rbac

type DefaultManager struct {
	// contains filtered or unexported fields
}

type Effect string

type Manager interface {
	// Role management
	CreateRole(ctx context.Context, role *Role) error
	GetRole(ctx context.Context, roleID string) (*Role, error)
	UpdateRole(ctx context.Context, role *Role) error
	DeleteRole(ctx context.Context, roleID string) error
	ListRoles(ctx context.Context, tenantID string) ([]*Role, error)

	// User-Role assignment
	AssignRole(ctx context.Context, userID, roleID, tenantID string) error
	RevokeRole(ctx context.Context, userID, roleID, tenantID string) error
	GetUserRoles(ctx context.Context, userID, tenantID string) ([]*Role, error)
	HasRole(ctx context.Context, userID, roleID, tenantID string) bool

	// Permission checking
	HasPermission(ctx context.Context, userID, resource, action, tenantID string) bool
	GetUserPermissions(ctx context.Context, userID, tenantID string) ([]Permission, error)

	// Policy management
	CreatePolicy(ctx context.Context, policy *Policy) error
	GetPolicy(ctx context.Context, policyID string) (*Policy, error)
	UpdatePolicy(ctx context.Context, policy *Policy) error
	DeletePolicy(ctx context.Context, policyID string) error
	EvaluatePolicy(ctx context.Context, userID, resource, action, tenantID string) Effect
}

type Permission struct {
	ID          string `json:"id" datastore:"id"`
	Name        string `json:"name" datastore:"name"`
	Resource    string `json:"resource" datastore:"resource"`
	Action      string `json:"action" datastore:"action"`
	Description string `json:"description" datastore:"description,noindex"`
}

type Policy struct {
	ID          string                 `json:"id" datastore:"id"`
	Name        string                 `json:"name" datastore:"name"`
	Description string                 `json:"description" datastore:"description,noindex"`
	Rules       []PolicyRule           `json:"rules" datastore:"rules"`
	TenantID    string                 `json:"tenant_id" datastore:"tenant_id"`
	Priority    int                    `json:"priority" datastore:"priority"`
	Enabled     bool                   `json:"enabled" datastore:"enabled"`
	Conditions  map[string]interface{} `json:"conditions" datastore:"conditions,noindex"`
}

type PolicyRule struct {
	Resource   string   `json:"resource"`
	Actions    []string `json:"actions"`
	Effect     Effect   `json:"effect"`
	Principals []string `json:"principals"` // User IDs or role IDs
}

type Role struct {
	ID          string       `json:"id" datastore:"id"`
	Name        string       `json:"name" datastore:"name"`
	Description string       `json:"description" datastore:"description,noindex"`
	Permissions []Permission `json:"permissions" datastore:"permissions"`
	IsSystem    bool         `json:"is_system" datastore:"is_system"`
	TenantID    string       `json:"tenant_id" datastore:"tenant_id"`
	CreatedAt   time.Time    `json:"created_at" datastore:"created_at"`
	UpdatedAt   time.Time    `json:"updated_at" datastore:"updated_at"`
}

type UserRole struct {
	UserID    string     `json:"user_id" datastore:"user_id"`
	RoleID    string     `json:"role_id" datastore:"role_id"`
	TenantID  string     `json:"tenant_id" datastore:"tenant_id"`
	GrantedBy string     `json:"granted_by" datastore:"granted_by"`
	GrantedAt time.Time  `json:"granted_at" datastore:"granted_at"`
	ExpiresAt *time.Time `json:"expires_at,omitempty" datastore:"expires_at"`
}