glaz

type BatchCheckRequest struct {

	// Required.
	Subject *Principal `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
	// Capped at 10,000 items. GLAZ rejects a larger batch outright rather
	// than evaluating an unbounded number of Cedar decisions in one call.
	Items []*CheckItem `protobuf:"bytes,2,rep,name=items,proto3" json:"items,omitempty"`
	// Every tuple relevant to any item in this batch, deduped by the caller.
	// Not pre-filtered per item — see CheckItem.ancestor_ids. Capped at
	// 10,000, the same as items: GLAZ indexes the whole list by object id
	// once per call, so an unbounded list would make that indexing cost
	// unbounded too.
	Relationships []*Relationship `protobuf:"bytes,3,rep,name=relationships,proto3" json:"relationships,omitempty"`
	// contains filtered or unexported fields
}

type BatchCheckResponse struct {
	Results []*CheckResult `protobuf:"bytes,1,rep,name=results,proto3" json:"results,omitempty"`
	// contains filtered or unexported fields
}

type CheckItem struct {
	Object *Object `protobuf:"bytes,1,opt,name=object,proto3" json:"object,omitempty"`
	// The actions being checked, e.g. "read_repository". Capped at 20 per
	// item; must not be empty.
	Actions []string `protobuf:"bytes,2,rep,name=actions,proto3" json:"actions,omitempty"`
	// Context for ABAC (e.g. visibility, type), as a JSON object string.
	Context string `protobuf:"bytes,3,opt,name=context,proto3" json:"context,omitempty"`
	// IDs of this object's ancestors (e.g. namespace_id and org_id, for a
	// repository). GLAZ counts a tuple from BatchCheckRequest.relationships
	// toward this item only if the tuple's object matches this item's own
	// object or one of these ancestor_ids. GLAZ trusts these ids as given; it
	// does not verify that they are actually ancestors of `object`. Capped at
	// 20 per item, the same as actions: real hierarchies are a handful of
	// levels deep, and scoping does one lookup per ancestor id per item.
	//
	// This is the only ancestor input GLAZ reads.
	AncestorIds []string `protobuf:"bytes,4,rep,name=ancestor_ids,json=ancestorIds,proto3" json:"ancestor_ids,omitempty"`
	// contains filtered or unexported fields
}

type CheckRequest struct {

	// Always a principal UUID.
	Subject *Principal `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
	// The action being checked, e.g. "read_repository". Named "action", not
	// "permission".
	Action string `protobuf:"bytes,2,opt,name=action,proto3" json:"action,omitempty"`
	// The object the action is checked against.
	Object *Object `protobuf:"bytes,3,opt,name=object,proto3" json:"object,omitempty"`
	// The subject's role grants, filtered by the host to the object and its
	// ancestors. GLAZ does not scope this list itself: a grant on any object
	// listed here counts toward the decision.
	Relationships []*Relationship `protobuf:"bytes,4,rep,name=relationships,proto3" json:"relationships,omitempty"`
	// Context for ABAC (e.g. visibility, type), as a JSON object string.
	Context string `protobuf:"bytes,5,opt,name=context,proto3" json:"context,omitempty"`
	// contains filtered or unexported fields
}

type CheckResponse struct {
	Allowed bool   `protobuf:"varint,1,opt,name=allowed,proto3" json:"allowed,omitempty"`
	Reason  string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type CheckResult struct {
	Object  *Object `protobuf:"bytes,1,opt,name=object,proto3" json:"object,omitempty"`
	Action  string  `protobuf:"bytes,2,opt,name=action,proto3" json:"action,omitempty"`
	Allowed bool    `protobuf:"varint,3,opt,name=allowed,proto3" json:"allowed,omitempty"`
	Reason  string  `protobuf:"bytes,4,opt,name=reason,proto3" json:"reason,omitempty"`
	// The index of the CheckItem in BatchCheckRequest.items that produced this
	// result. Disambiguates two items that share the same object.
	ItemIndex int32 `protobuf:"varint,5,opt,name=item_index,json=itemIndex,proto3" json:"item_index,omitempty"`
	// contains filtered or unexported fields
}

type Object struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

type Principal struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

type Relationship struct {
	Object *Object `protobuf:"bytes,2,opt,name=object,proto3" json:"object,omitempty"`
	Role   *Role   `protobuf:"bytes,4,opt,name=role,proto3" json:"role,omitempty"`
	// contains filtered or unexported fields
}

type Role struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}