v0connect

package
v1.19.1-20251124112219... Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: unknown License: Apache-2.0 Imports: 6 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// WatchPermissionSetsServiceWatchPermissionSetsProcedure is the fully-qualified name of the
	// WatchPermissionSetsService's WatchPermissionSets RPC.
	WatchPermissionSetsServiceWatchPermissionSetsProcedure = "/authzed.api.materialize.v0.WatchPermissionSetsService/WatchPermissionSets"
	// WatchPermissionSetsServiceLookupPermissionSetsProcedure is the fully-qualified name of the
	// WatchPermissionSetsService's LookupPermissionSets RPC.
	WatchPermissionSetsServiceLookupPermissionSetsProcedure = "/authzed.api.materialize.v0.WatchPermissionSetsService/LookupPermissionSets"
	// WatchPermissionSetsServiceDownloadPermissionSetsProcedure is the fully-qualified name of the
	// WatchPermissionSetsService's DownloadPermissionSets RPC.
	WatchPermissionSetsServiceDownloadPermissionSetsProcedure = "/authzed.api.materialize.v0.WatchPermissionSetsService/DownloadPermissionSets"
)

These constants are the fully-qualified names of the RPCs defined in this package. They're exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.

Note that these are different from the fully-qualified method names used by google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to reflection-formatted method names, remove the leading slash and convert the remaining slash to a period.

View Source 
const (
	// RelationshipsServiceExperimentalCountRelationshipsByFilterProcedure is the fully-qualified name
	// of the RelationshipsService's ExperimentalCountRelationshipsByFilter RPC.
	RelationshipsServiceExperimentalCountRelationshipsByFilterProcedure = "/authzed.api.materialize.v0.RelationshipsService/ExperimentalCountRelationshipsByFilter"
)

These constants are the fully-qualified names of the RPCs defined in this package. They're exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.

Note that these are different from the fully-qualified method names used by google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to reflection-formatted method names, remove the leading slash and convert the remaining slash to a period.

View Source 
const (
	// RelationshipsServiceName is the fully-qualified name of the RelationshipsService service.
	RelationshipsServiceName = "authzed.api.materialize.v0.RelationshipsService"
)
View Source 
const (
	// WatchPermissionSetsServiceName is the fully-qualified name of the WatchPermissionSetsService
	// service.
	WatchPermissionSetsServiceName = "authzed.api.materialize.v0.WatchPermissionSetsService"
)
View Source 
const (
	// WatchPermissionsServiceName is the fully-qualified name of the WatchPermissionsService service.
	WatchPermissionsServiceName = "authzed.api.materialize.v0.WatchPermissionsService"
)
View Source 
const (
	// WatchPermissionsServiceWatchPermissionsProcedure is the fully-qualified name of the
	// WatchPermissionsService's WatchPermissions RPC.
	WatchPermissionsServiceWatchPermissionsProcedure = "/authzed.api.materialize.v0.WatchPermissionsService/WatchPermissions"
)

These constants are the fully-qualified names of the RPCs defined in this package. They're exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.

Note that these are different from the fully-qualified method names used by google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to reflection-formatted method names, remove the leading slash and convert the remaining slash to a period.

Variables

This section is empty.

Functions

func NewRelationshipsServiceHandler 

func NewRelationshipsServiceHandler(svc RelationshipsServiceHandler, opts ...connect.HandlerOption) (string, http.Handler)

NewRelationshipsServiceHandler builds an HTTP handler from the service implementation. It returns the path on which to mount the handler and the handler itself.

By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf and JSON codecs. They also support gzip compression.

func NewWatchPermissionSetsServiceHandler 

func NewWatchPermissionSetsServiceHandler(svc WatchPermissionSetsServiceHandler, opts ...connect.HandlerOption) (string, http.Handler)

NewWatchPermissionSetsServiceHandler builds an HTTP handler from the service implementation. It returns the path on which to mount the handler and the handler itself.

By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf and JSON codecs. They also support gzip compression.

func NewWatchPermissionsServiceHandler 

func NewWatchPermissionsServiceHandler(svc WatchPermissionsServiceHandler, opts ...connect.HandlerOption) (string, http.Handler)

NewWatchPermissionsServiceHandler builds an HTTP handler from the service implementation. It returns the path on which to mount the handler and the handler itself.

By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf and JSON codecs. They also support gzip compression.

Types

type RelationshipsServiceClient 

type RelationshipsServiceClient interface {
	// EXPERIMENTAL: CountRelationships returns the count of relationships for a given filter.
	ExperimentalCountRelationshipsByFilter(context.Context, *connect.Request[v0.ExperimentalCountRelationshipsByFilterRequest]) (*connect.Response[v0.ExperimentalCountRelationshipsByFilterResponse], error)
}

RelationshipsServiceClient is a client for the authzed.api.materialize.v0.RelationshipsService service.

func NewRelationshipsServiceClient 

func NewRelationshipsServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) RelationshipsServiceClient

NewRelationshipsServiceClient constructs a client for the authzed.api.materialize.v0.RelationshipsService service. By default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or connect.WithGRPCWeb() options.

The URL supplied here should be the base URL for the Connect or gRPC server (for example, http://api.acme.com or https://acme.com/grpc).

type RelationshipsServiceHandler 

type RelationshipsServiceHandler interface {
	// EXPERIMENTAL: CountRelationships returns the count of relationships for a given filter.
	ExperimentalCountRelationshipsByFilter(context.Context, *connect.Request[v0.ExperimentalCountRelationshipsByFilterRequest]) (*connect.Response[v0.ExperimentalCountRelationshipsByFilterResponse], error)
}

RelationshipsServiceHandler is an implementation of the authzed.api.materialize.v0.RelationshipsService service.

type UnimplementedRelationshipsServiceHandler 

type UnimplementedRelationshipsServiceHandler struct{}

UnimplementedRelationshipsServiceHandler returns CodeUnimplemented from all methods.

func (UnimplementedRelationshipsServiceHandler) ExperimentalCountRelationshipsByFilter 

func (UnimplementedRelationshipsServiceHandler) ExperimentalCountRelationshipsByFilter(context.Context, *connect.Request[v0.ExperimentalCountRelationshipsByFilterRequest]) (*connect.Response[v0.ExperimentalCountRelationshipsByFilterResponse], error)

type UnimplementedWatchPermissionSetsServiceHandler 

type UnimplementedWatchPermissionSetsServiceHandler struct{}

UnimplementedWatchPermissionSetsServiceHandler returns CodeUnimplemented from all methods.

func (UnimplementedWatchPermissionSetsServiceHandler) DownloadPermissionSets 

func (UnimplementedWatchPermissionSetsServiceHandler) DownloadPermissionSets(context.Context, *connect.Request[v0.DownloadPermissionSetsRequest]) (*connect.Response[v0.DownloadPermissionSetsResponse], error)

func (UnimplementedWatchPermissionSetsServiceHandler) LookupPermissionSets 

func (UnimplementedWatchPermissionSetsServiceHandler) LookupPermissionSets(context.Context, *connect.Request[v0.LookupPermissionSetsRequest], *connect.ServerStream[v0.LookupPermissionSetsResponse]) error

func (UnimplementedWatchPermissionSetsServiceHandler) WatchPermissionSets 

func (UnimplementedWatchPermissionSetsServiceHandler) WatchPermissionSets(context.Context, *connect.Request[v0.WatchPermissionSetsRequest], *connect.ServerStream[v0.WatchPermissionSetsResponse]) error

type UnimplementedWatchPermissionsServiceHandler 

type UnimplementedWatchPermissionsServiceHandler struct{}

UnimplementedWatchPermissionsServiceHandler returns CodeUnimplemented from all methods.

func (UnimplementedWatchPermissionsServiceHandler) WatchPermissions 

func (UnimplementedWatchPermissionsServiceHandler) WatchPermissions(context.Context, *connect.Request[v0.WatchPermissionsRequest], *connect.ServerStream[v0.WatchPermissionsResponse]) error

type WatchPermissionSetsServiceClient 

type WatchPermissionSetsServiceClient interface {
	// WatchPermissionSets returns a stream of changes to the sets which can be used to compute the watched permissions.
	//
	// WatchPermissionSets lets consumers achieve the same thing as WatchPermissions, but trades off a simpler usage model with
	// significantly lower computational requirements. Unlike WatchPermissions, this method returns changes to the sets of permissions,
	// rather than the individual permissions. Permission sets are a normalized form of the computed permissions, which
	// means that the consumer must perform an extra computation over this representation to obtain the final computed
	// permissions, typically by intersecting the provided sets.
	//
	// For example, this would look like a JOIN between the
	// materialize permission sets table in a target relation database, the table with the resources to authorize access
	// to, and the table with the subject (e.g. a user).
	//
	// In exchange, the number of changes issued by WatchPermissionSets will be several orders of magnitude less than those
	// emitted by WatchPermissions, which has several implications:
	// - significantly less resources to compute the sets
	// - significantly less messages to stream over the network
	// - significantly less events to ingest on the consumer side
	// - less ingestion lag from the origin SpiceDB mutation
	//
	// The type of scenarios WatchPermissionSets is particularly well suited is when a single change
	// in the origin SpiceDB can yield millions of changes. For example, in the GitHub authorization model, assigning a role
	// to a top-level team of an organization with hundreds of thousands of employees can lead to an explosion of
	// permission change events that would require a lot of computational resources to process, both on Materialize and
	// the consumer side.
	//
	// WatchPermissionSets is thus recommended for any larger scale use case where the fan-out in permission changes that
	// emerges from a specific schema and data shape is too large to handle effectively.
	//
	// The API does not offer a sharding mechanism and thus there should only be one consumer per target system.
	// Implementing an active-active HA consumer setup over the same target system will require coordinating which
	// revisions have been consumed in order to prevent transitioning to an inconsistent state.
	WatchPermissionSets(context.Context, *connect.Request[v0.WatchPermissionSetsRequest]) (*connect.ServerStreamForClient[v0.WatchPermissionSetsResponse], error)
	// LookupPermissionSets returns the current state of the permission sets which can be used to derive the computed permissions.
	// It's typically used to backfill the state of the permission sets in the consumer side.
	//
	// It's a cursored API and the consumer is responsible to keep track of the cursor and use it on each subsequent call.
	// Each stream will return <N> permission sets defined by the specified request limit. The server will keep streaming until
	// the sets per stream is hit, or the current state of the sets is reached,
	// whatever happens first, and then close the stream. The server will indicate there are no more changes to stream
	// through the `completed_members` in the cursor.
	//
	// There may be many elements to stream, and so the consumer should be prepared to resume the stream from the last
	// cursor received. Once completed, the consumer may start streaming permission set changes using WatchPermissionSets
	// and the revision token from the last LookupPermissionSets response.
	LookupPermissionSets(context.Context, *connect.Request[v0.LookupPermissionSetsRequest]) (*connect.ServerStreamForClient[v0.LookupPermissionSetsResponse], error)
	// DownloadPermissionSets returns URLs to download permission sets data as Avro files.
	// This provides an alternative to LookupPermissionSets for customers who need to download
	// large datasets efficiently. The returned URLs point to compressed Avro files containing
	// the permission sets data in a normalized format.
	DownloadPermissionSets(context.Context, *connect.Request[v0.DownloadPermissionSetsRequest]) (*connect.Response[v0.DownloadPermissionSetsResponse], error)
}

WatchPermissionSetsServiceClient is a client for the authzed.api.materialize.v0.WatchPermissionSetsService service.

func NewWatchPermissionSetsServiceClient 

func NewWatchPermissionSetsServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) WatchPermissionSetsServiceClient

NewWatchPermissionSetsServiceClient constructs a client for the authzed.api.materialize.v0.WatchPermissionSetsService service. By default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or connect.WithGRPCWeb() options.

The URL supplied here should be the base URL for the Connect or gRPC server (for example, http://api.acme.com or https://acme.com/grpc).

type WatchPermissionSetsServiceHandler 

type WatchPermissionSetsServiceHandler interface {
	// WatchPermissionSets returns a stream of changes to the sets which can be used to compute the watched permissions.
	//
	// WatchPermissionSets lets consumers achieve the same thing as WatchPermissions, but trades off a simpler usage model with
	// significantly lower computational requirements. Unlike WatchPermissions, this method returns changes to the sets of permissions,
	// rather than the individual permissions. Permission sets are a normalized form of the computed permissions, which
	// means that the consumer must perform an extra computation over this representation to obtain the final computed
	// permissions, typically by intersecting the provided sets.
	//
	// For example, this would look like a JOIN between the
	// materialize permission sets table in a target relation database, the table with the resources to authorize access
	// to, and the table with the subject (e.g. a user).
	//
	// In exchange, the number of changes issued by WatchPermissionSets will be several orders of magnitude less than those
	// emitted by WatchPermissions, which has several implications:
	// - significantly less resources to compute the sets
	// - significantly less messages to stream over the network
	// - significantly less events to ingest on the consumer side
	// - less ingestion lag from the origin SpiceDB mutation
	//
	// The type of scenarios WatchPermissionSets is particularly well suited is when a single change
	// in the origin SpiceDB can yield millions of changes. For example, in the GitHub authorization model, assigning a role
	// to a top-level team of an organization with hundreds of thousands of employees can lead to an explosion of
	// permission change events that would require a lot of computational resources to process, both on Materialize and
	// the consumer side.
	//
	// WatchPermissionSets is thus recommended for any larger scale use case where the fan-out in permission changes that
	// emerges from a specific schema and data shape is too large to handle effectively.
	//
	// The API does not offer a sharding mechanism and thus there should only be one consumer per target system.
	// Implementing an active-active HA consumer setup over the same target system will require coordinating which
	// revisions have been consumed in order to prevent transitioning to an inconsistent state.
	WatchPermissionSets(context.Context, *connect.Request[v0.WatchPermissionSetsRequest], *connect.ServerStream[v0.WatchPermissionSetsResponse]) error
	// LookupPermissionSets returns the current state of the permission sets which can be used to derive the computed permissions.
	// It's typically used to backfill the state of the permission sets in the consumer side.
	//
	// It's a cursored API and the consumer is responsible to keep track of the cursor and use it on each subsequent call.
	// Each stream will return <N> permission sets defined by the specified request limit. The server will keep streaming until
	// the sets per stream is hit, or the current state of the sets is reached,
	// whatever happens first, and then close the stream. The server will indicate there are no more changes to stream
	// through the `completed_members` in the cursor.
	//
	// There may be many elements to stream, and so the consumer should be prepared to resume the stream from the last
	// cursor received. Once completed, the consumer may start streaming permission set changes using WatchPermissionSets
	// and the revision token from the last LookupPermissionSets response.
	LookupPermissionSets(context.Context, *connect.Request[v0.LookupPermissionSetsRequest], *connect.ServerStream[v0.LookupPermissionSetsResponse]) error
	// DownloadPermissionSets returns URLs to download permission sets data as Avro files.
	// This provides an alternative to LookupPermissionSets for customers who need to download
	// large datasets efficiently. The returned URLs point to compressed Avro files containing
	// the permission sets data in a normalized format.
	DownloadPermissionSets(context.Context, *connect.Request[v0.DownloadPermissionSetsRequest]) (*connect.Response[v0.DownloadPermissionSetsResponse], error)
}

WatchPermissionSetsServiceHandler is an implementation of the authzed.api.materialize.v0.WatchPermissionSetsService service.

type WatchPermissionsServiceClient 

type WatchPermissionsServiceClient interface {
	// WatchPermissions returns a stream of PermissionChange events for the given permissions.
	//
	// WatchPermissions is a long-running RPC, and will stream events until the client
	// closes the connection or the server terminates the stream. The consumer is responsible of
	// keeping track of the last seen revision and resuming the stream from that point in the event
	// of disconnection or client-side restarts.
	//
	// The API does not offer a sharding mechanism and thus there should only be one consumer per target system.
	// Implementing an active-active HA consumer setup over the same target system will require coordinating which
	// revisions have been consumed in order to prevent transitioning to an inconsistent state.
	//
	// Usage of WatchPermissions requires to be explicitly enabled on the service, including the permissions to be
	// watched. It requires more resources and is less performant than WatchPermissionsSets. It's usage
	// is only recommended when performing the set intersections of WatchPermissionSets in the client side is not viable
	// or there is a strict application requirement to use consume the computed permissions.
	WatchPermissions(context.Context, *connect.Request[v0.WatchPermissionsRequest]) (*connect.ServerStreamForClient[v0.WatchPermissionsResponse], error)
}

WatchPermissionsServiceClient is a client for the authzed.api.materialize.v0.WatchPermissionsService service.

func NewWatchPermissionsServiceClient 

func NewWatchPermissionsServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) WatchPermissionsServiceClient

NewWatchPermissionsServiceClient constructs a client for the authzed.api.materialize.v0.WatchPermissionsService service. By default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or connect.WithGRPCWeb() options.

The URL supplied here should be the base URL for the Connect or gRPC server (for example, http://api.acme.com or https://acme.com/grpc).

type WatchPermissionsServiceHandler 

type WatchPermissionsServiceHandler interface {
	// WatchPermissions returns a stream of PermissionChange events for the given permissions.
	//
	// WatchPermissions is a long-running RPC, and will stream events until the client
	// closes the connection or the server terminates the stream. The consumer is responsible of
	// keeping track of the last seen revision and resuming the stream from that point in the event
	// of disconnection or client-side restarts.
	//
	// The API does not offer a sharding mechanism and thus there should only be one consumer per target system.
	// Implementing an active-active HA consumer setup over the same target system will require coordinating which
	// revisions have been consumed in order to prevent transitioning to an inconsistent state.
	//
	// Usage of WatchPermissions requires to be explicitly enabled on the service, including the permissions to be
	// watched. It requires more resources and is less performant than WatchPermissionsSets. It's usage
	// is only recommended when performing the set intersections of WatchPermissionSets in the client side is not viable
	// or there is a strict application requirement to use consume the computed permissions.
	WatchPermissions(context.Context, *connect.Request[v0.WatchPermissionsRequest], *connect.ServerStream[v0.WatchPermissionsResponse]) error
}

WatchPermissionsServiceHandler is an implementation of the authzed.api.materialize.v0.WatchPermissionsService service.

Source Files

  • relationships.connect.go
  • watchpermissions.connect.go
  • watchpermissionsets.connect.go

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.