Documentation
¶
Overview ¶
Package resolver evaluates single-resource permission checks and list authorization against relational authz storage (ADR 032–033 / issue #423).
Index ¶
- func PermissionName(objectType, relation string) string
- type Decision
- type Graph
- func (g *Graph) OracleCheck(projectID, principalHomeProjectID string, ...) bool
- func (g *Graph) OracleCheckParams(p domain.AuthzCheckParams) bool
- func (g *Graph) OracleFoothold(projectID string, principalType domain.AuthzPrincipalType, principalID string) bool
- func (g *Graph) OracleList(projectID, principalHomeProjectID string, ...) []string
- func (g *Graph) OracleListParams(p domain.AuthzListObjectsParams) []string
- type ListRequest
- type Request
- type Resolver
- func (r *Resolver) ActiveCatalogID(ctx context.Context, stmts service.AuthzResolverStatements) (string, error)
- func (r *Resolver) Check(ctx context.Context, stmts service.AuthzResolverStatements, req Request) (Decision, error)
- func (r *Resolver) CheckParams(ctx context.Context, stmts service.AuthzResolverStatements, req Request) (domain.AuthzCheckParams, error)
- func (r *Resolver) ListObjects(ctx context.Context, stmts service.AuthzResolverStatements, req ListRequest) ([]string, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func PermissionName ¶
PermissionName builds the flat "{resource}.{verb}" string for the sk_team_ gate.
Types ¶
type Decision ¶
type Decision uint8
Decision is the library-level outcome of a permission check (not an HTTP code).
type Graph ¶
type Graph struct {
Closure []compiler.Implication
Edges []compiler.ExpressionEdge
Assignments []*domain.AuthzAssignment
Memberships []*domain.AuthzMembershipEdge
Resources []*domain.ResourceScope
}
Graph is an in-memory authz fact set for the L4 oracle.
func GraphFromPersisted ¶
func GraphFromPersisted(catalog compiler.PersistedCatalog) Graph
GraphFromPersisted builds an oracle graph catalog fragment from compiler output.
func (*Graph) OracleCheck ¶
func (g *Graph) OracleCheck(projectID, principalHomeProjectID string, principalType domain.AuthzPrincipalType, principalID, objectType, relation string) bool
OracleCheck applies MVP rules: direct+closure, team membership expand, bounded TTU.
func (*Graph) OracleCheckParams ¶
func (g *Graph) OracleCheckParams(p domain.AuthzCheckParams) bool
OracleCheckParams applies OracleCheck, optional team/resource-scoped grant arms (by-id Check), then the sk_team_ team constraint.
func (*Graph) OracleFoothold ¶
func (g *Graph) OracleFoothold(projectID string, principalType domain.AuthzPrincipalType, principalID string) bool
OracleFoothold mirrors HasAuthzProjectFoothold.
func (*Graph) OracleList ¶
func (g *Graph) OracleList(projectID, principalHomeProjectID string, principalType domain.AuthzPrincipalType, principalID string, kind domain.ResourceKind, objectType, relation string) []string
OracleList returns resource ids of kind authorized under project / team / resource scopes.
func (*Graph) OracleListParams ¶
func (g *Graph) OracleListParams(p domain.AuthzListObjectsParams) []string
OracleListParams applies OracleList then the sk_team_ team constraint.
type ListRequest ¶
type ListRequest struct {
Request
ResourceKind domain.ResourceKind
}
ListRequest is the public ListObjects input (L4 / oracle helper).
type Request ¶
type Request struct {
PrincipalType domain.AuthzPrincipalType
PrincipalID string
ProjectID string
ObjectType string
Relation string
// TeamID is required for sk_team_ principals (token team). Copied to
// AuthzCheckParams.ConstraintTeamID so SQL can constrain the object.
TeamID string
// ResourceID is the object being checked (user id, team id, path id).
// Optional for permission-level Check of non-team-bound types; required for
// sk_team checks of team-bound object types so the compensating team
// constraint cannot be skipped. Also used for resource-scoped grant arms.
// Empty ResourceID does not skip the grant Check — it only skips the extra
// "object is in the token team" AND — so omission would look like a
// create-style Check. Missing id is an error, not Allow.
ResourceID string
// ResourceTeamID is RSI.team_id after a by-id lookup (team-scoped grant arm).
ResourceTeamID string
// HomeProjectID is the credential's home project for membership-edge
// lookup (#333 / ADR 052). Empty stays empty — CheckParams does not
// default it to ProjectID (the target). SQL still falls back via
// AuthzCheckParams.HomeProjectID() when unset.
HomeProjectID string
}
Request is the public Check input. The active system catalog is resolved internally; callers must not supply a catalog id.
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver evaluates checks with optional request-scoped memoization. Create one per request; it is not safe for concurrent use.
func (*Resolver) ActiveCatalogID ¶
func (*Resolver) Check ¶
func (r *Resolver) Check(ctx context.Context, stmts service.AuthzResolverStatements, req Request) (Decision, error)
Check returns Allow / NotFound / Forbidden for one permission check.
For sk_team_ principals, permissions outside the flat allowlist short-circuit to DecisionNotFound without a foothold lookup (intentional masking; HTTP will map like other NotFound). Allowed permissions still use storage Allow / Forbidden / NotFound as usual.
func (*Resolver) CheckParams ¶
func (r *Resolver) CheckParams(ctx context.Context, stmts service.AuthzResolverStatements, req Request) (domain.AuthzCheckParams, error)
CheckParams is the storage Check/List payload for req, including ConstraintTeamID for sk_team principals. HTTP list filters must use this so EXISTS SQL matches Check.
CheckParams does not apply the sk_team allowlist short-circuit that Check uses. sk_team Checks of project.viewer are DecisionNotFound, so HTTP lists never take the Forbidden / filter branch for those principals. ConstraintTeamID plumbing stays so a future allowlisted project relation still constrains SQL.
func (*Resolver) ListObjects ¶
func (r *Resolver) ListObjects(ctx context.Context, stmts service.AuthzResolverStatements, req ListRequest) ([]string, error)
ListObjects returns resource_scope_index ids of ResourceKind the principal may see.
Source Files