Documentation
¶
Overview ¶
Package authz holds dialect-independent Wave 1 authz persistence helpers: lifecycle projection (multi-write), membership-edge Filter schema, and catalog row mapping from compiler mutations.
Index ¶
- Variables
- func EmptyToNil(s string) *string
- func ExpressionEdgeKind(k compiler.TermKind) (string, error)
- func ParseExpressionEdgeKind(kind string) (compiler.TermKind, error)
- func PersistedCatalogFromDomain(catalog *domain.AuthzCatalog) (compiler.PersistedCatalog, error)
- func RequireManagementListFilter(ctx context.Context) error
- func UserCreated(ctx context.Context, rsi service.ResourceScopeStatements, ...) error
- func UserDeactivated(ctx context.Context, edges service.AuthzMembershipEdgeStatements, ...) error
- func UserDeleted(ctx context.Context, rsi service.ResourceScopeStatements, ...) error
- func ValidateAssignment(a *domain.AuthzAssignment) error
- func WriteActiveSystemCatalogID(w ArgWriter, env Env)
- func WriteCheckAuthz(w ArgWriter, env Env, params domain.AuthzCheckParams)
- func WriteHasAuthzProjectFoothold(w ArgWriter, env Env, projectID string, ...)
- func WriteListAuthzExistsPredicate(w ArgWriter, env Env, outerResourceIDExpr string, ...)
- func WriteListAuthzObjectIDs(w ArgWriter, env Env, params domain.AuthzListObjectsParams)
- type ArgWriter
- type CatalogRows
- type ClosureRow
- type Env
- type ExpressionEdgeRow
- type RelationReferenceRow
- type RelationRow
Constants ¶
This section is empty.
Variables ¶
var ErrListFilterRequired = service.ErrListFilterRequired
ErrListFilterRequired is returned when a management list runs without an AuthzListFilter (or unrestricted / one-shot skip marker) on the context.
var ErrSKTeamProjectScope = errors.New("authz: sk_team grants for team-bound permissions must be team-scoped")
ErrSKTeamProjectScope is returned when an sk_team_ grant for a team-bound permission is minted with project scope.
var MembershipEdgeSchema = database.NewSchema(map[domain.AuthzMembershipEdgeField]database.FieldBinding[domain.AuthzMembershipEdge]{ domain.AuthzMembershipEdgeFieldProjectID: { SQLName: "project_id", Accessor: func(e *domain.AuthzMembershipEdge) any { return e.ProjectID }, Coerce: database.CoerceString, }, domain.AuthzMembershipEdgeFieldMemberType: { SQLName: "member_type", Accessor: func(e *domain.AuthzMembershipEdge) any { return e.MemberType.String() }, Coerce: database.CoerceString, }, domain.AuthzMembershipEdgeFieldMemberID: { SQLName: "member_id", Accessor: func(e *domain.AuthzMembershipEdge) any { return e.MemberID }, Coerce: database.CoerceString, }, domain.AuthzMembershipEdgeFieldSetType: { SQLName: "set_type", Accessor: func(e *domain.AuthzMembershipEdge) any { return e.SetType.String() }, Coerce: database.CoerceString, }, domain.AuthzMembershipEdgeFieldSetID: { SQLName: "set_id", Accessor: func(e *domain.AuthzMembershipEdge) any { return e.SetID }, Coerce: database.CoerceString, }, domain.AuthzMembershipEdgeFieldCreatedAt: { SQLName: "created_at", Accessor: func(e *domain.AuthzMembershipEdge) any { return e.CreatedAt }, Coerce: database.CoerceTime, }, })
MembershipEdgeSchema binds authz_membership_edges filter fields for all dialects.
Functions ¶
func EmptyToNil ¶
EmptyToNil returns nil for empty strings (SQL NULL for optional columns).
func ExpressionEdgeKind ¶
ExpressionEdgeKind returns the authz_expression_edges.kind CHECK value for a compiler term.
func ParseExpressionEdgeKind ¶
ParseExpressionEdgeKind maps an authz_expression_edges.kind column value to TermKind.
func PersistedCatalogFromDomain ¶
func PersistedCatalogFromDomain(catalog *domain.AuthzCatalog) (compiler.PersistedCatalog, error)
PersistedCatalogFromDomain maps a loaded domain catalog projection into the compiler-shaped rows used by persist round-trip tests.
func RequireManagementListFilter ¶
RequireManagementListFilter is the #838 tripwire: compileList and hand-built lists (ListUsers) must not SELECT the world if the HTTP filter was forgotten. Unrestricted nested lists are checked first so they do not consume Allow's one-shot skip.
func UserCreated ¶
func UserCreated(ctx context.Context, rsi service.ResourceScopeStatements, edges service.AuthzMembershipEdgeStatements, projectID, userID, initialTeamID string) error
UserCreated dual-writes user RSI and an optional initial team membership edge.
func UserDeactivated ¶
func UserDeactivated(ctx context.Context, edges service.AuthzMembershipEdgeStatements, projectID, userID string) error
UserDeactivated clears all membership edges for the user (RSI is kept).
func UserDeleted ¶
func UserDeleted(ctx context.Context, rsi service.ResourceScopeStatements, edges service.AuthzMembershipEdgeStatements, projectID, userID string) error
UserDeleted clears membership edges and the user resource scope.
func ValidateAssignment ¶
func ValidateAssignment(a *domain.AuthzAssignment) error
ValidateAssignment rejects sk_team_ + project-scope grants for team-bound object types (user, team, team_membership, event). Call from every dialect's CreateAuthzAssignment before INSERT.
func WriteActiveSystemCatalogID ¶
WriteActiveSystemCatalogID emits SELECT id for the active system catalog.
func WriteCheckAuthz ¶
func WriteCheckAuthz(w ArgWriter, env Env, params domain.AuthzCheckParams)
WriteCheckAuthz emits SELECT (allowed), (foothold) in one round-trip.
func WriteHasAuthzProjectFoothold ¶
func WriteHasAuthzProjectFoothold(w ArgWriter, env Env, projectID string, principalType domain.AuthzPrincipalType, principalID string)
WriteHasAuthzProjectFoothold emits SELECT (foothold).
func WriteListAuthzExistsPredicate ¶
func WriteListAuthzExistsPredicate(w ArgWriter, env Env, outerResourceIDExpr string, params domain.AuthzListObjectsParams)
WriteListAuthzExistsPredicate emits the per-row visibility test for a management list. outerResourceIDExpr is a raw SQL column reference (e.g. "zitadel_nextgen.teams.id").
The constant arms are lifted out of the correlated subquery by the distributive law, so a planner evaluates them once rather than per listed row:
EXISTS(base AND (C OR Q)) == (C AND EXISTS(base)) OR EXISTS(base AND Q)
`C AND EXISTS(base)` is required, not cosmetic: an object with no RSI row must stay invisible even when C is true, so C alone can never grant it.
func WriteListAuthzObjectIDs ¶
func WriteListAuthzObjectIDs(w ArgWriter, env Env, params domain.AuthzListObjectsParams)
WriteListAuthzObjectIDs emits SELECT resource_id … ORDER BY resource_id.
Types ¶
type CatalogRows ¶
type CatalogRows struct {
Relations []RelationRow
References []RelationReferenceRow
Edges []ExpressionEdgeRow
Closure []ClosureRow
}
CatalogRows are storage-ready rows derived from compiler.CatalogMutations.
func BuildCatalogRows ¶
func BuildCatalogRows(catalogID string, mutations compiler.CatalogMutations) (CatalogRows, error)
BuildCatalogRows maps compiler mutations into typed insert rows.
type ClosureRow ¶
type ClosureRow struct {
CatalogID string
FromObjectType string
FromRelation string
ToObjectType string
ToRelation string
Depth int
}
ClosureRow is one authz_relation_closure insert.
type Env ¶
type Env struct {
// Schema is table qualifier including trailing dot, or empty (e.g. "zitadel_nextgen.").
Schema string
// Now emits the dialect clock compared to expires_at.
Now func(ArgWriter)
}
Env adapts shared resolver SQL to one dialect (schema prefix + clock).
type ExpressionEdgeRow ¶
type ExpressionEdgeRow struct {
CatalogID string
ObjectType string
Relation string
Kind string
SourceObjectType *string
SourceRelation *string
TuplesetObjectType *string
TuplesetRelation *string
Position int
}
ExpressionEdgeRow is one authz_expression_edges insert.
Source Files