authz

type Condition ¶

type Condition struct {
	Name       string
	Expression string
	Parameters []ConditionParameter
}

Condition is an OpenFGA caveat definition. Profile validation rejects these for the MVP when they require non-indexed attribute evaluation; they are still preserved in the IR so diagnostics can name them.

type ConditionParameter ¶

type ConditionParameter struct {
	Name string
	Type ConditionParameterType
}

ConditionParameter is a named parameter of a Condition.

type ConditionParameterType ¶

type ConditionParameterType struct {
	Name     string
	Generics []ConditionParameterType
}

ConditionParameterType is an OpenFGA condition parameter type such as timestamp or list<string>. Name is the lower-case type without the TYPE_NAME_ proto prefix; Generics holds nested types for list/map.

type Model ¶

type Model struct {
	SchemaVersion string
	Types         []Type
	Conditions    []Condition
}

Model is the storage-independent representation of an OpenFGA authorization model. Types and Conditions are sorted by name for deterministic comparison in tests and later catalog diffs.

type Relation ¶

type Relation struct {
	Name                 string
	Rewrite              Rewrite
	DirectlyRelatedTypes []RelationReference
}

Relation is a named permission or relationship on a Type, including its rewrite expression and the type restrictions that apply to direct assignments (the [user] / [team#member] lists in the DSL).

type RelationReference ¶

type RelationReference struct {
	Type      string
	Relation  string // userset restriction (#relation); empty when unset
	Wildcard  bool   // true for type:*
	Condition string // caveat name attached with "with"; empty when unset
}

RelationReference is a direct-assignment type restriction, e.g. user, team#member, user:*, or user with non_expired.

type Rewrite ¶

type Rewrite struct {
	Kind     RewriteKind
	Relation string
	Tupleset string
	Children []Rewrite
}

Rewrite is one relation expression. Field use depends on Kind:

• RewriteComputedUserset: Relation is the implied relation name
• RewriteTupleToUserset: Relation is the computed userset; Tupleset is the tupleset relation (DSL: "<Relation> from <Tupleset>")
• RewriteUnion / RewriteIntersection: Children are the operands
• RewriteDifference: Children are [base, subtract]

type RewriteKind ¶

type RewriteKind uint8

RewriteKind identifies which OpenFGA userset construct a Rewrite encodes.

const (
	RewriteInvalid         RewriteKind = iota
	RewriteDirect                      // [user, ...] — this / direct assignment
	RewriteComputedUserset             // define editor: viewer
	RewriteTupleToUserset              // define viewer: member from team
	RewriteUnion                       // a or b
	RewriteIntersection                // a and b
	RewriteDifference                  // a but not b
)

type Type ¶

type Type struct {
	Name      string
	Relations []Relation
}

Type is an OpenFGA object type (e.g. project, team, user).