authzguardsql

type DefaultResourceBuilder ¶

type DefaultResourceBuilder struct {
	// OrgID is the organization the schema's data belongs to.
	OrgID *uuid.UUID
}

DefaultResourceBuilder maps every entity and every field to its own concrete resource: type ResourceTypeEntity or ResourceTypeField, with a deterministic ID derived from the organization, entity and field names (see EntityResourceID and FieldResourceID), and the organization as the resource's OrgID. The names are also kept in the "entity" and "field" attributes for logging, but no provider evaluates attributes.

Policy follows from the provider:

• SpiceDB checks the concrete object, so each field has its own relationships; write them for guardsql_field:<FieldResourceID>.
• rbac checks role permissions keyed by type ("guardsql_field.read"), so such a permission grants every field of every entity. For column-level policy with rbac, use a ResourceBuilder whose resource types name the entity and field.

Set OrgID: without it, rbac answers only for the resource owner, and IDs are shared by every organization.

func (b DefaultResourceBuilder) EntityResource(entity string) authz.Resource

func (b DefaultResourceBuilder) EntityResourceID(entity string) uuid.UUID

func (b DefaultResourceBuilder) FieldResource(entity, field string) authz.Resource

func (b DefaultResourceBuilder) FieldResourceID(entity, field string) uuid.UUID

type PolicyBuilder ¶

type PolicyBuilder struct {
	Authorizer      authz.Authorizer
	Principal       authz.Principal
	Schema          guardsql.Schema
	ResourceBuilder ResourceBuilder
	RequireLimit    bool
	MaxLimit        int
	MaxDepth        int
	MaxNodes        int
	MaxInValues     int
	AllowStar       bool
}

PolicyBuilder checks SystemForge authorization for schema entities/fields and compiles the result into a GuardSQL policy.

func (b PolicyBuilder) Build(ctx context.Context) (guardsql.Policy, error)

type ResourceBuilder ¶

type ResourceBuilder interface {
	EntityResource(entity string) authz.Resource
	FieldResource(entity, field string) authz.Resource
}

ResourceBuilder maps GuardSQL entities and fields to SystemForge resources. Applications can use these names directly in SpiceDB schemas or adapt them to product-specific resource types.

type ResourceBuilderFunc ¶

type ResourceBuilderFunc struct {
	Entity func(entity string) authz.Resource
	Field  func(entity, field string) authz.Resource
}

ResourceBuilderFunc adapts functions into a ResourceBuilder.

func (f ResourceBuilderFunc) EntityResource(entity string) authz.Resource

func (f ResourceBuilderFunc) FieldResource(entity, field string) authz.Resource