authorization

type Authorizer ¶

type Authorizer interface {
	// CanPerform checks whether the user holds any role that grants permission.
	CanPerform(context.Context, User, Permission) error

	// CanPerformOwned checks whether the user holds permission unconditionally,
	// or — when ownership is required — whether user.GetID() == ownerID.
	CanPerformOwned(context.Context, User, Permission, uuid.UUID) error
}

Authorizer checks whether a user is permitted to perform an action.

type LocalAuthorizer ¶

type LocalAuthorizer struct {
	// contains filtered or unexported fields
}

LocalAuthorizer evaluates permissions against a static, in-process Policy. It is the standard implementation for services that define policy at startup.

func NewLocalAuthorizer(policy Policy) *LocalAuthorizer

func (l *LocalAuthorizer) CanPerform(_ context.Context, user User, permission Permission) error

func (l *LocalAuthorizer) CanPerformOwned(
	_ context.Context,
	user User,
	permission Permission,
	ownerID uuid.UUID,
) error

type Module ¶

type Module struct {
	modules.Base
	// contains filtered or unexported fields
}

func New() *Module

func (m *Module) Authorizer() Authorizer

func (m *Module) Configure(opts ...modules.Option) error

func (m *Module) Shutdown() error

func (m *Module) Start() error

type OwnershipConstraint ¶

type OwnershipConstraint bool

OwnershipConstraint controls whether a permission requires the subject to own the resource being acted upon.

const (
	OwnershipRequired   OwnershipConstraint = true
	NoOwnershipRequired OwnershipConstraint = false
)

type Permission ¶

type Permission string

Permission is a named action that can be granted to a role.

type Policy ¶

type Policy map[string]map[Permission]OwnershipConstraint

Policy maps role names to the set of permissions granted to that role, along with the ownership constraint for each permission. Each service defines its own policy as a package-level variable and passes it to WithPolicy.

type User ¶

type User interface {
	GetRoles() []string
	GetID() uuid.UUID
}

User is implemented by each service's concrete user entity, allowing the authorization package to remain decoupled from any specific user type.