GenerateAuthzCheckRequest[T any] func(item T) CheckRequest

GenerateAuthzCheckRequest builds a CheckRequest for an individual item.

type ItemFilter added in v0.16.0

type ItemFilter[T any] func(item T) bool

ItemFilter is a predicate that returns true if the item should be included.

type ListOptions added in v0.16.0

type ListOptions struct {
	// Limit is the maximum number of items to return per page.
	Limit int
	// Cursor is an opaque pagination cursor from a previous response.
	Cursor string
	// LabelSelector is an optional label selector string to filter resources server-side
	// (e.g., "app=frontend,tier=backend").
	LabelSelector string
}

ListOptions controls pagination and filtering for list operations.

type ListResource added in v0.16.0

type ListResource[T any] func(ctx context.Context, opts ListOptions) (*ListResult[T], error)

ListResource fetches a single page of items from the underlying data source.

func PreFilteredList added in v0.16.0

func PreFilteredList[T any](
	listResource ListResource[T],
	filters ...ItemFilter[T],
) ListResource[T]

PreFilteredList wraps a ListResource with in-memory predicate filters. It returns a new ListResource that over-fetches and filters items while maintaining correct pagination using an internal cursor. This can be composed with FilteredList for layered filtering (e.g., project filter + authz filter). When no filters are provided, the original listResource is returned unchanged.

type ListResult added in v0.16.0

type ListResult[T any] struct {
	// Items is the list of resources in this page.
	Items []T
	// NextCursor is an opaque cursor for fetching the next page.
	// Empty when there are no more items.
	NextCursor string
	// RemainingCount is an approximate count of items remaining after this page.
	// Nil when the count is unknown (e.g. authz-filtered queries).
	RemainingCount *int64
}

ListResult holds a page of items along with pagination metadata.

func FilteredList added in v0.16.0

func FilteredList[T any](
	ctx context.Context,
	opts ListOptions,
	authzChecker *AuthzChecker,
	listResource ListResource[T],
	generateAuthzCheckRequest GenerateAuthzCheckRequest[T],
) (*ListResult[T], error)

FilteredList implements the generic authz-filtered over-fetch loop. It fetches pages from the data source, filters items through the authz checker, and accumulates results until the requested limit is reached or all items are exhausted.

type ValidationError added in v0.17.0

type ValidationError struct {
	Msg        string
	StatusCode int
}

ValidationError represents a request validation failure. StatusCode carries the originating HTTP status when the error came from kube-apiserver (typically 422 for a webhook or CRD CEL denial). It is unset for openchoreo-api's own pre-kube input checks, which the handler maps to HTTP 400.

func ExtractValidationError added in v1.1.0

func ExtractValidationError(err error) *ValidationError

ExtractValidationError wraps a Kubernetes Invalid StatusError as a *ValidationError, carrying through the originating HTTP status (typically 422). Returns nil for any error that is not a Kubernetes Invalid status, including nil input.

func (*ValidationError) Error added in v0.17.0

func (e *ValidationError) Error() string

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL