gating

type ActorRequirementsWriter interface {
	ReplaceRequirementsAs(context.Context, authz.Resource, string, string, Requirements, string) (RequirementsDocument, error)
}

type Administration struct {
	ACL     *authz.Service
	Store   RequirementsStore
	Writer  RequirementsWriter
	Choices ChoicesProvider
}

type Binding struct {
	Resource authz.Resource       `json:"resource"`
	Action   string               `json:"action"`
	Document RequirementsDocument `json:"document"`
}

type Choice struct {
	ID    string `json:"id"`
	Label string `json:"label,omitempty"`
}

type ChoiceBinding struct {
	Resource authz.Resource `json:"resource"`
	Action   string         `json:"action"`
	Choices  EditorChoices  `json:"choices"`
}

type ChoicesProvider interface {
	ResolveChoices(context.Context, authz.Resource, string) (EditorChoices, error)
}

type Decision struct {
	SchemaVersion        int       `json:"schemaVersion"`
	DecisionID           string    `json:"decisionId"`
	RequestID            string    `json:"requestId"`
	Subject              string    `json:"subject"`
	Issuer               string    `json:"issuer"`
	TenantID             string    `json:"tenantId"`
	AccountID            string    `json:"accountId"`
	ResourceKind         string    `json:"resourceKind"`
	ResourceID           string    `json:"resourceId"`
	ResourceVersion      string    `json:"resourceVersion"`
	Action               string    `json:"action"`
	RequirementsRevision string    `json:"requirementsRevision"`
	EntitySelectionHash  string    `json:"entitySelectionHash"`
	Effect               string    `json:"effect"`
	ReasonCode           string    `json:"reasonCode,omitempty"`
	ValidUntil           time.Time `json:"validUntil"`
	ProviderRevision     string    `json:"providerRevision"`
	RequirementKey       string    `json:"requirementKey,omitempty"`
	ProviderRef          string    `json:"providerRef,omitempty"`
}

type EditorChoices struct {
	Exposures            []Choice            `json:"exposures,omitempty"`
	Roles                []Choice            `json:"roles,omitempty"`
	EntityTypes          []Choice            `json:"entityTypes,omitempty"`
	EntityPermissions    map[string][]Choice `json:"entityPermissions,omitempty"`
	SelectionParameters  []Choice            `json:"selectionParameters,omitempty"`
	EntitlementProviders []Choice            `json:"entitlementProviders,omitempty"`
	EntitlementKeys      map[string][]Choice `json:"entitlementKeys,omitempty"`
}

type EditorContext struct {
	CanManage bool          `json:"canManage"`
	Choices   EditorChoices `json:"choices"`
}

type EntitlementProvider interface {
	CheckEntitlement(context.Context, ProviderRequest) (Decision, error)
}

type EntitlementRequirement struct {
	ProviderRef string `json:"providerRef"`
	Key         string `json:"key"`
	Scope       string `json:"scope"` // account or entity
}

type EntityPermissionProvider interface {
	CheckEntityPermission(context.Context, ProviderRequest) (Decision, error)
}

type EntityRequirement struct {
	Type               string `json:"type"`
	Permission         string `json:"permission"`
	SelectionParameter string `json:"selectionParameter,omitempty"`
	SelectionMode      string `json:"selectionMode"` // single or multiple
}

type Evaluator struct {
	ACL          *authz.Service
	Principals   PrincipalResolver
	Requirements RequirementsStore
	Entities     EntityPermissionProvider
	Entitlements map[string]EntitlementProvider // trusted providerRef registry
	Now          func() time.Time
}

type FileStore struct {
	// contains filtered or unexported fields
}

type Principal struct {
	Facts            authz.Facts `json:"facts"`
	AccountID        string      `json:"accountId"`
	MembershipGroups []string    `json:"membershipGroups,omitempty"`
	IdentityRevision string      `json:"identityRevision"`
}

type PrincipalResolver interface {
	ResolvePrincipal(context.Context) (Principal, error)
}

type ProviderRequest struct {
	SchemaVersion        int            `json:"schemaVersion"`
	RequestID            string         `json:"requestId"`
	Subject              string         `json:"subject"`
	Issuer               string         `json:"issuer"`
	TenantID             string         `json:"tenantId"`
	AccountID            string         `json:"accountId"`
	ResourceKind         string         `json:"resourceKind"`
	ResourceID           string         `json:"resourceId"`
	ResourceVersion      string         `json:"resourceVersion"`
	Action               string         `json:"action"`
	RequirementsRevision string         `json:"requirementsRevision"`
	RequirementKey       string         `json:"requirementKey"`
	ProviderRef          string         `json:"providerRef,omitempty"`
	EntitySelection      []authz.Entity `json:"entitySelection,omitempty"`
	EntitySelectionHash  string         `json:"entitySelectionHash"`
}

type Request struct {
	RequestID string
	Resource  authz.Resource
	Action    string
	Selected  []authz.Entity
}

type Requirements struct {
	SchemaVersion     int                     `json:"schemaVersion"`
	RequiredExposures []string                `json:"requiredExposures,omitempty"`
	AllowedRoles      []string                `json:"allowedRoles,omitempty"`
	Entity            *EntityRequirement      `json:"entity,omitempty"`
	Entitlement       *EntitlementRequirement `json:"entitlement,omitempty"`
}

type RequirementsDocument struct {
	Revision     string       `json:"revision"`
	Requirements Requirements `json:"requirements"`
}

type RequirementsStore interface {
	GetRequirements(context.Context, authz.Resource, string) (RequirementsDocument, error)
}

type RequirementsWriter interface {
	ReplaceRequirements(context.Context, authz.Resource, string, string, Requirements) (RequirementsDocument, error)
}

type StaticChoices struct {
	// contains filtered or unexported fields
}

type StaticStore struct {
	// contains filtered or unexported fields
}