security

type Action string

type ArnKind string

type Authorizer interface {
	// Prepare accepts input infos and build EvalArgs.
	// when you implement this method, you must know the meaning of the arnParts and convert to correct Action.
	// In Web authz, the parts format is [appCode, Request.Method, Request.URL.Path] by default;
	// In Graphql, the parts format is [appCode, Request.Method, Operator.Name] by default;
	Prepare(ctx context.Context, kind ArnKind, parts ...string) (*EvalArgs, error)
	// Eval returns true if the request is allowed, otherwise returns false.
	Eval(ctx context.Context, args *EvalArgs) (bool, error)
	// QueryAllowedResourceConditions parse the conditions part of resources eval passed by resource prefix,
	// the result is a list of resource conditions that adapt Authorizer instance.
	// This method call sense: Orm need to filter the data that the user has permission to access.
	// For example, the resource arn "oss:bucket:user/1" means that the user has permission to access the `user` table data
	// whose condition is "user = 1",the result of this method is ["user = 1"].
	// You should implement complex condition by your sense if you when to filter data.
	QueryAllowedResourceConditions(ctx context.Context, args *EvalArgs) ([]string, error)
}

type EvalArgs struct {
	// User is the user who performs the operation. If you can't get the user from the context, you can set it.
	User Principal
	// Action is the operation that the user performs on the resource.
	Action Action
	// ActionVerb is the operation verb that may be in part of action.
	//
	// For example, the action is "user:createUser", the verb is "create". The verb is empty in most cases.
	// If the Authorizer implement user a verb in policy such as casbin, a policy ['p','/user','read']
	ActionVerb string
	// Resource is the resource that the user performs the operation on, empty in most cases.
	Resource Resource
}

type GenericIdentity struct {
	// contains filtered or unexported fields
}

type GenericPrincipal struct {
	GenericIdentity *GenericIdentity
}

type Identity interface {
	// Name returns the identity of the user from Claims.
	// for example, the primary key of the user record in database.
	// The identity field in business system may int or string, translate it to string.
	Name() string
	// Claims uses jwt Claims for easy to get user info and declare use jwt to pass identity info.
	Claims() jwt.Claims
}

type Principal interface {
	Identity() Identity
}

type Resource string