authz

type Action interface {
	HasIdentity
}

type ActionStr string

type ClientSubject struct {
	// contains filtered or unexported fields
}

type DefaultAuthorizationService struct {
	// contains filtered or unexported fields
}

type Effect int32

type EntityResource struct {
	Namespace string
	Id        string
}

type Filter struct {
	Resource Resource
	Action   Action
	TenantID *string
	Effects  []Effect
}

type FilterFunc func(*Filter)

type HasIdentity interface {
	GetIdentity() string
}

type Option struct {
	SubjectContribList []SubjectContrib
}

type PermissionAllowSide int32

type PermissionBean struct {
	Namespace string
	Resource  string
	Action    string
	Subject   string
	TenantID  string
	Effect    Effect
}

type PermissionChecker interface {
	IsGrantTenant(ctx context.Context, requirement RequirementList, tenantID string, subjects ...Subject) ([]Effect, error)
}

type PermissionConf struct {
	Groups []*PermissionDefGroup `protobuf:"bytes,1,rep,name=groups,proto3" json:"groups,omitempty"`
	// contains filtered or unexported fields
}

type PermissionDef struct {

	// name user friendly name
	Name      string              `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Side      PermissionAllowSide `protobuf:"varint,2,opt,name=side,proto3,enum=authz.PermissionAllowSide" json:"side,omitempty"`
	Namespace string              `protobuf:"bytes,3,opt,name=namespace,proto3" json:"namespace,omitempty"`
	Action    string              `protobuf:"bytes,4,opt,name=action,proto3" json:"action,omitempty"`
	Extra     *structpb.Struct    `protobuf:"bytes,5,opt,name=extra,proto3" json:"extra,omitempty"`
	// internal will not be displayed by ui
	Internal bool  `protobuf:"varint,6,opt,name=internal,proto3" json:"internal,omitempty"`
	Priority int32 `protobuf:"varint,7,opt,name=priority,proto3" json:"priority,omitempty"`
	// contains filtered or unexported fields
}

type PermissionDefGroup struct {
	Name     string              `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Side     PermissionAllowSide `protobuf:"varint,2,opt,name=side,proto3,enum=authz.PermissionAllowSide" json:"side,omitempty"`
	Def      []*PermissionDef    `protobuf:"bytes,3,rep,name=def,proto3" json:"def,omitempty"`
	Extra    *structpb.Struct    `protobuf:"bytes,4,opt,name=extra,proto3" json:"extra,omitempty"`
	Internal bool                `protobuf:"varint,5,opt,name=internal,proto3" json:"internal,omitempty"`
	Priority int32               `protobuf:"varint,6,opt,name=priority,proto3" json:"priority,omitempty"`
	// contains filtered or unexported fields
}

type PermissionManagementService interface {
	AddGrant(ctx context.Context, resource Resource, action Action, subject Subject, tenantID string, effect Effect) error
	//ListAcl list permission of subjects. if not subjects provided, all acl will be returned
	ListAcl(ctx context.Context, subjects ...Subject) ([]PermissionBean, error)
	UpdateGrant(ctx context.Context, subject Subject, acl []UpdateSubjectPermission) error
	RemoveGrant(ctx context.Context, subject Subject, filter ...FilterFunc) error
}

type PermissionRequirement struct {
	Resource Resource
	Action   Action
}

type Requirement struct {
	Resource Resource
	Action   Action
}

type RequirementList []*Requirement

type Resource interface {
	HasIdentity
	GetNamespace() string
}

type Result struct {
	Allowed      bool
	Requirements []*Requirement
}

type ResultList []*Result

type RoleSubject struct {
	// contains filtered or unexported fields
}

type Service interface {
	//CheckForSubjects permission of these subjects directly
	CheckForSubjects(ctx context.Context, resource Resource, action Action, subjects ...Subject) (*Result, error)
	//Check resolve subject from ctx, then check permission of these subjects
	Check(ctx context.Context, resource Resource, action Action) (*Result, error)

	BatchCheckForSubjects(ctx context.Context, requirement RequirementList, subjects ...Subject) (ResultList, error)
	BatchCheck(ctx context.Context, requirement RequirementList) (ResultList, error)

	FormatError(ctx context.Context, result *Result, subjects ...Subject) error
}

type Subject interface {
	HasIdentity
}

type SubjectContrib interface {
	Process(ctx context.Context, subject Subject) ([]Subject, error)
}

type SubjectList []Subject

type SubjectResolver interface {
	//ResolveFromContext extract subjects from current ctx
	ResolveFromContext(ctx context.Context) ([]Subject, error)
	//ResolveProcessed recursively find related subjects. (RBAC)
	ResolveProcessed(ctx context.Context, subjects ...Subject) ([]Subject, error)
}

type SubjectResolverImpl struct {
	// contains filtered or unexported fields
}

type SubjectStr string

type TenantSubject struct {
	// contains filtered or unexported fields
}

type TokenSubject struct {
	// contains filtered or unexported fields
}

type UpdateSubjectPermission struct {
	Resource Resource
	Action   Action
	Effect   Effect
	TenantID string
}

type UserSubject struct {
	// contains filtered or unexported fields
}