compiler

type CatalogMutations ¶

type CatalogMutations struct {
	SchemaVersion      string
	Types              []TypeDefinition
	Relations          []RelationDefinition
	RelationReferences []RelationReference
	ExpressionEdges    []ExpressionEdge
	Closure            []Implication
}

CatalogMutations are the storage-neutral rows needed to replace one catalog version. Callers add catalog/version and partition metadata when persisting them.

func (m CatalogMutations) Persisted() PersistedCatalog

type Compiler ¶

type Compiler struct {
	Validator profile.Validator
}

Compiler validates and compiles authorization models. Validator controls the allowed tuple-to-userset hierarchy; its zero value uses the ADR 032 defaults.

func (c Compiler) Compile(model authz.Model) (Output, error)

type ExpressionEdge ¶

type ExpressionEdge struct {
	Target   Relation
	Kind     TermKind
	Source   Relation
	Tupleset Relation
	Position int
}

ExpressionEdge is a flattened OR term suitable for relational storage. The MVP profile only permits union as a set operator, so nested unions are associative and can be flattened without changing semantics.

Field use depends on Kind:

• TermDirect: Source and Tupleset are zero values; direct type restrictions live in CatalogMutations.RelationReferences.
• TermComputedUserset: Source is the relation implied on the same object.
• TermTupleToUserset: Source is the computed relation on the tupleset's target type; Tupleset is the relation traversed on the target object.

type Implication ¶

type Implication struct {
	Source  Relation
	Implied Relation
	Depth   int
}

Implication is one row of the precomputed same-object relation closure: assigning Source also grants Implied. Depth is the shortest number of computed-userset edges between them; every relation has a reflexive depth-0 row so a resolver can use one closure join for direct and implied grants.

Object-bound userset references and tuple-to-userset traversals are not global implications and therefore never appear here.

type Output ¶

type Output struct {
	Catalog CatalogMutations
	Plans   []QueryPlan
}

Output is the complete result of compiling one catalog schema.

func Compile(model authz.Model) (Output, error)

type PersistedCatalog ¶

type PersistedCatalog struct {
	Relations          []RelationDefinition
	RelationReferences []RelationReference
	ExpressionEdges    []ExpressionEdge
	Closure            []Implication
}

PersistedCatalog is the subset of CatalogMutations that PersistCatalogVersion writes and LoadCatalogMutations reads (relations, references, edges, closure). SchemaVersion and Types are compile-time metadata only.

type QueryPlan ¶

type QueryPlan struct {
	Target Relation
	Terms  []QueryTerm
}

QueryPlan groups the flattened expression terms for one target relation. The resolver can OR the terms as indexed semi-joins without re-walking the original OpenFGA expression tree.

type QueryTerm ¶

type QueryTerm struct {
	Kind             TermKind
	Source           Relation
	Tupleset         Relation
	DirectReferences []authz.RelationReference
}

QueryTerm is the runtime form of an ExpressionEdge. DirectReferences is set only for TermDirect; it tells the resolver which principal or userset shapes may be assigned directly.

type Relation ¶

type Relation struct {
	Type string
	Name string
}

Relation identifies one relation on one object type.

type RelationDefinition ¶

type RelationDefinition struct {
	Relation Relation
}

type RelationReference ¶

type RelationReference struct {
	Relation  Relation
	Reference authz.RelationReference
	Position  int
}

RelationReference is one direct-assignment type restriction belonging to a relation. Position preserves the normalized, deterministic order.

type TermKind ¶

type TermKind uint8

TermKind identifies one supported leaf in a relation expression.

const (
	TermInvalid TermKind = iota
	TermDirect
	TermComputedUserset
	TermTupleToUserset
)

type TypeDefinition ¶

type TypeDefinition struct {
	Name string
}