rbac

type Decision int

type EvaluateOption func(*EvaluateOptions)

type EvaluateOptions struct {
	Explainer Explainer
}

type Evaluator struct {
	// contains filtered or unexported fields
}

type Explainer interface {
	// RuleConsidered is called for each rule that is evaluated
	RuleConsidered(rule *Rule)

	// RuleSkipped is called when a rule is skipped with the reason
	RuleSkipped(rule *Rule, reason string)

	// RuleMatched is called when a rule matches and grants permission
	RuleMatched(rule *Rule, resource string, action string)

	// NoRulesMatched is called when no rules grant the requested permission
	NoRulesMatched()
}

type Permission struct {
	Resource string   `json:"resource"`
	Actions  []string `json:"actions"`
}

type Policy struct {
	Rules       []Rule `json:"rules"`
	ClusterID   string `json:"cluster_id,omitempty"`
	ClusterName string `json:"cluster_name,omitempty"`
}

type PolicyProvider interface {
	// GetPolicy returns the current policy
	GetPolicy() *Policy
}

type Request struct {
	Subject  string         // Subject identifier (from JWT)
	Groups   []string       // Group IDs the subject belongs to
	Resource string         // Resource being accessed
	Action   string         // Action being performed
	Tags     map[string]any // Tags to match against rule selectors
	Context  map[string]any // Additional context
}

type Rule struct {
	ID          string       `json:"id"`
	Name        string       `json:"name"`
	Description string       `json:"description,omitempty"`
	TagSelector TagSelector  `json:"tag_selector"`
	Groups      []string     `json:"groups"`
	Permissions []Permission `json:"permissions"`
	CreatedAt   string       `json:"created_at"`
	UpdatedAt   string       `json:"updated_at"`
}

type TagExpression struct {
	Tag      string `json:"tag"`
	Value    any    `json:"value"`    // Can be a string, number, boolean, or array
	Operator string `json:"operator"` // "equals", "not_equals", "in", "not_in", "exists", "not_exists"
}

type TagSelector struct {
	Expressions []TagExpression `json:"expressions"`
}