decision

package

v0.2.0 Latest Latest Go to latest Published: Jul 14, 2026 License: MIT Imports: 9 Imported by: 0

Details

Package decision owns the single BrokerKit decision path used by every transport.

This section is empty.

This section is empty.

This section is empty.

type ActivationValidator interface {
	ValidateActivation(context.Context, grants.Grant, grants.ApprovalConstraints) error
}

ActivationValidator is the provider-owned fail-closed approval check.

type ActivationValidatorFunc func(context.Context, grants.Grant, grants.ApprovalConstraints) error

ActivationValidatorFunc adapts a function to ActivationValidator.

func (f ActivationValidatorFunc) ValidateActivation(ctx context.Context, grant grants.Grant, constraints grants.ApprovalConstraints) error

type Options struct {
	Store     *grants.Store
	Validator ActivationValidator
	Broker    string
	Audit     audit.Recorder
}

Options assembles the transport-independent decision path.

type Result struct {
	grants.OperatorDecisionResult
	AuditExportFailed bool
}

Result is a committed revision-bound decision and its export diagnostic.

type Service struct {
	// contains filtered or unexported fields
}

Service is the only first-party entry point for operator decisions.

func New(options Options) (*Service, error)

func (s *Service) ApproveToken(ctx context.Context, id, token, actor string, ref notify.MessageRef) (grants.Grant, error)

ApproveToken applies a single-use notification-channel approval through the same validator.

func (s *Service) Decide(ctx context.Context, id string, action operatorv1.Action, actor string, command operatorv1.Decision) (Result, error)

Decide applies one revision-bound Operator V1 decision.

func (s *Service) DenyToken(ctx context.Context, id, token, actor string, ref notify.MessageRef) (grants.Grant, error)

DenyToken applies a single-use notification-channel denial.