rbac

type Authorizer interface {
	Authorize(ctx context.Context, a authorizer.Attributes) (authorized authorizer.Decision, reason string, err error)
}

type DefaultResolver struct {
	// resources get or list from cache
	// sync by informer
	cache.Cache
}

type Interface interface {
	RoleExtractor
	RoleResolver
	Authorizer
}

type RoleExtractor interface {
	GetUser(name string) (userv1.User, error)
	ListUser() ([]userv1.User, error)

	GetRole(namespace, name string) (rbacv1.Role, error)
	ListRoleBindings(namespace string) ([]rbacv1.RoleBinding, error)

	GetClusterRole(name string) (rbacv1.ClusterRole, error)
	ListClusterRoleBindings() ([]rbacv1.ClusterRoleBinding, error)
}

type RoleResolver interface {
	// RolesFor get all of roles and cluster roles bind to user, with non empty
	// namespace will match both Role and ClusterRole, otherwise only clusterRole
	// will be matched.
	RolesFor(user user.Info, namespace string) ([]*rbacv1.Role, []*rbacv1.ClusterRole, error)

	// UsersFor get all of users bind to role reference, if Role with namespace,
	// will match RoleBindings and ClusterRoleBindings, otherwise only Cluster
	// will be matched.
	UsersFor(role rbacv1.RoleRef, namespace string) ([]*userv1.User, error)

	// VisitRulesFor invokes visitor() with each rule that applies to a given user in a given namespace,
	// and each error encountered resolving those rules. Rule may be nil if err is non-nil.
	// If visitor() returns false, visiting is short-circuited.
	VisitRulesFor(user user.Info, namespace string, visitor func(source fmt.Stringer, rule *rbacv1.PolicyRule, err error) bool)
}