Versions in this module Expand all Collapse all v0 v0.1.0 Jul 13, 2026 Changes in this version + var ErrMissingObjectID = errors.New("authz: action requires an object ID") + var ErrNoChecker = errors.New("authz: no policy checker registered for resource") + var ErrNoObjectChecker = errors.New("authz: checker cannot authorize already-loaded objects") + var ErrObjectType = errors.New("authz: object type does not match registered checker") + var ErrUnauthorized = errors.New("authz: unauthorized") + var ErrUnexpectedObjectID = errors.New("authz: collection-only checker received an object ID") + type CollectionChecker interface + CanCollection func(ctx context.Context, subject S, action A) (bool, error) + type CollectionCheckerFunc func(ctx context.Context, subject S, action A) (bool, error) + func (f CollectionCheckerFunc[A, S]) CanCollection(ctx context.Context, subject S, action A) (bool, error) + type ConfigModifier func(*engineConfig) + func WithDenyUnknownResources() ConfigModifier + func WithLogger(l *slog.Logger) ConfigModifier + type Engine struct + func NewEngine[R, A comparable, S any](modifiers ...ConfigModifier) *Engine[R, A, S] + func (e *Engine[R, A, S]) Check(ctx context.Context, subject S, resource R, action A, objectID string) (bool, error) + func (e *Engine[R, A, S]) CheckObject(ctx context.Context, subject S, resource R, action A, obj any) (bool, error) + func (e *Engine[R, A, S]) HasChecker(resource R) bool + func (e *Engine[R, A, S]) Register(resource R, checker PolicyChecker[A, S]) + func (e *Engine[R, A, S]) RegisterFunc(resource R, fn func(ctx context.Context, req Request[A, S]) (bool, error)) + func (e *Engine[R, A, S]) Require(ctx context.Context, subject S, resource R, action A, objectID string) error + func (e *Engine[R, A, S]) RequireObject(ctx context.Context, subject S, resource R, action A, obj any) error + func (e *Engine[R, A, S]) Resources() []R + type ObjectChecker interface + CanObject func(ctx context.Context, subject S, action A, obj any) (bool, error) + type ObjectLoader interface + Load func(ctx context.Context, id string) (T, error) + type ObjectLoaderFunc func(ctx context.Context, id string) (T, error) + func (f ObjectLoaderFunc[T]) Load(ctx context.Context, id string) (T, error) + type PolicyChecker interface + Can func(ctx context.Context, req Request[A, S]) (bool, error) + func WrapCollectionOnly[A comparable, S any](collection CollectionChecker[A, S]) PolicyChecker[A, S] + func WrapFunc[A comparable, S, T any](checker func(ctx context.Context, subject S, action A, obj T) (bool, error), ...) PolicyChecker[A, S] + func WrapHybrid[A comparable, S, T any](resource ResourceChecker[A, S, T], collection CollectionChecker[A, S], ...) PolicyChecker[A, S] + func Wrap[A comparable, S, T any](checker ResourceChecker[A, S, T], loader ObjectLoader[T]) PolicyChecker[A, S] + type PolicyCheckerFunc func(ctx context.Context, req Request[A, S]) (bool, error) + func (f PolicyCheckerFunc[A, S]) Can(ctx context.Context, req Request[A, S]) (bool, error) + type Request struct + Action A + ObjectID string + Subject S + type ResourceChecker interface + Can func(ctx context.Context, subject S, action A, obj T) (bool, error) + type ResourceCheckerFunc func(ctx context.Context, subject S, action A, obj T) (bool, error) + func (f ResourceCheckerFunc[A, S, T]) Can(ctx context.Context, subject S, action A, obj T) (bool, error) + type UnauthorizedError struct + Action string + ObjectID string + Resource string + func (e *UnauthorizedError) Error() string + func (e *UnauthorizedError) Is(target error) bool
Go to main page