Documentation
¶
Index ¶
- Variables
- func AllObjectsGranted(ctx context.Context, db storage.DBTX, subject uuid.UUID, objects []uuid.UUID, ...) (bool, error)
- func BatchDelete(ctx context.Context, tx storage.Transaction, keys []Key) error
- type Cursor
- type DuplicateGrantError
- type Grant
- type Key
- type Kind
- type ReadQuery
- type Relationship
- type ScanBySubjectQuery
- type ScanQuery
- type ScannedRelationship
Constants ¶
This section is empty.
Variables ¶
var ErrDuplicateGrant = errors.New("duplicate (subject, object, kind) in the batch")
ErrDuplicateGrant means a batch held two grants with the same (Subject, Object, Kind). The partial unique index allows one DIRECT role per grant, so the upsert touches a row twice and the DB rejects it; the handler maps this to InvalidArgument. BatchUpsert returns a *DuplicateGrantError, which matches this sentinel under errors.Is, so callers may test for either.
var ErrInvalidCursor = errors.New("invalid cursor")
ErrInvalidCursor means a page token failed to decode, or was minted for a different query than the one it's being used to page through.
var ErrNoObjects = errors.New("store: read requires at least one object")
ErrNoObjects means a read was requested without any object to scope it to.
Functions ¶
func AllObjectsGranted ¶ added in v1.18.0
func BatchDelete ¶ added in v1.33.0
BatchDelete removes the rows matching keys, in statements of at most maxBatchSize keys. Deletion is idempotent: a key with no matching row is not an error. BatchDelete takes the transaction it runs in so the delete stays atomic across chunks.
Types ¶
type Cursor ¶ added in v1.27.0
Cursor is the keyset position of the last row returned by a scan.
func DecodeCursor ¶ added in v1.30.0
DecodeCursor reverses Encode. An empty token is the first page, so it returns a nil Cursor and no error. fingerprint must match the one the token was minted with, or DecodeCursor returns ErrInvalidCursor.
type DuplicateGrantError ¶ added in v1.38.1
DuplicateGrantError reports the (Subject, Object, Kind) tuple that appeared twice in a batch. It carries the tuple so callers can name the offending grant instead of just knowing one exists.
func (*DuplicateGrantError) Error ¶ added in v1.38.1
func (e *DuplicateGrantError) Error() string
func (*DuplicateGrantError) Is ¶ added in v1.38.1
func (e *DuplicateGrantError) Is(target error) bool
Is reports a match against ErrDuplicateGrant so existing errors.Is checks for the sentinel keep working once BatchUpsert returns the richer type.
type Key ¶ added in v1.33.0
Key identifies a relationship row to delete by (subject, object, kind); no role, since that key is already unique per DIRECT row.
type Kind ¶
type Kind int32
Kind mirrors relationshipspb.Kind but keeps this package free of a proto dependency; the handler maps the proto enum onto it.
type Relationship ¶
type Relationship struct {
Subject uuid.UUID
Object uuid.UUID
Kind Kind
// EdgeType is the stored edge class (1=DIRECT). This API only writes DIRECT
// rows; it is mapped through so the struct mirrors the row for future readers.
EdgeType int32
Role uuid.UUID
CreatedAt time.Time
}
func BatchUpsert ¶ added in v1.14.0
func BatchUpsert(ctx context.Context, tx storage.Transaction, grants []Grant) ([]Relationship, error)
BatchUpsert writes the grants in statements of at most maxBatchSize rows and returns the stored rows in the same order as grants. The write stays atomic across chunks: BatchUpsert takes the transaction it runs in, and on any error the caller rolls back, so the rows written by earlier chunks never commit. A batch must not contain two grants with the same (Subject, Object, Kind); BatchUpsert returns ErrDuplicateGrant.
func LookupBySubject ¶ added in v1.49.0
func LookupBySubject(ctx context.Context, db storage.DBTX, query ScanBySubjectQuery) ([]Relationship, error)
LookupBySubject returns one page of a subject's relationships, keyset-paginated on (object, kind); role breaks no ties, since the subject is fixed and relationships_direct_grant_unique already makes (object, kind) unique. It is read-only, so it takes a DBTX.
type ScanBySubjectQuery ¶ added in v1.49.0
type ScanBySubjectQuery struct {
Subject uuid.UUID
Kinds []Kind
Roles []uuid.UUID
After *Cursor // nil reads the first page
Limit int
}
ScanBySubjectQuery is the input to LookupBySubject. After is nil for the first page.
type ScanQuery ¶ added in v1.27.0
type ScanQuery struct {
OrgID string
Objects []uuid.UUID
Kinds []Kind
Roles []uuid.UUID
After *Cursor // nil reads the first page
Limit int
}
ScanQuery is the input to LookupByOrg. After is nil for the first page. Limit must be between 1 and maxPageSize.
type ScannedRelationship ¶ added in v1.27.0
type ScannedRelationship struct {
Subject uuid.UUID
Object uuid.UUID
Kind Kind
Role uuid.UUID
CreatedAt time.Time
SubjectLocalID string
GrantedByLocalID string
}
ScannedRelationship is one row of an org scan, plus the local IDs of the subject's and the granter's identities in that org. GrantedByLocalID is empty when the row has no granter.
func LookupByOrg ¶ added in v1.27.0
func LookupByOrg(ctx context.Context, db storage.DBTX, query ScanQuery) ([]ScannedRelationship, error)
LookupByOrg returns one page of an org's relationships, keyset-paginated. It is read-only, so it takes a DBTX.
Source Files
Directories