authz

func (Authorizer) AuthorizeDelete ¶ added in v1.50.0

func (a Authorizer) AuthorizeDelete(ctx context.Context, keys []*relationshipspb.RelationshipKey) error

AuthorizeDelete is AuthorizeWrite plus one exception: a caller may remove their own grant on any object without the owner role or a direct/ancestor grant on it. Removing your own grant can never grant you anything, so this is safe even when the caller's cached organization_role claim is stale (e.g. a just-demoted owner deleting their now-stale org-admin row). Self-owned keys are dropped per key, not all-or-nothing, before authorize ever sees them; only objects tied to someone else's grant go through the normal write authorization.

func (Authorizer) AuthorizeLookup ¶ added in v1.28.0

func (a Authorizer) AuthorizeLookup(ctx context.Context, objects []*relationshipspb.Object) error

func (Authorizer) AuthorizeLookupResources ¶ added in v1.49.0

func (a Authorizer) AuthorizeLookupResources(ctx context.Context, subject *relationshipspb.Identity) error

AuthorizeLookupResources allows a caller to look up its own resources, or, if it is the org owner, any subject in the same org. The request names no objects, so there is nothing to check a relationships-admin grant against — unlike AuthorizeLookup, this never touches the database.

func (Authorizer) AuthorizeWrite ¶ added in v1.28.0

func (a Authorizer) AuthorizeWrite(ctx context.Context, objects []*relationshipspb.Object) error