Help us shape the future of Go! Take the 2026 Go Developer Survey

spicedb

package
v0.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 6, 2026 License: MIT Imports: 15 Imported by: 0

Documentation

Overview

Package spicedb provides SpiceDB-based authorization for SystemForge.

Index

Constants

View Source
const (
	// TypePrincipal represents a principal (user, service, agent).
	TypePrincipal = "principal"

	// TypeOrganization represents an organization.
	TypeOrganization = "organization"

	// TypeUser represents a user.
	TypeUser = "user"
)

Common resource type constants.

View Source
const (
	// PermView allows viewing a resource.
	PermView = "view"

	// PermEdit allows editing a resource.
	PermEdit = "edit"

	// PermManage allows managing a resource (admin operations).
	PermManage = "manage"

	// PermDelete allows deleting a resource.
	PermDelete = "delete"

	// PermCreate allows creating resources.
	PermCreate = "create"
)

Common permission constants.

View Source
const (
	// RelOwner represents the owner relation.
	RelOwner = "owner"

	// RelAdmin represents the admin relation.
	RelAdmin = "admin"

	// RelMember represents the member relation.
	RelMember = "member"

	// RelViewer represents the viewer relation.
	RelViewer = "viewer"

	// RelEditor represents the editor relation.
	RelEditor = "editor"
)

Common relation constants.

View Source
const BaseSchema = `` /* 661-byte string literal not displayed */

BaseSchema provides a minimal SpiceDB schema for SystemForge applications. Applications can extend this with their own resource types.

Variables

This section is empty.

Functions

func ResourceSchema

func ResourceSchema(resourceType string) string

ResourceSchema returns a SpiceDB schema definition for a custom resource type. This can be used to define app-specific resources that integrate with organizations.

Types

type CheckRequest

type CheckRequest struct {
	// ResourceType is the type of the resource (e.g., "organization", "project")
	ResourceType string
	// ResourceID is the ID of the resource
	ResourceID string
	// Permission is the permission to check (e.g., "view", "edit", "manage")
	Permission string
	// SubjectType is the type of the subject (e.g., "principal", "user")
	SubjectType string
	// SubjectID is the ID of the subject
	SubjectID string
}

CheckRequest represents a permission check request.

type Client

type Client struct {
	// contains filtered or unexported fields
}

Client provides authorization operations backed by SpiceDB.

func NewClient

func NewClient(ctx context.Context, cfg Config, logger *slog.Logger) (*Client, error)

NewClient creates a new SpiceDB client based on configuration.

func (*Client) Check

func (c *Client) Check(ctx context.Context, req *CheckRequest) (bool, error)

Check checks if a subject has a permission on a resource.

func (*Client) Close

func (c *Client) Close() error

Close closes the client connection.

func (*Client) DeleteRelationship

func (c *Client) DeleteRelationship(ctx context.Context, rel *Relationship) error

DeleteRelationship deletes a relationship tuple.

func (*Client) IsEmbedded

func (c *Client) IsEmbedded() bool

IsEmbedded returns true if this client is using an embedded SpiceDB instance.

func (*Client) LookupResources

func (c *Client) LookupResources(ctx context.Context, req *LookupResourcesRequest) ([]string, error)

LookupResources finds all resources a subject has permission on.

func (*Client) LookupSubjects

func (c *Client) LookupSubjects(ctx context.Context, req *LookupSubjectsRequest) ([]string, error)

LookupSubjects finds all subjects with a given permission on a resource.

func (*Client) ReadSchema

func (c *Client) ReadSchema(ctx context.Context) (string, error)

ReadSchema reads the current authorization schema.

func (*Client) WriteRelationship

func (c *Client) WriteRelationship(ctx context.Context, rel *Relationship) error

WriteRelationship writes a relationship tuple.

func (*Client) WriteRelationships

func (c *Client) WriteRelationships(ctx context.Context, rels []*Relationship) error

WriteRelationships writes multiple relationship tuples atomically.

func (*Client) WriteSchema

func (c *Client) WriteSchema(ctx context.Context, schema string) error

WriteSchema writes the authorization schema.

type Config

type Config struct {
	// Mode: "embedded" or "remote"
	Mode string `json:"mode" yaml:"mode"`

	// Embedded mode settings
	// DatastoreEngine: "memory" or "postgres"
	DatastoreEngine string `json:"datastore_engine,omitempty" yaml:"datastore_engine,omitempty"`
	// DatastoreURI: connection string for postgres
	DatastoreURI string `json:"datastore_uri,omitempty" yaml:"datastore_uri,omitempty"`

	// Remote mode settings
	// Endpoint: SpiceDB gRPC endpoint (e.g., "localhost:50051")
	Endpoint string `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`
	// Token: preshared key for authentication
	Token string `json:"token,omitempty" yaml:"token,omitempty"`
	// Insecure: skip TLS verification
	Insecure bool `json:"insecure,omitempty" yaml:"insecure,omitempty"`
}

Config holds SpiceDB client configuration.

func DefaultConfig

func DefaultConfig() Config

DefaultConfig returns a default configuration for embedded mode.

type LookupResourcesRequest

type LookupResourcesRequest struct {
	// ResourceType is the type of resources to look up
	ResourceType string
	// Permission is the permission to check
	Permission string
	// SubjectType is the type of the subject
	SubjectType string
	// SubjectID is the ID of the subject
	SubjectID string
}

LookupResourcesRequest represents a request to find resources a subject can access.

type LookupSubjectsRequest

type LookupSubjectsRequest struct {
	// ResourceType is the type of the resource
	ResourceType string
	// ResourceID is the ID of the resource
	ResourceID string
	// Permission is the permission to check
	Permission string
	// SubjectType is the type of subjects to look up
	SubjectType string
}

LookupSubjectsRequest represents a request to find subjects with a permission.

type Provider

type Provider struct {
	// contains filtered or unexported fields
}

Provider implements the authz.Authorizer interface using SpiceDB.

func NewProvider

func NewProvider(client *Client) *Provider

NewProvider creates a new SpiceDB authorization provider.

func (*Provider) AddOrgMember

func (p *Provider) AddOrgMember(ctx context.Context, principalID string, orgID uuid.UUID, role string) error

AddOrgMember adds a principal as a member of an organization with a specific role.

func (*Provider) AddRelationship

func (p *Provider) AddRelationship(ctx context.Context, subjectType, subjectID, relation, resourceType, resourceID string) error

AddRelationship adds a relationship between a subject and a resource.

func (*Provider) Can

func (p *Provider) Can(ctx context.Context, principal authz.Principal, action authz.Action, resource authz.Resource) (bool, error)

Can checks if a principal can perform an action on a resource.

func (*Provider) CanAll

func (p *Provider) CanAll(ctx context.Context, principal authz.Principal, actions []authz.Action, resource authz.Resource) (bool, error)

CanAll checks if a principal can perform all specified actions on a resource.

func (*Provider) CanAny

func (p *Provider) CanAny(ctx context.Context, principal authz.Principal, actions []authz.Action, resource authz.Resource) (bool, error)

CanAny checks if a principal can perform any of the specified actions on a resource.

func (*Provider) CanForOrg

func (p *Provider) CanForOrg(ctx context.Context, principal authz.Principal, orgID uuid.UUID, action authz.Action, resource authz.Resource) (bool, error)

CanForOrg checks permission scoped to a specific organization.

func (*Provider) Client

func (p *Provider) Client() *Client

Client returns the underlying SpiceDB client for advanced operations.

func (*Provider) Close

func (p *Provider) Close() error

Close closes the provider and underlying client.

func (*Provider) Filter

func (p *Provider) Filter(ctx context.Context, principal authz.Principal, action authz.Action, resources []authz.Resource) ([]authz.Resource, error)

Filter returns only the resources the principal can access with the given action.

func (*Provider) GetRole

func (p *Provider) GetRole(ctx context.Context, principal authz.Principal, orgID uuid.UUID) (string, error)

GetRole returns the principal's role in an organization.

func (*Provider) IsMember

func (p *Provider) IsMember(ctx context.Context, principal authz.Principal, orgID uuid.UUID) (bool, error)

IsMember checks if a principal is a member of an organization.

func (*Provider) IsPlatformAdmin

func (p *Provider) IsPlatformAdmin(ctx context.Context, principal authz.Principal) (bool, error)

IsPlatformAdmin checks if a principal has platform-wide admin access.

func (*Provider) RemoveOrgMember

func (p *Provider) RemoveOrgMember(ctx context.Context, principalID string, orgID uuid.UUID, role string) error

RemoveOrgMember removes a principal from an organization.

func (*Provider) RemoveRelationship

func (p *Provider) RemoveRelationship(ctx context.Context, subjectType, subjectID, relation, resourceType, resourceID string) error

RemoveRelationship removes a relationship between a subject and a resource.

type Relationship

type Relationship struct {
	// ResourceType is the type of the resource
	ResourceType string
	// ResourceID is the ID of the resource
	ResourceID string
	// Relation is the relationship type (e.g., "owner", "member", "admin")
	Relation string
	// SubjectType is the type of the subject
	SubjectType string
	// SubjectID is the ID of the subject
	SubjectID string
}

Relationship represents a relationship tuple.

type Syncer

type Syncer struct {
	// contains filtered or unexported fields
}

Syncer implements RelationshipSyncer using SpiceDB as the authorization backend.

func NewSyncer

func NewSyncer(client *Client) *Syncer

NewSyncer creates a new SpiceDB-backed relationship syncer.

func (*Syncer) AddOrgMembership

func (s *Syncer) AddOrgMembership(ctx context.Context, principalID, orgID uuid.UUID, role string) error

AddOrgMembership adds a principal's membership in an organization.

func (*Syncer) RegisterOrganization

func (s *Syncer) RegisterOrganization(ctx context.Context, orgID, ownerID uuid.UUID) error

RegisterOrganization creates an organization with an initial owner.

func (*Syncer) RegisterPrincipal

func (s *Syncer) RegisterPrincipal(_ context.Context, _ uuid.UUID) error

RegisterPrincipal creates a principal entity in SpiceDB. SpiceDB doesn't require explicit entity creation - entities are created implicitly when relationships are added. This is a no-op but kept for interface compliance.

func (*Syncer) RemoveOrgMembership

func (s *Syncer) RemoveOrgMembership(ctx context.Context, principalID, orgID uuid.UUID, role string) error

RemoveOrgMembership removes a principal's membership from an organization.

func (*Syncer) SetPlatformAdmin

func (s *Syncer) SetPlatformAdmin(ctx context.Context, principalID uuid.UUID, isAdmin bool) error

SetPlatformAdmin grants or revokes platform admin privileges.

func (*Syncer) UnregisterOrganization

func (s *Syncer) UnregisterOrganization(ctx context.Context, orgID uuid.UUID) error

UnregisterOrganization removes an organization and all its membership relationships.

func (*Syncer) UnregisterPrincipal

func (s *Syncer) UnregisterPrincipal(ctx context.Context, principalID uuid.UUID) error

UnregisterPrincipal removes all relationships involving a principal.

func (*Syncer) UpdateOrgMembership

func (s *Syncer) UpdateOrgMembership(ctx context.Context, principalID, orgID uuid.UUID, oldRole, newRole string) error

UpdateOrgMembership changes a principal's role in an organization. This is implemented as an atomic batch operation: remove old role, add new role.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL