dsl

type AndExpr ¶

type AndExpr struct {
	Left, Right Expr
	Pos         Pos
}

AndExpr is set intersection (e.g. `editor and not banned`).

func (e *AndExpr) Position() Pos

type ApplyOptions ¶

type ApplyOptions struct {
	// TenantID overrides Program.Tenant when non-empty.
	TenantID string
	// AppID overrides Program.App when non-empty.
	AppID string
	// DryRun, when true, plans the changes and returns the diff but writes
	// nothing to the store.
	DryRun bool
	// Prune, when true, deletes tenant entries (within the namespaces
	// covered by the program) that are not declared in the program.
	// kubectl-style apply with prune.
	Prune bool
	// Now is the time used for CreatedAt/UpdatedAt timestamps. Defaults to
	// time.Now().UTC().
	Now time.Time
}

ApplyOptions configures the DSL applier.

type ApplyResult ¶

type ApplyResult struct {
	Created []string // human-readable summary lines: "+ kind/name"
	Updated []string // "~ kind/name (field: old → new)"
	Deleted []string // "- kind/name"
	NoOps   int      // count of unchanged entries
}

ApplyResult summarizes the outcome of an apply.

func Apply(ctx context.Context, eng *warden.Engine, prog *Program, opts ApplyOptions) (*ApplyResult, error)

func ApplyDir(ctx context.Context, eng *warden.Engine, dir string, opts ApplyOptions, loadOpts ...LoadOption) (*ApplyResult, error)

func ApplyFS(ctx context.Context, eng *warden.Engine, fsys fs.FS, root string, opts ApplyOptions, loadOpts ...LoadOption) (*ApplyResult, error)

//go:embed all:config
var configFS embed.FS

res, err := dsl.ApplyFS(ctx, eng, configFS, "config",
    dsl.ApplyOptions{TenantID: "acme"},
    dsl.WithVariables(dsl.Variables{"REGION": region}))

func ApplyFile(ctx context.Context, eng *warden.Engine, path string, opts ApplyOptions, loadOpts ...LoadOption) (*ApplyResult, error)

prog, parseErrs, err := dsl.LoadFile(path, loadOpts...)
// check err, parseErrs, then call dsl.Apply(ctx, eng, prog, opts)

type Condition ¶

type Condition struct {
	// Atomic predicate.
	Field    string
	Operator string
	Value    any
	Negate   bool

	// Boolean groups.
	AllOf []*Condition
	AnyOf []*Condition

	Pos Pos
}

Condition is a single ABAC predicate or boolean group.

Exactly one of {Field+Operator+Value, AllOf, AnyOf} is populated.

type Diagnostic ¶

type Diagnostic struct {
	Pos Pos
	Msg string
}

Diagnostic is a parser/checker error with a source position and message.

func Resolve(prog *Program) []*Diagnostic

func SubstituteVariables(file string, src []byte, vars Variables) ([]byte, []*Diagnostic)

func (d *Diagnostic) Error() string

func (d *Diagnostic) String() string

type DiagnosticError ¶

type DiagnosticError struct {
	Diags []*Diagnostic
}

DiagnosticError is the error type Apply / ApplyFile / ApplyDir / ApplyFS return when source-level errors prevent application. Use errors.As to extract the underlying diagnostics:

var derr *dsl.DiagnosticError
if errors.As(err, &derr) {
    for _, d := range derr.Diagnostics() {
        fmt.Println(d) // file:line:col: message
    }
}

The Error() representation joins every diagnostic with a newline so printing the error directly produces a multi-line list suitable for CI logs.

func (e *DiagnosticError) Diagnostics() []*Diagnostic

func (e *DiagnosticError) Error() string

type EngineEvaluator ¶

type EngineEvaluator struct {
	// contains filtered or unexported fields
}

EngineEvaluator implements warden.ExpressionEvaluator by looking up the resource type's permission expression, compiling+caching it, and evaluating against the relation graph.

Wire it via:

ev := dsl.NewEngineEvaluator(store)
eng := warden.NewEngine(warden.WithStore(store), warden.WithExpressionEvaluator(ev))

func NewEngineEvaluator(s engineStore) *EngineEvaluator

func (e *EngineEvaluator) EvalPermission(
	ctx context.Context,
	tenantID, namespacePath, resourceType, permName, subjectKind, subjectID, resourceID string,
) (bool, error)

type EvalContext ¶

type EvalContext struct {
	TenantID      string
	NamespacePath string

	ObjectType string
	ObjectID   string

	SubjectType string
	SubjectID   string

	// MaxDepth bounds traversal recursion. The engine sets this from its
	// configured graph walker depth.
	MaxDepth int
}

EvalContext is the runtime input to expression evaluation.

The evaluator walks an Expr AST against the relation graph to decide whether `subject` has the named permission on `resource`. It uses the store to look up tuples and recurses across traversal hops up to a bounded depth (taken from MaxDepth).

type Evaluator ¶

type Evaluator struct {
	// contains filtered or unexported fields
}

Evaluator evaluates resource-type permission expressions.

func NewEvaluator(relStore relation.Store) *Evaluator

func (e *Evaluator) CompileAndCache(tenantID, ns, resourceType, permName, exprSrc string) (Expr, []*Diagnostic)

func (e *Evaluator) Eval(ctx context.Context, expr Expr, ec EvalContext) (bool, error)

func (e *Evaluator) Invalidate(tenantID, resourceType string)

func (e *Evaluator) WithPermResolver(r PermResolver) *Evaluator

type ExportOptions ¶

type ExportOptions struct {
	// TenantID is required — the tenant whose state is exported.
	TenantID string
	// AppID is optional and propagates to the emitted header.
	AppID string
	// NamespacePrefix limits the export to entities whose namespace_path
	// equals or descends from this value. Empty means "all namespaces".
	NamespacePrefix string
	// Layout controls file layout (see Layout consts).
	Layout Layout
	// OutputDir is the destination root. Created if missing.
	OutputDir string
}

ExportOptions configures Export.

type Expr ¶

type Expr interface {
	Position() Pos
	// contains filtered or unexported methods
}

Expr is the interface for permission-expression AST nodes.

type ImportDecl ¶

type ImportDecl struct {
	Path string
	Pos  Pos
}

ImportDecl is a literal `import "<path>"` directive (reserved for the future explicit-import flow; the loader does not consume them today).

type Layout ¶

type Layout int

Layout controls how `warden export` distributes a tenant's state across .warden files.

const (
	// FlatLayout writes everything to a single main.warden file.
	FlatLayout Layout = iota
	// SectionalLayout splits by entity kind: 00-resource-types.warden,
	// 10-permissions.warden, 20-roles.warden, 30-policies.warden,
	// 40-relations.warden.
	SectionalLayout
	// DomainLayout groups by namespace path. Each top-level segment becomes
	// a directory; entities at the tenant root go to a `_root/` directory.
	DomainLayout
)

type Lexer ¶

type Lexer struct {
	// contains filtered or unexported fields
}

Lexer is a hand-written tokenizer for `.warden` source.

Encoding is UTF-8; positions are tracked in 1-based line and byte column. The lexer never errors fatally — it returns ILLEGAL tokens for malformed input and lets the parser report richer diagnostics.

func NewLexer(file string, src []byte) *Lexer

func (l *Lexer) Next() Token

type LoadOption ¶

type LoadOption func(*loadConfig)

LoadOption configures a Load* call. Use the With* helpers below.

func WithVariables(v Variables) LoadOption

type NamespaceDecl ¶

type NamespaceDecl struct {
	// Name is the path segment, not the absolute path.
	Name string

	// Children are the decls declared directly inside this block. After
	// flattening, the absolute namespace path of each is recorded on the
	// decl itself; this field is kept for reference / formatter use.
	ResourceTypes []*ResourceDecl
	Permissions   []*PermissionDecl
	Roles         []*RoleDecl
	Policies      []*PolicyDecl
	Relations     []*RelationDecl
	Namespaces    []*NamespaceDecl

	Pos Pos
}

NamespaceDecl wraps a nested `namespace "name" { ... }` block. The parser flattens nested namespaces into per-decl NamespacePath strings, but it also keeps the original NamespaceDecl tree around for fmt-friendly re-emission.

type NotExpr ¶

type NotExpr struct {
	Inner Expr
	Pos   Pos
}

NotExpr is set complement (e.g. `not banned`).

func (e *NotExpr) Position() Pos

type OrExpr ¶

type OrExpr struct {
	Left, Right Expr
	Pos         Pos
}

OrExpr is set union (e.g. `viewer or editor`).

func (e *OrExpr) Position() Pos

type PermResolver ¶

type PermResolver func(ctx context.Context, tenantID, namespacePath, resourceType, permName string) (Expr, bool)

PermResolver returns the compiled permission expression for a resource type's named permission, if one exists. Used by the traversal walker to recursively evaluate permissions across resource-type hops (e.g. `parent->read` where `read` is itself a permission expression on the hopped resource type).

Returns (nil, false) when no expression is defined for that combination.

type PermissionDecl ¶

type PermissionDecl struct {
	Name          string // the literal "resource:action" string
	NamespacePath string
	Resource      string // parsed from Name or set explicitly
	Action        string // parsed from Name or set explicitly
	Description   string
	IsSystem      bool
	Pos           Pos
}

PermissionDecl is a top-level `permission "<name>" (...)` or `{...}` block.

type PolicyDecl ¶

type PolicyDecl struct {
	Name          string
	NamespacePath string
	Description   string
	Effect        string // "allow" | "deny"
	Priority      int
	Active        bool
	NotBefore     *time.Time
	NotAfter      *time.Time
	Obligations   []string
	Actions       []string
	Resources     []string
	Conditions    []*Condition
	Pos           Pos
}

PolicyDecl is a top-level `policy "<name>" { ... }` block.

PBAC fields:

• NotBefore / NotAfter: optional RFC3339 instants bounding when the policy is effective. Either may be nil ("no bound on that side").
• Obligations: list of named side-effect actions emitted when the policy matches (e.g. "audit-log", "require-mfa").

type Pos ¶

type Pos struct {
	File string
	Line int // 1-based
	Col  int // 1-based, byte column
}

Pos is the source position of a token or AST node.

func (p Pos) String() string

type Program ¶

type Program struct {
	// File this program was parsed from. For multi-file load sets, this is
	// the root path (the load entrypoint).
	File string

	// Header values.
	Version int
	Tenant  string // optional; resolved at apply time
	App     string // optional

	// Top-level declarations.
	ResourceTypes []*ResourceDecl
	Permissions   []*PermissionDecl
	Roles         []*RoleDecl
	Policies      []*PolicyDecl
	Relations     []*RelationDecl
	Imports       []*ImportDecl
	Namespaces    []*NamespaceDecl

	// HeaderPos is the position of the `warden config N` line.
	HeaderPos Pos
}

Program is the root AST node — one parsed `.warden` file or set of files.

All decls within a program share the same logical namespace; cross-file references are resolved against the merged Program.

func BuildProgram(ctx context.Context, eng *warden.Engine, opts ExportOptions) (*Program, error)

type RefExpr ¶

type RefExpr struct {
	Name string
	Pos  Pos
}

RefExpr references a relation by name. Used as the leaf of expressions inside a resource type ("viewer", "editor").

func (e *RefExpr) Position() Pos

type RelationDecl ¶

type RelationDecl struct {
	NamespacePath   string
	ObjectType      string
	ObjectID        string
	Relation        string
	SubjectType     string
	SubjectID       string
	SubjectRelation string
	Pos             Pos
}

RelationDecl is a top-level `relation <obj_type>:<obj_id> <rel> = <subj_type>:<subj_id>[#<subj_rel>]`.

type RelationDef ¶

type RelationDef struct {
	Name            string
	AllowedSubjects []SubjectType
	Pos             Pos
}

RelationDef is a `relation <name>: <subj> | <subj>#<rel> | ...` line inside a resource block.

type ResourceDecl ¶

type ResourceDecl struct {
	Name          string
	NamespacePath string // absolute path, empty = tenant root
	Description   string
	Relations     []*RelationDef
	Permissions   []*ResourcePermissionDecl
	Pos           Pos
}

ResourceDecl is a `resource <name> { ... }` block.

type ResourcePermissionDecl ¶

type ResourcePermissionDecl struct {
	Name string
	Expr Expr
	Pos  Pos
}

ResourcePermissionDecl is a `permission <name> = <expr>` inside a resource block.

type RoleDecl ¶

type RoleDecl struct {
	Slug          string
	NamespacePath string
	Parent        string // raw — may be a local slug or absolute path starting with "/"
	Name          string
	Description   string
	IsSystem      bool
	IsDefault     bool
	MaxMembers    int
	Grants        []string // permission names; possibly globs
	GrantsAppend  bool     // true if `grants += [...]`
	Pos           Pos
}

RoleDecl is a `role <slug> [: <parent>] { ... }` block.

type SubjectType ¶

type SubjectType struct {
	Type     string
	Relation string
	Pos      Pos
}

SubjectType is one entry in a relation's allowed_subjects list. Relation, when non-empty, restricts to a relation-set (`group#member`).

type Token ¶

type Token struct {
	Kind  TokenKind
	Value string // raw lexeme; for STRING this is the unescaped string literal
	Pos   Pos
}

Token represents a single lexed token.

type TokenKind ¶

type TokenKind int

TokenKind enumerates lexical token categories.

const (
	// EOF marks end-of-input.
	EOF TokenKind = iota

	// ILLEGAL is an unrecognized character or unterminated literal.
	ILLEGAL

	// IDENT is a lowercase identifier — `[a-z_][a-z0-9_-]*`.
	IDENT

	// STRING is a double-quoted string literal with the value already
	// unescaped (\\, \", \n, \t).
	STRING

	// INT is an unsigned integer literal — `[0-9]+`.
	INT

	// BOOL is `true` or `false`.
	BOOL

	// Single-character punctuation.
	LBRACE   // {
	RBRACE   // }
	LPAREN   // (
	RPAREN   // )
	LBRACKET // [
	RBRACKET // ]
	COMMA    // ,
	COLON    // :
	SEMI     // ;
	DOT      // .
	PIPE     // |
	HASH     // #
	BANG     // !
	SLASH    // /  (used for absolute namespace paths in role parent refs)

	// Operators.
	ASSIGN // =
	APPEND // +=
	ARROW  // ->
	EQ     // ==
	NE     // !=
	LT     // <
	GT     // >
	LE     // <=
	GE     // >=
	PLUS   // +  (also used as union operator on expressions)
	MINUS  // -  (also unary negation)
	AMP    // &  (also intersection on expressions)
	REGEX  // =~

	// Keywords. Lexer picks these out of the IDENT stream.
	WARDEN      // warden
	CONFIG      // config
	TENANT      // tenant
	APP         // app
	NAMESPACE   // namespace
	IMPORT      // import
	RESOURCE    // resource
	RELATION    // relation
	PERMISSION  // permission
	ROLE        // role
	POLICY      // policy
	EFFECT      // effect
	ALLOW       // allow
	DENY        // deny
	ACTIONS     // actions
	RESOURCES   // resources
	SUBJECTS    // subjects
	WHEN        // when
	NEGATE      // negate
	GRANTS      // grants
	NAME        // name
	DESCRIPTION // description
	PRIORITY    // priority
	ACTIVE      // active
	IS_SYSTEM   //nolint:revive // matches DSL keyword spelling
	IS_DEFAULT  //nolint:revive // matches DSL keyword spelling
	MAX_MEMBERS //nolint:revive // matches DSL keyword spelling
	METADATA    // metadata
	OR          // or
	AND         // and
	NOT         // not
	IN          // in
	CONTAINS    // contains
	STARTS_WITH //nolint:revive // matches DSL keyword spelling
	ENDS_WITH   //nolint:revive // matches DSL keyword spelling
	EXISTS      // exists
	IP_IN_CIDR  //nolint:revive // matches DSL keyword spelling
	TIME_AFTER  //nolint:revive // matches DSL keyword spelling
	TIME_BEFORE //nolint:revive // matches DSL keyword spelling
	ALL_OF      //nolint:revive // matches DSL keyword spelling
	ANY_OF      //nolint:revive // matches DSL keyword spelling
	NOT_BEFORE  //nolint:revive // matches DSL keyword spelling
	NOT_AFTER   //nolint:revive // matches DSL keyword spelling
	OBLIGATIONS // obligations (PBAC: named side-effect actions)
)

func (k TokenKind) String() string

type TraverseExpr ¶

type TraverseExpr struct {
	// Steps holds at least 2 names: the first is a relation on the current
	// resource type, subsequent names are relations or permissions on the
	// target type after each hop.
	Steps []string
	Pos   Pos
}

TraverseExpr is `<rel>->...->target` — walk one or more relation hops and then check the final permission/relation on the resulting object.

func (e *TraverseExpr) Position() Pos

type Variables ¶

type Variables map[string]string

Variables is a name → value map of template variables expanded during loading. Names match the regex `[A-Za-z_][A-Za-z0-9_]*`. Values are inserted verbatim — substitution is purely textual, including inside string literals and comments.

Use cases: per-environment tenant IDs, namespace prefixes, region tags, or any other field that varies between deployments without changing the rest of the config.

func EnvVariables() Variables

func MergeVariables(layers ...Variables) Variables