Versions in this module Expand all Collapse all v1 v1.2.0 Nov 9, 2026 Changes in this version + const DefaultCacheTTL + const DefaultPolicyFile + const MaxCheckEach + const PermRolesAssign + const PermRolesManage + var ErrAlreadyLinked = errors.New("wardn: scope already has a different parent") + var ErrAuditRejected = errors.New("wardn: the audit hook rejected the change") + var ErrCacheInvalidation = errors.New("wardn: change saved, but invalidating the cache failed") + var ErrConflict = errors.New("wardn: role was changed by someone else; reload and try again") + var ErrDenied = errors.New("wardn: permission denied") + var ErrEscalation = errors.New("wardn: you cannot grant permissions you do not hold") + var ErrInvalidInput = errors.New("wardn: invalid input") + var ErrInvalidLink = errors.New("wardn: invalid scope link") + var ErrLinksExternal = errors.New("wardn: scope parents are resolved by Config.ParentOf; Link is disabled") + var ErrNoTransaction = errors.New(...) + var ErrNotAssignable = errors.New("wardn: role is not assignable at this scope") + var ErrRoleInUse = errors.New("wardn: role is still assigned") + var ErrRoleNameTaken = errors.New("wardn: a role with this name already exists here") + var ErrRoleNotFound = errors.New("wardn: role not found") + var ErrUnauthenticated = errors.New("wardn: no authenticated user") + var Global = Scope + func DecodeMemberCursor(cursor string) (user, role string, err error) + func EncodeMemberCursor(user, role string) string + func HTTPStatus(err error) int + func PathValue(name string) func(*http.Request) string + func UserOf(ctx context.Context) (string, bool) + func WithScope(ctx context.Context, s Scope) context.Context + func WithUser(ctx context.Context, userID string) context.Context + type AssignOption func(*assignWindow) + func From(t time.Time) AssignOption + func Until(t time.Time) AssignOption + type Assignment struct + ExpiresAt time.Time + Role string + Scope Scope + StartsAt time.Time + User string + type AssignmentStore interface + Assign func(ctx context.Context, a Assignment) error + Assignments func(ctx context.Context, user string, scopes []Scope) ([]Assignment, error) + ExpiredUnreported func(ctx context.Context, t time.Time, limit int) ([]Assignment, error) + MarkExpiryReported func(ctx context.Context, as []Assignment) error + Members func(ctx context.Context, scope Scope, cursor string, limit int) ([]Assignment, string, error) + Revoke func(ctx context.Context, user, role string, scope Scope) error + RevokeExpired func(ctx context.Context, a Assignment) error + RevokeRole func(ctx context.Context, role string) error + RoleInUse func(ctx context.Context, role string) (bool, error) + type Cache interface + Counters func(ctx context.Context, keys []string) ([]uint64, error) + Get func(ctx context.Context, key string) ([]byte, bool, error) + Incr func(ctx context.Context, keys []string) error + Set func(ctx context.Context, key string, value []byte, ttl time.Duration) error + type Clock interface + Now func() time.Time + type Config struct + Cache Cache + CacheSecret []byte + CacheTTL time.Duration + Clock Clock + File string + ManualMigrations bool + OnChange func(ctx context.Context, e Event) error + OnDecision func(ctx context.Context, d Decision, err error) + OnError func(w http.ResponseWriter, r *http.Request, err error) + ParentOf func(ctx context.Context, child Scope) (parent Scope, ok bool, err error) + Policy *Policy + Store Store + UserFrom func(r *http.Request) (userID string, ok bool) + type CustomRole struct + Allow []string + AssignableAt []string + CreatedAt time.Time + Description string + ID string + Name string + NameKey string + Owner Scope + UpdatedAt time.Time + Version int + type Decision struct + Allowed bool + At Scope + Permission string + Reason string + Role string + Rule string + Scope Scope + User string + type DeleteOption func(*deleteOptions) + func Cascade() DeleteOption + type DeniedError struct + Decisions []Decision + func (e *DeniedError) Error() string + func (e *DeniedError) Unwrap() error + type Event struct + Actor string + After *CustomRole + At time.Time + Before *CustomRole + Err error + ExpiresAt time.Time + Parent Scope + PreviousParent Scope + Role string + Scope Scope + StartsAt time.Time + System bool + Type EventType + User string + func (e *Event) UnmarshalJSON(data []byte) error + func (e Event) MarshalJSON() ([]byte, error) + type EventType string + const EventAssigned + const EventExpired + const EventLinked + const EventMoved + const EventRevoked + const EventRoleCreated + const EventRoleDeleted + const EventRoleUpdated + type MemoryCache struct + func NewMemoryCache(opts ...MemoryCacheOption) *MemoryCache + func (c *MemoryCache) Counters(ctx context.Context, keys []string) ([]uint64, error) + func (c *MemoryCache) Get(ctx context.Context, key string) ([]byte, bool, error) + func (c *MemoryCache) Incr(ctx context.Context, keys []string) error + func (c *MemoryCache) Set(ctx context.Context, key string, value []byte, ttl time.Duration) error + type MemoryCacheOption func(*MemoryCache) + func WithCacheClock(now func() time.Time) MemoryCacheOption + func WithMaxEntries(n int) MemoryCacheOption + type MemoryStore struct + func NewMemoryStore() *MemoryStore + func (m *MemoryStore) Assign(ctx context.Context, a Assignment) error + func (m *MemoryStore) Assignments(ctx context.Context, user string, scopes []Scope) ([]Assignment, error) + func (m *MemoryStore) CreateRole(ctx context.Context, r CustomRole) error + func (m *MemoryStore) DeleteRole(ctx context.Context, id string) error + func (m *MemoryStore) ExpiredUnreported(ctx context.Context, t time.Time, limit int) ([]Assignment, error) + func (m *MemoryStore) Link(ctx context.Context, child, parent Scope) error + func (m *MemoryStore) MarkExpiryReported(ctx context.Context, as []Assignment) error + func (m *MemoryStore) Members(ctx context.Context, scope Scope, cursor string, limit int) ([]Assignment, string, error) + func (m *MemoryStore) Parent(ctx context.Context, child Scope) (Scope, bool, error) + func (m *MemoryStore) Revoke(ctx context.Context, user, role string, scope Scope) error + func (m *MemoryStore) RevokeExpired(ctx context.Context, a Assignment) error + func (m *MemoryStore) RevokeRole(ctx context.Context, role string) error + func (m *MemoryStore) RoleInUse(ctx context.Context, role string) (bool, error) + func (m *MemoryStore) Roles(ctx context.Context, ids []string) ([]CustomRole, error) + func (m *MemoryStore) RolesOwnedBy(ctx context.Context, owners []Scope) ([]CustomRole, error) + func (m *MemoryStore) UpdateRole(ctx context.Context, r CustomRole, expectedVersion int) error + type Migrator interface + Migrate func(ctx context.Context) error + type Permission struct + Description string + Name string + type Policy struct + Permissions map[string]string + Roles map[string]Role + Scopes map[string]ScopeType + func LoadPolicyFile(path string) (*Policy, error) + func ParsePolicy(data []byte, source string) (*Policy, error) + func (p *Policy) Validate() error + type PolicyError struct + Issues []PolicyIssue + Source string + func (e *PolicyError) Error() string + type PolicyIssue struct + Line int + Message string + Path string + type Role struct + Allow []string + AssignableAt []string + Deny []string + Description string + type RoleInfo struct + Allow []string + AssignableAt []string + Custom bool + Deny []string + Description string + ID string + Name string + Owner Scope + Version int + type RoleSpec struct + Allow []string + AssignableAt []string + Deny []string + Description string + Name string + type RoleStore interface + CreateRole func(ctx context.Context, r CustomRole) error + DeleteRole func(ctx context.Context, id string) error + Roles func(ctx context.Context, ids []string) ([]CustomRole, error) + RolesOwnedBy func(ctx context.Context, owners []Scope) ([]CustomRole, error) + UpdateRole func(ctx context.Context, r CustomRole, expectedVersion int) error + type Scope struct + ID string + Type string + func NewScope(scopeType, id string) Scope + func ScopeOf(ctx context.Context) (Scope, bool) + func (s Scope) IsGlobal() bool + func (s Scope) String() string + type ScopeStore interface + Link func(ctx context.Context, child, parent Scope) error + Parent func(ctx context.Context, child Scope) (Scope, bool, error) + type ScopeType struct + Parent string + type Store interface + type SweepOption func(*sweepOptions) + func RemoveExpired() SweepOption + type System struct + func (s *System) Assign(ctx context.Context, user, role string, scope Scope, opts ...AssignOption) error + func (s *System) CreateRole(ctx context.Context, owner Scope, spec RoleSpec) (CustomRole, error) + func (s *System) DeleteRole(ctx context.Context, id string, opts ...DeleteOption) error + func (s *System) Revoke(ctx context.Context, user, role string, scope Scope) error + func (s *System) UpdateRole(ctx context.Context, id string, spec RoleSpec, version int) (CustomRole, error) + type TxStore interface + InTx func(ctx context.Context) bool + type UndefinedError struct + Kind string + Name string + Suggestion string + func (e *UndefinedError) Error() string + type Warden struct + func MustNew(cfg Config) *Warden + func New(cfg Config) (*Warden, error) + func (w *Warden) Assign(ctx context.Context, user, role string, scope Scope, opts ...AssignOption) error + func (w *Warden) AssignableRoles(ctx context.Context, scope Scope) ([]RoleInfo, error) + func (w *Warden) Can(ctx context.Context, user, permission string, scope Scope) bool + func (w *Warden) CanAll(ctx context.Context, user string, scope Scope, permissions ...string) bool + func (w *Warden) CanAny(ctx context.Context, user string, scope Scope, permissions ...string) bool + func (w *Warden) CanEach(ctx context.Context, user, permission string, scopes []Scope) []bool + func (w *Warden) Catalog() []Permission + func (w *Warden) Check(ctx context.Context, user, permission string, scope Scope) (Decision, error) + func (w *Warden) CheckEach(ctx context.Context, user, permission string, scopes []Scope) ([]Decision, error) + func (w *Warden) CreateRole(ctx context.Context, owner Scope, spec RoleSpec) (CustomRole, error) + func (w *Warden) CustomRole(ctx context.Context, id string) (CustomRole, error) + func (w *Warden) DeleteRole(ctx context.Context, id string, opts ...DeleteOption) error + func (w *Warden) InvalidateCache(ctx context.Context, scopes ...Scope) error + func (w *Warden) Link(ctx context.Context, child, parent Scope) error + func (w *Warden) Members(ctx context.Context, scope Scope, cursor string, limit int) ([]Assignment, string, error) + func (w *Warden) Move(ctx context.Context, child, newParent Scope) error + func (w *Warden) Now() time.Time + func (w *Warden) PermissionsOf(ctx context.Context, user string, scope Scope) ([]string, error) + func (w *Warden) Require(permissions ...string) func(http.Handler) http.Handler + func (w *Warden) RequireAny(permissions ...string) func(http.Handler) http.Handler + func (w *Warden) Revoke(ctx context.Context, user, role string, scope Scope) error + func (w *Warden) Roles(ctx context.Context, scope Scope) ([]RoleInfo, error) + func (w *Warden) RolesOf(ctx context.Context, user string, scope Scope) ([]Assignment, error) + func (w *Warden) RunExpiry(ctx context.Context, interval time.Duration, onError func(error), ...) + func (w *Warden) ScopeFrom(scopeType string, id func(*http.Request) string) func(http.Handler) http.Handler + func (w *Warden) SweepExpired(ctx context.Context, opts ...SweepOption) (int, error) + func (w *Warden) System() *System + func (w *Warden) SystemRoles() []string + func (w *Warden) Transaction(ctx context.Context) (context.Context, func(context.Context) error) + func (w *Warden) UpdateRole(ctx context.Context, id string, spec RoleSpec, version int) (CustomRole, error) + func (w *Warden) WithMemo(ctx context.Context) context.Context v1.1.0 Nov 8, 2026 v1.0.0 Nov 8, 2026
Go to main page