authz

package

Go to main page

Versions in this module

v0

v0.14.0

Oct 11, 2026

Changes in this version

+ const ManagerRoleEducator

+ const ManagerRoleGuardian

+ const ResourceRoleContributor

+ const ResourceRoleMaintainer

+ const ResourceRoleViewer

+ var ErrGrantNotFound = errors.New("authz: resource grant not found")

+ var ErrInvalidResource = errors.New("authz: invalid resource")

+ var ErrInvalidResourceRole = errors.New("authz: invalid resource role")

+ var ErrResourceOrganizationMismatch = errors.New("authz: resource belongs to another organization")

+ var ManagerRolePermissions = map[string][]Action

+ var OrgRolePermissions = map[string][]Action

+ var ResourceRolePermissions = map[string][]Action

+ func CollaboratorDefinitions(schema string) []string

+ func IsOrgPermission(action Action) bool

+ func IsResourcePermission(action Action) bool

+ func ManagerRoleAllows(role string, action Action) bool

+ func OrgRoleAllows(role string, action Action) bool

+ func ResourceApp(resourceType string) string

+ func ResourceRoleAllows(role string, action Action) bool

+ func ResourceRoleFragment(resourceType string) string

+ func ResourceRoleRank(role string) int

+ func ResourceRoles() []string

+ func ResourceRolesGranting(action Action) []string

+ func ValidAppName(application string) bool

+ func ValidResourceRole(role string) bool

+ func ValidateResourceRef(ref ResourceRef) error

type Action

+ const PermManageAccount

+ const PermManageCredentials

+ const PermManageManagers

+ const PermOrgChangeRole

+ const PermOrgContribute

+ const PermOrgDelete

+ const PermOrgEdit

+ const PermOrgInviteMember

+ const PermOrgList

+ const PermOrgManage

+ const PermOrgRemoveMember

+ const PermOrgSettings

+ const PermOrgView

+ const PermResourceEdit

+ const PermResourceManage

+ const PermResourceView

+ const PermViewProfile

+ type AppRoleSyncer interface

+ AddAppRole func(ctx context.Context, principalID, orgID uuid.UUID, application, role string) error

+ RemoveAppRole func(ctx context.Context, principalID, orgID uuid.UUID, application, role string) error

+ type Engine string

+ const EngineSpiceDB

+ func Engines() []Engine

+ type Grant struct

+ GrantedBy *uuid.UUID

+ PrincipalID uuid.UUID

+ Resource ResourceRef

+ Role string

+ type ManagerRoleGetter func(ctx context.Context, managerID, managedID uuid.UUID) ([]string, error)

+ type Mode string

+ const ModeRBAC

+ const ModeReBAC

+ type ModeConfig struct

+ Engine Engine

+ Mode Mode

+ SpiceDB *SpiceDBConfig

+ func (c *ModeConfig) ApplyDefaults()

+ func (c ModeConfig) Validate() error

+ type Provider interface

type RelationshipSyncer

+ AddPrincipalManager func(ctx context.Context, managedID, managerID uuid.UUID, role string) error

+ RemovePrincipalManager func(ctx context.Context, managedID, managerID uuid.UUID, role string) error

type Resource

+ func NewPrincipalResource(id uuid.UUID) Resource

+ type ResourceGrantReader interface

+ OrganizationRoles func(ctx context.Context, principalID uuid.UUID) (map[uuid.UUID]string, error)

+ ResourceRole func(ctx context.Context, principalID uuid.UUID, resource ResourceRef) (string, error)

+ type ResourceGrantSyncer interface

+ RemoveResourceGrant func(ctx context.Context, principalID uuid.UUID, resource ResourceRef) error

+ SetResourceGrant func(ctx context.Context, principalID uuid.UUID, resource ResourceRef, role string) error

+ type ResourceGranter interface

+ GrantResourceRole func(ctx context.Context, principalID uuid.UUID, resource ResourceRef, role string, ...) error

+ ListResourceGrants func(ctx context.Context, resource ResourceRef) ([]Grant, error)

+ ListResources func(ctx context.Context, principalID uuid.UUID, resourceType string, ...) (ResourceSet, error)

+ RevokeResourceRole func(ctx context.Context, principalID uuid.UUID, resource ResourceRef) error

+ type ResourceRef struct

+ ID string

+ OrganizationID uuid.UUID

+ Type string

+ func ResourceRefOf(r Resource) (ResourceRef, bool)

+ type ResourceSet struct

+ IDs []string

+ OrganizationIDs []uuid.UUID

type ResourceType

+ const ResourceTypePrincipal

+ type SpiceDBConfig struct

+ DatastoreEngine string

+ DatastoreURI string

+ Endpoint string

+ Insecure bool

+ Mode string

+ Token string

+ WriteSchema bool

type VocabularyRegistry

+ func (r *VocabularyRegistry) CollaboratorResourceTypes(app string) []string

+ func (r *VocabularyRegistry) ValidateResourceType(resourceType string) error

v0.13.0

Oct 7, 2026

v0.12.0

Oct 6, 2026

v0.11.0

Oct 3, 2026

v0.10.0

Sep 6, 2026

Changes in this version

+ const BaseSpiceDBSchema

+ var DefaultRoleHierarchy = RoleHierarchy

+ var DefaultRolePermissions = RolePermissions

+ var ErrInvalidResourceID = &middlewareError

+ var ErrMissingResourceID = &middlewareError

+ func ValidateAppSchema(app, schema string) error

+ func ValidateScope(app, scope string) error

+ func ValidateVocabulary(v AppVocabulary) error

+ type Action string

+ const ActionCreate

+ const ActionDelete

+ const ActionList

+ const ActionManage

+ const ActionRead

+ const ActionUpdate

+ type AppVocabulary interface

+ App func() string

+ Hierarchy func() RoleHierarchy

+ Roles func() RolePermissions

+ Scopes func() []string

+ SpiceDBSchema func() string

+ type Authorizer interface

+ Can func(ctx context.Context, principal Principal, action Action, resource Resource) (bool, error)

+ CanAll func(ctx context.Context, principal Principal, actions []Action, resource Resource) (bool, error)

+ CanAny func(ctx context.Context, principal Principal, actions []Action, resource Resource) (bool, error)

+ Filter func(ctx context.Context, principal Principal, action Action, resources []Resource) ([]Resource, error)

+ type Decision struct

+ Allowed bool

+ PolicyID string

+ Reason string

+ type DecisionAuthorizer interface

+ Decide func(ctx context.Context, principal Principal, action Action, resource Resource) (Decision, error)

+ type ErrorResponse struct

+ Error string

+ Message string

+ type FeatureAuthorizer interface

+ CanWithFeature func(ctx context.Context, principal Principal, action Action, resource Resource, ...) (bool, error)

+ type Middleware struct

+ func NewMiddleware(authorizer Authorizer) *Middleware

+ func (m *Middleware) RequireAction(resourceType ResourceType, action Action) func(http.Handler) http.Handler

+ func (m *Middleware) RequireAllActions(resourceType ResourceType, actions ...Action) func(http.Handler) http.Handler

+ func (m *Middleware) RequireAnyAction(resourceType ResourceType, actions ...Action) func(http.Handler) http.Handler

+ func (m *Middleware) RequireResourceAction(extractor ResourceExtractor, action Action) func(http.Handler) http.Handler

+ type OrgAuthorizer interface

+ CanForOrg func(ctx context.Context, principal Principal, orgID uuid.UUID, action Action, ...) (bool, error)

+ GetRole func(ctx context.Context, principal Principal, orgID uuid.UUID) (string, error)

+ IsMember func(ctx context.Context, principal Principal, orgID uuid.UUID) (bool, error)

+ type OrgMiddleware struct

+ func NewOrgMiddleware(authorizer OrgAuthorizer) *OrgMiddleware

+ func (m *OrgMiddleware) RequireMembership() func(http.Handler) http.Handler

+ func (m *OrgMiddleware) RequireRole(role string, hierarchy RoleHierarchy) func(http.Handler) http.Handler

+ type PlatformAuthorizer interface

+ IsPlatformAdmin func(ctx context.Context, principal Principal) (bool, error)

+ type PlatformMiddleware struct

+ func NewPlatformMiddleware(authorizer PlatformAuthorizer) *PlatformMiddleware

+ func (m *PlatformMiddleware) RequirePlatformAdmin() func(http.Handler) http.Handler

+ type Principal struct

+ Attributes map[string]any

+ ID uuid.UUID

+ Type PrincipalType

+ func NewServicePrincipal(serviceID uuid.UUID) Principal

+ func NewUserPrincipal(userID uuid.UUID) Principal

+ func NewUserPrincipalWithAttrs(userID uuid.UUID, attrs map[string]any) Principal

+ func (p Principal) WithAttr(key string, value any) Principal

+ type PrincipalType string

+ const PrincipalTypeAPIKey

+ const PrincipalTypeService

+ const PrincipalTypeSystem

+ const PrincipalTypeUser

+ type RelationshipSyncer interface

+ AddOrgMembership func(ctx context.Context, principalID, orgID uuid.UUID, role string) error

+ RegisterOrganization func(ctx context.Context, orgID, ownerID uuid.UUID) error

+ RegisterPrincipal func(ctx context.Context, principalID uuid.UUID) error

+ RemoveOrgMembership func(ctx context.Context, principalID, orgID uuid.UUID, role string) error

+ SetPlatformAdmin func(ctx context.Context, principalID uuid.UUID, isAdmin bool) error

+ UnregisterOrganization func(ctx context.Context, orgID uuid.UUID) error

+ UnregisterPrincipal func(ctx context.Context, principalID uuid.UUID) error

+ UpdateOrgMembership func(ctx context.Context, principalID, orgID uuid.UUID, oldRole, newRole string) error

+ type Resource struct

+ Attributes map[string]any

+ ID *uuid.UUID

+ OrgID *uuid.UUID

+ OwnerID *uuid.UUID

+ Type ResourceType

+ func NewOrgResource(resourceType ResourceType, orgID uuid.UUID) Resource

+ func NewOwnedResource(resourceType ResourceType, id, ownerID uuid.UUID) Resource

+ func NewResource(resourceType ResourceType) Resource

+ func NewResourceWithID(resourceType ResourceType, id uuid.UUID) Resource

+ func (r Resource) IsOwner(principalID uuid.UUID) bool

+ func (r Resource) WithAttr(key string, value any) Resource

+ func (r Resource) WithOrg(orgID uuid.UUID) Resource

+ func (r Resource) WithOwner(ownerID uuid.UUID) Resource

+ type ResourceExtractor func(r *http.Request) (Resource, error)

+ func WithResourceID(resourceType ResourceType, pathParamName string, ...) ResourceExtractor

+ type ResourceType string

+ const ResourceTypeMember

+ const ResourceTypeOrganization

+ const ResourceTypeUser

+ type RoleHierarchy map[string]int

+ func (h RoleHierarchy) CanAccess(userRole, requiredRole string) bool

+ func (h RoleHierarchy) IsHigherOrEqual(role1, role2 string) bool

+ func (h RoleHierarchy) Level(role string) int

+ type RolePermissions map[string][]string

+ func (rp RolePermissions) GetPermissions(role string) []string

+ func (rp RolePermissions) HasAllPermissions(role string, permissions []string) bool

+ func (rp RolePermissions) HasAnyPermission(role string, permissions []string) bool

+ func (rp RolePermissions) HasPermission(role, permission string) bool

+ type SyncMode string

+ const SyncModeEventual

+ const SyncModeStrict

+ type VocabularyRegistry struct

+ func NewVocabularyRegistry() *VocabularyRegistry

+ func (r *VocabularyRegistry) AllScopes() []string

+ func (r *VocabularyRegistry) Apps() []string

+ func (r *VocabularyRegistry) ComposeSpiceDBSchema() (string, error)

+ func (r *VocabularyRegistry) Get(app string) (AppVocabulary, bool)

+ func (r *VocabularyRegistry) Register(v AppVocabulary) error

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL