Documentation
¶
Overview ¶
Package authorization coordinates policy decisions and durable approval requests.
Index ¶
Constants ¶
This section is empty.
Variables ¶
Functions ¶
This section is empty.
Types ¶
type ActiveGrantsFunc ¶
ActiveGrantsFunc projects durable grants relevant to request into policy grants.
type Coordinator ¶
type Coordinator struct {
// contains filtered or unexported fields
}
Coordinator owns the provider-neutral authorize-or-request transition.
func New ¶
func New(options Options) (*Coordinator, error)
New constructs a coordinator over a validated provider registry.
func (*Coordinator) Authorize ¶
func (c *Coordinator) Authorize(request policy.Request, build IntentBuilder) (Result, error)
Authorize allows, refuses, or durably creates an approval request.
func (*Coordinator) RequestApproval ¶
func (c *Coordinator) RequestApproval(request policy.Request, build IntentBuilder) (Result, error)
RequestApproval explicitly requests a bounded approval even when an existing grant could currently authorize the same capability.
type DecideFunc ¶
DecideFunc evaluates one provider-classified request.
type GrantIntent ¶
type GrantIntent struct {
Mode policy.GrantMode
Authorization policy.Request
Request grants.Request
Plan grants.ImmutablePlan
}
GrantIntent is a provider-built canonical approval request and immutable plan.
type IntentBuilder ¶
type IntentBuilder func(policy.Decision) (GrantIntent, error)
IntentBuilder resolves provider defaults and builds an immutable request after the coordinator has selected the request rule and its bounds.
type Options ¶
type Options struct {
Registry policy.Registry
Decide DecideFunc
Grants *grants.Store
// ActiveGrants projects durable provider grants into policy grants. It
// defaults to Grants.ActivePolicyGrants when provider-native storage already
// uses the policy target schema.
ActiveGrants ActiveGrantsFunc
Now func() time.Time
}
Options configures a Coordinator.
Source Files