tenancy

type Grant ¶

type Grant struct {
	Permission string
	Operator   bool
}

Grant is a permission question: which token, and whether that token is one only the operator's own tenant may exercise.

It is a struct rather than a string because "may this caller do X" and "is this a tenant entitled to X at all" are two questions and the second is asked first. It lives beside Tenant because both halves of the answer are here.

type Principal ¶

type Principal struct {
	// UserID identifies the person or machine account.
	UserID uuid.UUID
	// Roles are the roles the credential carries, for an authorizer that wants
	// them without a second lookup.
	Roles []string
}

Principal is who is making a request, established once per request by the HTTP layer's identity hook and never derived again.

It lives here, beside Tenant and the actor, because the three are one thing. It used to live in kit/httpx, and the cost was a module's contracts/ package naming the HTTP kernel to describe its own caller — which linked huma and chi into the build graph of anything that only wanted to name a Session.

There is no tenant on it: the hook runs inside the resolved tenant's own transaction, so a credential belonging to another is a row row-level security does not show, and the principal that would have had to be refused is never built.

func PrincipalFrom(ctx context.Context) (Principal, bool)

type SystemToken ¶

type SystemToken = syscap.SystemToken

SystemToken is a capability that lets kernel runners open cross-tenant work. It is an interface whose only implementation and only constructor live in kit/internal/syscap, so packages outside kit/ can name a token but can neither mint nor implement one: the compiler enforces that modules never bypass tenancy.

Resolving a host to a tenant is a query, so it needs a transaction; the interface for it is httpx.TenantLoader, declared where both kit/db and this package are already imported.

type Tenant ¶

type Tenant struct {
	ID   uuid.UUID
	Slug string
	Name string
	// Operator says this tenant is the installation's own, the one whose
	// administrators may reach the control plane. A customer's administrator
	// holds "may do everything in my tenant", which must not become the power
	// to list, create and suspend the tenants beside them. The column is
	// written by the bootstrap and by nothing else; see Grant and docs/adr/0006.
	Operator bool
}

Tenant is one customer of the platform.

func FromContext(ctx context.Context) (Tenant, bool)