Documentation
¶
Overview ¶
Package seeds loads a module's declarative catalog seeds (permissions, roles, resource types, relationship types) from embedded YAML and syncs them idempotently into the global catalogs at boot. Seeds touch ONLY global catalogs — never tenant data (blueprint 06 §2 lifecycle SeedSync). Because the catalogs back authorization, they are written with platform privilege (app_platform / owner), never as app_rt (SEC-13/D-0026).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Sync ¶
Sync upserts the bundle's catalog rows idempotently. It must run on a platform-privileged connection (the global catalogs are not app_rt-writable). Running twice is a no-op diff (ON CONFLICT DO UPDATE); tenant data is never touched.
invalidators, if any, are invoked AFTER every write succeeds so an in-process authz cache does not serve stale role/permission grants past the sync (CA-2). Pass the kernel's live cache (Kernel.AuthzCache) when it is non-nil; pass nothing when caching is off — the default — and Sync behaves exactly as before.
Types ¶
type Bundle ¶
type Bundle struct {
Permissions []PermissionSeed `yaml:"permissions"`
Roles []RoleSeed `yaml:"roles"`
ResourceTypes []ResourceTypeSeed `yaml:"resource_types"`
RelationshipTypes []RelationshipTypeSeed `yaml:"relationship_types"`
}
Bundle is the parsed, merged seed catalog for one or more modules.
type PermissionSeed ¶
type PermissionSeed struct {
Key string `yaml:"key"`
Description string `yaml:"description"`
Sensitive bool `yaml:"sensitive"`
// GrantedVia declares the ReBAC rule fed into the authz registry.
GrantedVia string `yaml:"granted_via"`
}
PermissionSeed declares a permission in the catalog.
type RelationshipTypeSeed ¶
type RelationshipTypeSeed struct {
Key string `yaml:"key"`
SubjectKind string `yaml:"subject_kind"`
ObjectKind string `yaml:"object_kind"`
Cardinality string `yaml:"cardinality"`
Description string `yaml:"description"`
}
RelationshipTypeSeed declares a relationship type.
type ResourceTypeSeed ¶
ResourceTypeSeed declares a resource type.
type RoleSeed ¶
type RoleSeed struct {
Key string `yaml:"key"`
Name string `yaml:"name"`
Permissions []string `yaml:"permissions"`
}
RoleSeed declares a platform-template role and the permissions it grants.
type SpineInvalidator ¶
type SpineInvalidator interface{ InvalidateAll() }
SpineInvalidator drops an in-process authorization cache after a seed (authorization-spine) write commits. *authz.CachingStore satisfies it via its InvalidateAll method — declared here as a narrow local interface so this base package stays free of an authz import. A seed sync rewrites GLOBAL platform roles and their role_permissions, which any tenant's actors may hold and which the cache pre-joins into ActiveAssignments, so the WHOLE cache is dropped (not one tenant) — see CachingStore.InvalidateAll.
Source Files