requestguard

type EvalContext struct {
	// Orgs the caller belongs to.
	UserOrgIds []model.Id
	// The org unit the caller belongs to, if any.
	OrgUnitId *model.Id
	// The org that OrgUnitId belongs to. Needed for the orgunit -> org fallback.
	OrgUnitOrgId *model.Id
}

type ExtGetUserEntitlementsQuery struct {
	UserId    *model.Id `json:"user_id"`
	UserEmail *string   `json:"user_email"`
}

type ExtGetUserEntitlementsResult = dyn.OpResult[ExtGetUserEntitlementsResultData]

type ExtGetUserEntitlementsResultData struct {
	IsOwner      bool                 `json:"is_owner"`
	Entitlements []string             `json:"entitlements"`
	OrgUnitId    *model.Id            `json:"org_unit_id"`
	OrgUnitOrgId *model.Id            `json:"org_unit_org_id"`
	UserId       model.Id             `json:"user_id"`
	UserOrgIds   []model.Id           `json:"user_org_ids"`
	User         dmodel.DynamicFields `json:"user"`
}

type GetUserEntitlementsQuery = ExtGetUserEntitlementsQuery

type GetUserEntitlementsResult = dyn.OpResult[GetUserEntitlementsResultData]

type GetUserEntitlementsResultData = ExtGetUserEntitlementsResultData

type ParsedExpression struct {
	ActionCode   string
	ResourceCode string
	Scope        ResourceScope
	ScopeId      *model.Id
}

type Perm struct {
	ResourceCode string
	ActionCode   string
	Scope        ResourceScope
	// This is Org Unit ID to which the resource belongs (if any).
	// If this is not nil, then OrgId must be this Org Unit's Org ID.
	OrgUnitId *model.Id

	// This is the Org ID to which the resource belongs (if any)
	// Or, this can be the Org Unit's Org ID (if the resource belongs to an org unit)
	OrgId *model.Id

	// IsRecordOwnedByCaller answers the private scope: the caller may act on their
	// own record. Callers whose scope is private must set it; leaving it false
	// simply means "not the caller's record", which denies.
	IsRecordOwnedByCaller bool
}

type PermissionContext struct {
	IsOwner      bool
	Entitlements []string
}

type RequestGuardService interface {
	// Calculate a fingerprint for the request that can be used to identify the request.
	// This can be used for caching or to prevent replay attacks.
	CalcRequestFingerprint(ctx corectx.Context, request *http.Request) (fingerprint string, err error)
	GetCorsMiddleware(ctx corectx.Context) (echo.MiddlewareFunc, error)
	GetUserEntitlements(ctx corectx.Context, query GetUserEntitlementsQuery) (*GetUserEntitlementsResult, error)
	VerifyJwt(ctx corectx.Context, request *http.Request) (result *VerifyRequestResult, err error)
}

type ResourceScope string

type StaticRequestGuardServiceImpl struct {
	// contains filtered or unexported fields
}

type StaticRequestGuardServiceParams struct {
	dig.In

	ConfigSvc config.ConfigService
	CqrsBus   cqrs.CqrsBus
	TokenSvc  coretoken.AuthTokenService
}

type VerifyRequestResult struct {
	IsOk        bool
	JwtClaims   jwt.Claims
	ClientError *ft.ClientErrorItem
}