iam

package module
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 28, 2026 License: Apache-2.0 Imports: 27 Imported by: 0

README

Axis Vertex Go SDK

Go Reference

Go SDK for the Axis Vertex Application Identity Platform. Provides JWT verification, role→permission resolution with local caching, and drop-in middleware for net/http, chi, gin, and echo.

Permission manifest synchronization

Use an explicit structured manifest with separate issuer/Portal endpoints. Startup defaults disabled; CI validate, deployment upsert, and development with explicit failure policy are opt-in. Commands share three attempts and fifteen seconds. Observer emits only mode/outcome/status/duration. iam-codegen upload now accepts a structured --manifest; Go AST parsing and legacy V1 upload are retired. Disabled startup returns PermissionManifestStartupResult{NetworkAttempted:false}. Development CONTINUE requires a redacted event handler and cannot silently swallow failure.

Run publication as an explicit CI/deployment command outside request-serving application startup:

manifestClient, err := iam.NewPermissionManifestClient(iam.PermissionManifestClientConfig{
    IssuerEndpoint: mustEnv("IAM_ISSUER_ENDPOINT"),
    PortalAPIEndpoint: mustEnv("IAM_PORTAL_API_ENDPOINT"),
    ClientID: mustEnv("IAM_SYNC_CLIENT_ID"),
    ClientSecret: mustEnv("IAM_SYNC_CLIENT_SECRET"),
})
if err != nil { log.Fatal(err) }
result, err := iam.RunPermissionManifestStartup(ctx, manifestClient, iam.PermissionManifest{
    ManifestID: "orders-service", Revision: mustEnv("GIT_COMMIT"),
    Permissions: []iam.PermissionManifestDeclaration{{Resource: "posts", Action: "read", Name: "Read posts"}},
}, iam.PermissionManifestStartupOptions{
    Mode: iam.PermissionManifestDeploymentUpsert,
    IdempotencyKey: mustEnv("IAM_IDEMPOTENCY_KEY"),
})
if err != nil || !result.NetworkAttempted { log.Fatal("permission manifest deployment failed") }

Application Client contract

Create one business Application for your product, then create the ApplicationClients it needs. Go server apps and iam-codegen use a WEB or M2M confidential ApplicationClient. ClientID is ApplicationClient.clientId, and ClientSecret is that confidential client's secret. Browser or native SPA/NATIVE public clients have no secret and must not be used for this server SDK or permission sync/upload.

This Go SDK is a resource-server and management-call SDK. It does not implement interactive WEB browser login. If a Go WEB application implements Authorization Code login itself, Axis Vertex requires both confidential client authentication at token exchange and S256 PKCE (code_challenge_method=S256 with a matching code_verifier stored with server-side OAuth state).

Install

go get github.com/axis-iam/vertex-sdk-go@v0.1.1
# adapter of your choice:
go get github.com/axis-iam/vertex-sdk-go/chi@v0.1.1
go get github.com/axis-iam/vertex-sdk-go/gin@v0.1.1
go get github.com/axis-iam/vertex-sdk-go/echo@v0.1.1

Quick start (chi)

import (
    iam "github.com/axis-iam/vertex-sdk-go"
    "github.com/axis-iam/vertex-sdk-go/authz"
    iamchi "github.com/axis-iam/vertex-sdk-go/chi"

    "myapp/internal/perms" // generated by iam-codegen
)

sdk, err := iam.New(&iam.SDKConfig{
    Endpoint:     "https://iam.example.com",
    ClientID:     "iam_web_or_m2m_client_id",
    ClientSecret: mustEnv("IAM_CLIENT_SECRET"),
})
if err != nil { log.Fatal(err) }

// Permission-manifest publication is a separate explicit CI/deployment command.
// The request-serving process does not upload permissions at startup.

r := chi.NewRouter()
r.Use(iamchi.Authenticate(sdk))

r.With(iamchi.RequirePerm(perms.PostsRead)).Get("/posts", listPosts)
r.With(iamchi.RequirePerm(perms.PostsWrite)).Post("/posts", createPost)
r.With(iamchi.RequireStepUp("urn:iam:acr:mfa")).Post("/transfer", transfer)
gin
r := gin.Default()
r.Use(iamgin.Authenticate(sdk))
r.GET("/posts", iamgin.RequirePerm(perms.PostsRead), listPosts)
echo
e := echo.New()
e.Use(iamecho.Authenticate(sdk))
e.GET("/posts", listPosts, iamecho.RequirePerm(perms.PostsRead))
plain net/http
import "github.com/axis-iam/vertex-sdk-go/middleware"

mux := http.NewServeMux()
mux.Handle("/posts", sdk.Authenticate()(middleware.RequirePerm(perms.PostsRead)(listPosts)))

The permission model

  • Wire format: "resource:action" (e.g. posts:read).
  • Matching rules are identical to sdk-java and sdk-js:
    • exact: posts:read matches posts:read
    • action wildcard: posts:* matches posts:read
    • resource wildcard: *:read matches posts:read
    • full wildcard: *:* matches everything
    • case-sensitive; malformed entries never match

Permissions are not embedded in the JWT. The SDK resolves roles → permissions via POST /open/v1/permissions:resolve, caches the result in ristretto with singleflight deduplication, and surfaces the result as authz.User.Permissions on the request context.

Current user and profile

Use request-local context for audit actor fields and permission-adjacent decisions. This path does not call IAM:

func handler(w http.ResponseWriter, r *http.Request) {
    user, err := iam.MustUser(r.Context())
    if err != nil {
        http.Error(w, "unauthenticated", http.StatusUnauthorized)
        return
    }
    audit.ActorUserID = user.Subject
    audit.AppID = user.AppID
    audit.SessionID = user.SessionID
}

When the application needs fresher display/profile data, call IAM explicitly:

profile, err := sdk.GetMe(r.Context(), accessToken)
fresh, err := sdk.GetMe(r.Context(), accessToken, iam.BypassProfileCache())
security, err := sdk.GetAccountSecuritySummary(r.Context(), accessToken)
err = sdk.ChangePassword(r.Context(), accessToken, iam.PasswordChangeRequest{
    CurrentPassword: "old",
    NewPassword:     "new",
})
sessions, err := sdk.ListAccountSessions(r.Context(), accessToken)
err = sdk.RevokeOtherAccountSessions(r.Context(), accessToken)
orgs, err := sdk.ListAccountOrganizations(r.Context(), accessToken)
switched, err := sdk.SwitchAccountOrganization(r.Context(), accessToken, "org_123")
summary, err := sdk.GetAccountPermissionSummary(r.Context(), accessToken, "org_123")
check, err := sdk.CheckAccountPermission(r.Context(), accessToken, "orders:read", "org_123")

SDK.GetMe calls GET /api/v1/auth/me/profile with the user's bearer token and uses a short local cache. Client.GetMe is the uncached low-level helper. Account/security/organization helpers use the user's bearer token and do not send the SDK client secret, Basic auth, or X-IAM-Client-Id.

Email verification send/verify and password forgot/reset helpers are public connected-app helpers. They use the configured ApplicationClient ClientID and do not send the SDK client secret. Current-user permission summary/check calls use /api/v1/auth/me/permissions*; wildcard behavior is owned by IAM.

Organization switch returns a refresh/reauth continuation. The Go SDK does not mutate JWT org_id claims locally.

Public Organization invitation preview is unauthenticated; accept can be called without a bearer token and may return LOGIN_REQUIRED / LOGIN_OR_REGISTER_THEN_RETRY_ACCEPT:

preview, err := sdk.PreviewOrganizationInvitation(ctx, invitationTokenFromURL)
accepted, err := sdk.AcceptOrganizationInvitation(ctx, invitationTokenFromURL, accessTokenOrEmpty)

Do not persist raw invitation tokens in durable state. Keep them URL/request scoped.

UserProfile.Metadata is profile metadata returned by /api/v1/auth/me. It is not App User authorization attributes. App User authorization attributes are app-scoped management-plane fields shown/edited in Portal/Admin App User detail and may be used by IAM policy, ABAC, or token-claim generation. This Go SDK does not add a Portal/Admin App User management client in this scope, and runtime authorization checks continue to use JWT identity plus resolved permissions, never profile metadata or a cached profile.

Portal Open API M2M client

PortalOpenAPIClient is a server-side confidential client for trusted integrations that call iam-portal /open/v1/**. It must run only in backend code that can keep an M2M ClientSecret private. Do not bundle it into browser, native, or SPA code.

The client requests client_credentials machine tokens from {Issuer}/oauth2/token with HTTP Basic authentication and an explicit Portal Open API scope:

  • portal:openapi:read for GET
  • portal:openapi:write for POST, PUT, PATCH, and DELETE

Read and write tokens are cached separately. A cached read token is never used for write methods. Portal resource requests send only Authorization: Bearer <machine_token>; the SDK does not send Basic auth, X-IAM-Client-Id, X-Application-Id, or X-App-Key to iam-portal.

portal, err := iam.NewPortalOpenAPIClient(iam.PortalOpenAPIClientConfig{
    Issuer:         "https://iam.example.com",
    PortalEndpoint: "https://portal.example.com",
    ClientID:       "m2m_application_client_id",
    ClientSecret:   mustEnv("IAM_M2M_CLIENT_SECRET"),
})
if err != nil { log.Fatal(err) }

var stats map[string]any
if err := portal.RequestJSON(ctx, http.MethodGet, "/open/v1/stats", nil, &stats); err != nil {
    log.Fatal(err)
}

var createdRole map[string]any
body := map[string]any{"name": "support-admin", "description": "Support admin"}
if err := portal.RequestJSON(ctx, http.MethodPost, "/open/v1/roles", body, &createdRole); err != nil {
    log.Fatal(err)
}

For lower-level control, call GetMachineToken(ctx, iam.PortalOpenAPIReadScope) or GetMachineToken(ctx, iam.PortalOpenAPIWriteScope). Unsupported or empty scopes fail before any token request is sent.

Server Registration Grant Management

Registration Grant helpers are server-only and require registration_grants:read, registration_grants:write, and registration_grants:redemptions:read on the M2M client.

created, err := portal.CreateRegistrationGrant(ctx, iam.CreateRegistrationGrantRequest{Type: iam.CreateRegistrationGrantEmailLink})
if err != nil { return err }
if created.RegistrationGrantToken == nil { return errors.New("missing one-time proof") }
// Consume immediately. Never log, cache, or persist the proof.

Code generation

iam-codegen generate reads the explicit structured manifest locally and emits typed authz.PermissionKey constants. It performs no network request and needs no credentials. Validate/upsert remains a separate explicit server-only operation.

go install github.com/axis-iam/vertex-sdk-go/cmd/iam-codegen@v0.1.1

# local manifest → generate Go file
iam-codegen generate \
  --manifest iam-permission-manifest.json \
  --package perms --output internal/perms/permissions.gen.go

# explicit server-only validate/upsert
iam-codegen upload \
  --issuer-endpoint https://iam.example.com \
  --portal-api-endpoint https://portal.example.com \
  --client-id "$IAM_CLIENT_ID" --client-secret "$IAM_CLIENT_SECRET" \
  --manifest iam-permission-manifest.json --mode validate

Only validate/upsert requires a WEB/M2M confidential ApplicationClient. Generation is local and manifest-first.

go:generate integration:

// internal/perms/permissions.go
//go:generate iam-codegen generate --manifest ../../iam-permission-manifest.json --package perms --output permissions.gen.go
package perms

Testing

Use iamtest.MockServer to spin up an httptest-backed IAM server and iamtest.NewContext to inject permissions into business-logic unit tests:

func TestHandler(t *testing.T) {
    ctx := iamtest.NewContext(context.Background(),
        iamtest.WithSubject("u1"),
        iamtest.WithPermissions("posts:read"),
    )
    if !authz.HasPermission(authz.PermissionKey{Resource: "posts", Action: "read"},
        authz.FromContext(ctx).Permissions) {
        t.Fatal("expected allow")
    }
}

Configuration

SDKConfig fields (all optional except Endpoint, ClientID, and ClientSecret for server-side integrations):

Field Default Description
Endpoint — IAM base URL
ClientID — ApplicationClient.clientId for the WEB/M2M confidential client used by this server
ClientSecret — Secret for that WEB/M2M confidential ApplicationClient; required for server-side permission resolution, codegen, and upload
Audience ClientID Expected aud claim
Issuer Endpoint Expected iss claim
JWKSRefresh 1h JWKS cache TTL
PermissionCacheTTL 5m role→perms cache TTL
PermissionCacheMax 10000 ristretto max entries
UserProfileCacheTTL 1m /api/v1/auth/me profile cache TTL
UserProfileCacheMax 10000 profile cache max entries
DisableUserProfileCache false disables SDK.GetMe cache; Client.GetMe is always uncached
ResolveMode OnDemand FullSync pre-loads at startup
FailMode FailClose FailOpen returns empty perms on resolver error
HTTPTimeout 5s per-request timeout
MaxRetries 3 exponential-backoff attempts for transient 5xx

Modules

Path Purpose
github.com/axis-iam/vertex-sdk-go core types, config, JWT, authz, middleware
github.com/axis-iam/vertex-sdk-go/chi chi helpers
github.com/axis-iam/vertex-sdk-go/gin gin.HandlerFunc adapters
github.com/axis-iam/vertex-sdk-go/echo echo.MiddlewareFunc adapters
github.com/axis-iam/vertex-sdk-go/iamtest testing helpers
github.com/axis-iam/vertex-sdk-go/cmd/iam-codegen CLI

Adapter submodules carry their own go.mod so callers who adopt chi do not pull the gin / echo dependency tree (or vice versa).

Development

Server Authorization Management

PortalOpenAPIClient provides typed Application-scoped Role, Permission, role-permission, and user-role helpers. Load M2M credentials from the environment, request only the exact family scopes, and preserve returned quoted ETags:

role, err := portal.CreateRole(ctx, iam.CreateRoleRequest{Key: "support", Name: "Support"}, &iam.AuthorizationCreateOptions{IdempotencyKey: requestID})
role, err = portal.UpdateRole(ctx, role.ID, iam.UpdateRoleRequest{Name: ptr("Support agents")}, role.ETag)

go test ./...                 # unit tests
go test -race ./...           # race detector (requires CGO)
go vet ./...
golangci-lint run ./...

The cmd/iam-codegen binary is released with GoReleaser.

License

Apache 2.0 © axis-iam

Documentation

Overview

Package iam is the entry point for github.com/axis-iam/vertex-sdk-go, a Go SDK that integrates with the IAM Authentication Center.

It exposes:

  • SDKConfig — runtime configuration for the SDK
  • SDK — orchestrator that wires JWT verification, permission resolution and optional startup-time permission registration
  • Shortcut constructors for net/http middleware via the github.com/axis-iam/vertex-sdk-go/middleware sub-package

Framework-specific adapters live in their own submodules to avoid pulling unrelated router dependencies into callers:

  • github.com/axis-iam/vertex-sdk-go/chi
  • github.com/axis-iam/vertex-sdk-go/gin
  • github.com/axis-iam/vertex-sdk-go/echo

Index

Constants

View Source 
const PermissionsSyncScope = "permissions:sync"

Variables

View Source 
var (
	// ErrPortalOpenAPIConfig identifies invalid Portal Open API client configuration.
	ErrPortalOpenAPIConfig = errors.New("iam portal open api: config error")
	// ErrPortalOpenAPIToken identifies token acquisition or token response failures.
	ErrPortalOpenAPIToken = errors.New("iam portal open api: token error")
	// ErrPortalOpenAPIRequest identifies Portal resource request failures.
	ErrPortalOpenAPIRequest = errors.New("iam portal open api: request error")
)

Functions

func FromContext 

func FromContext(ctx context.Context) *authz.User

FromContext returns the authenticated IAM user carried by ctx, if any.

func MustUser 

func MustUser(ctx context.Context) (*authz.User, error)

MustUser returns the authenticated IAM user or authz.ErrUnauthenticated.

func PermissionDeclarationRevision 

func PermissionDeclarationRevision(declaration PermissionManifestDeclaration) (string, error)

Types

type APIError 

type APIError struct {
	Status int
	Body   string
}

APIError is returned for non-2xx responses from the IAM server.

func (*APIError) Error 

func (e *APIError) Error() string

func (*APIError) IsRetryable 

func (e *APIError) IsRetryable() bool

IsRetryable reports whether the error should trigger retries.

type AccountOrganization 

type AccountOrganization struct {
	OrganizationID string `json:"organizationId"`
	Name           string `json:"name"`
	Slug           string `json:"slug,omitempty"`
	Role           string `json:"role"`
	JoinedAt       string `json:"joinedAt,omitempty"`
	Current        bool   `json:"current"`
}

AccountOrganization is the current user's Application-scoped Organization membership.

type AccountPermissionSummary 

type AccountPermissionSummary struct {
	ApplicationID  string   `json:"applicationId"`
	OrganizationID string   `json:"organizationId,omitempty"`
	Roles          []string `json:"roles"`
	Permissions    []string `json:"permissions"`
}

AccountPermissionSummary is the current user's IAM-resolved permission summary.

type AccountSecuritySummary 

type AccountSecuritySummary struct {
	EmailVerified             bool `json:"emailVerified"`
	PasswordCredentialPresent bool `json:"passwordCredentialPresent"`
	MFAEnrolled               bool `json:"mfaEnrolled"`
	TOTPEnrolled              bool `json:"totpEnrolled"`
	WebAuthnEnrolled          bool `json:"webAuthnEnrolled"`
	ActiveSessionCount        int  `json:"activeSessionCount"`
}

AccountSecuritySummary is the current user's secret-free security summary.

type AccountUpdateProfileRequest 

type AccountUpdateProfileRequest struct {
	Username    string `json:"username,omitempty"`
	DisplayName string `json:"displayName,omitempty"`
	AvatarURL   string `json:"avatarUrl,omitempty"`
}

AccountUpdateProfileRequest is the safe scalar profile update request.

type AuthOption 

type AuthOption func(*middleware.AuthConfig)

AuthOption configures the Authenticate middleware.

func WithAuthResponder 

func WithAuthResponder(r middleware.ErrorResponder) AuthOption

WithAuthResponder substitutes the ErrorResponder used when authentication fails.

type AuthorizationCreateOptions 

type AuthorizationCreateOptions struct{ IdempotencyKey string }

AuthorizationCreateOptions carries an optional retry-safe Idempotency-Key.

type AuthorizationPageMetadata 

type AuthorizationPageMetadata struct {
	Size          int   `json:"size"`
	Number        int   `json:"number"`
	TotalElements int64 `json:"totalElements"`
	TotalPages    int   `json:"totalPages"`
}

AuthorizationPageMetadata is the nested Spring PagedModel metadata.

type AuthorizationPageOptions 

type AuthorizationPageOptions struct {
	Page *int
	Size *int
}

AuthorizationPageOptions selects a zero-based page with a maximum size of 100.

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client is a low-level HTTP client against the IAM server's /open/v1 API. It is safe for concurrent use.

func NewClient 

func NewClient(cfg *SDKConfig) (*Client, error)

NewClient constructs a Client from cfg. cfg.Validate() is called; callers should normally use New (in sdk.go) which also builds the verifier, resolver and registrar.

func (*Client) AcceptOrganizationInvitation 

func (c *Client) AcceptOrganizationInvitation(ctx context.Context, invitationToken, accessToken string) (*PublicOrganizationInvitationAcceptResponse, error)

AcceptOrganizationInvitation calls the public invitation accept endpoint. Pass an empty accessToken to receive IAM's login-required continuation when unauthenticated.

func (*Client) ChangePassword 

func (c *Client) ChangePassword(ctx context.Context, accessToken string, input PasswordChangeRequest) error

ChangePassword calls the authenticated password-change endpoint.

func (*Client) CheckAccountPermission 

func (c *Client) CheckAccountPermission(ctx context.Context, accessToken, permission, organizationID string) (*PermissionCheckResponse, error)

CheckAccountPermission checks one permission through IAM. Wildcard semantics are backend-owned.

func (*Client) Config 

func (c *Client) Config() *SDKConfig

Config returns a pointer to the underlying config. Callers must not mutate fields used by the SDK (Endpoint, ClientID, ...).

func (*Client) Endpoint 

func (c *Client) Endpoint() string

Endpoint returns the normalized IAM endpoint (no trailing slash).

func (*Client) GetAccountPermissionSummary 

func (c *Client) GetAccountPermissionSummary(ctx context.Context, accessToken, organizationID string) (*AccountPermissionSummary, error)

GetAccountPermissionSummary resolves current-user permissions in the active or explicit Organization context.

func (*Client) GetAccountProfile 

func (c *Client) GetAccountProfile(ctx context.Context, accessToken string) (*UserProfile, error)

GetAccountProfile calls GET /api/v1/auth/me/profile with the user's bearer token.

func (*Client) GetAccountSecuritySummary 

func (c *Client) GetAccountSecuritySummary(ctx context.Context, accessToken string) (*AccountSecuritySummary, error)

GetAccountSecuritySummary calls GET /api/v1/auth/me/security with the user's bearer token.

func (*Client) GetCurrentAccountOrganization 

func (c *Client) GetCurrentAccountOrganization(ctx context.Context, accessToken string) (*AccountOrganization, error)

GetCurrentAccountOrganization calls GET /api/v1/auth/me/organizations/current.

func (*Client) GetMe 

func (c *Client) GetMe(ctx context.Context, accessToken string) (*UserProfile, error)

GetMe calls GET /api/v1/auth/me/profile with the user's bearer access token. It is uncached; use SDK.GetMe for the short-TTL profile cache. The returned Metadata is profile metadata, not authorization attributes.

func (*Client) HTTP 

func (c *Client) HTTP() *http.Client

HTTP exposes the underlying http.Client (e.g. for test override).

func (*Client) HasAccountOrganizationMembership 

func (c *Client) HasAccountOrganizationMembership(ctx context.Context, accessToken, organizationID string) (bool, error)

HasAccountOrganizationMembership derives membership from the Organization list.

func (*Client) JWKS 

func (c *Client) JWKS(ctx context.Context, jwksURL string) ([]byte, error)

JWKS returns the raw JWKS JSON body served by the issuer's well-known endpoint. Used by the jwt sub-package.

func (*Client) ListAccountOrganizations 

func (c *Client) ListAccountOrganizations(ctx context.Context, accessToken string) ([]AccountOrganization, error)

ListAccountOrganizations calls GET /api/v1/auth/me/organizations.

func (*Client) ListAccountSessions 

func (c *Client) ListAccountSessions(ctx context.Context, accessToken string) ([]SessionView, error)

ListAccountSessions lists the current user's active sessions.

func (*Client) ListPermissions 

func (c *Client) ListPermissions(ctx context.Context, clientID string) (*ListPermissionsResponse, error)

ListPermissions calls GET /open/v1/apps/{cid}/permissions.

func (*Client) LogoutAccount 

func (c *Client) LogoutAccount(ctx context.Context, accessToken, refreshToken string) error

LogoutAccount blacklists the current token/session and optionally revokes a refresh token.

func (*Client) PreviewOrganizationInvitation 

func (c *Client) PreviewOrganizationInvitation(ctx context.Context, invitationToken string) (*PublicOrganizationInvitationPreview, error)

PreviewOrganizationInvitation calls the public invitation preview endpoint without bearer auth.

func (*Client) RequestPasswordReset 

func (c *Client) RequestPasswordReset(ctx context.Context, email, redirectURI string) error

RequestPasswordReset starts the opaque public forgot-password flow.

func (*Client) ResetPassword 

func (c *Client) ResetPassword(ctx context.Context, token, newPassword string) error

ResetPassword completes the public password reset flow.

func (*Client) ResolvePermissions 

func (c *Client) ResolvePermissions(ctx context.Context, clientID string, roles []string) (*ResolvePermissionsResponse, error)

ResolvePermissions calls POST /open/v1/permissions:resolve.

func (*Client) RevokeAccountSession 

func (c *Client) RevokeAccountSession(ctx context.Context, accessToken, sessionID string) error

RevokeAccountSession revokes one session owned by the current user.

func (*Client) RevokeOtherAccountSessions 

func (c *Client) RevokeOtherAccountSessions(ctx context.Context, accessToken string) error

RevokeOtherAccountSessions revokes all sessions except the current token's sid.

func (*Client) SendEmailVerification 

func (c *Client) SendEmailVerification(ctx context.Context, email string) (*EmailVerificationResponse, error)

SendEmailVerification starts the opaque public email verification send flow.

func (*Client) SetHTTPClient 

func (c *Client) SetHTTPClient(h *http.Client)

SetHTTPClient lets callers inject a custom http.Client. Intended for tests.

func (*Client) SwitchAccountOrganization 

func (c *Client) SwitchAccountOrganization(ctx context.Context, accessToken, organizationID string) (*OrganizationSwitchResponse, error)

SwitchAccountOrganization validates membership and returns the server continuation.

func (*Client) UpdateAccountProfile 

func (c *Client) UpdateAccountProfile(ctx context.Context, accessToken string, input AccountUpdateProfileRequest) (*UserProfile, error)

UpdateAccountProfile calls PATCH /api/v1/auth/me/profile with safe scalar profile fields.

func (*Client) VerifyEmail 

func (c *Client) VerifyEmail(ctx context.Context, token string) (*EmailVerificationResponse, error)

VerifyEmail verifies a public email-verification token.

type CreateOrganizationInvitationRequest 

type CreateOrganizationInvitationRequest struct {
	Email     string                  `json:"email"`
	Role      *OrganizationMemberRole `json:"role,omitempty"`
	SendEmail *bool                   `json:"sendEmail,omitempty"`
}

CreateOrganizationInvitationRequest is the strict invitation create payload.

type CreateOrganizationRequest 

type CreateOrganizationRequest struct {
	Name string `json:"name"`
	Slug string `json:"slug"`
}

CreateOrganizationRequest is the strict Organization create payload.

type CreatePermissionRequest 

type CreatePermissionRequest struct {
	Resource    string  `json:"resource"`
	Action      string  `json:"action"`
	Name        string  `json:"name"`
	Description *string `json:"description,omitempty"`
}

CreatePermissionRequest is the strict canonical permission create payload.

type CreateRegistrationGrantRequest 

type CreateRegistrationGrantRequest struct {
	Type          CreateRegistrationGrantType `json:"type"`
	DisplayName   *string                     `json:"displayName,omitempty"`
	AllowedEmail  *string                     `json:"allowedEmail,omitempty"`
	AllowedDomain *string                     `json:"allowedDomain,omitempty"`
	ExpiresAt     *string                     `json:"expiresAt,omitempty"`
	MaxUses       *int                        `json:"maxUses,omitempty"`
}

type CreateRegistrationGrantType 

type CreateRegistrationGrantType string

CreateRegistrationGrantRequest describes a manual EMAIL_LINK or ACCESS_CODE grant. 

const (
	CreateRegistrationGrantEmailLink  CreateRegistrationGrantType = "EMAIL_LINK"
	CreateRegistrationGrantAccessCode CreateRegistrationGrantType = "ACCESS_CODE"
)

type CreateRoleRequest 

type CreateRoleRequest struct {
	Key         string  `json:"key"`
	Name        string  `json:"name"`
	Description *string `json:"description,omitempty"`
}

CreateRoleRequest is the strict role create payload.

type CreateUserRoleRequest 

type CreateUserRoleRequest struct {
	RoleID    string             `json:"roleId"`
	Condition *UserRoleCondition `json:"condition,omitempty"`
}

CreateUserRoleRequest is the typed POST assignment payload.

type CreatedRegistrationGrant 

type CreatedRegistrationGrant struct {
	Grant                  RegistrationGrant `json:"grant"`
	RegistrationGrantToken *string           `json:"registrationGrantToken"`
	RegistrationAccessCode *string           `json:"registrationAccessCode"`
}

CreatedRegistrationGrant contains the one-time raw proof returned only by create.

type EmailVerificationResponse 

type EmailVerificationResponse struct {
	Message           string `json:"message"`
	RetryAfterSeconds *int   `json:"retryAfterSeconds"`
}

EmailVerificationResponse is returned by public email verification helpers.

type FailMode 

type FailMode int

FailMode controls how the SDK behaves when the permission resolver errors. 

const (
	// FailClose denies the request when resolution fails. Default.
	FailClose FailMode = iota
	// FailOpen allows the request through with an empty permission set.
	FailOpen
)

type ListPermissionsResponse 

type ListPermissionsResponse struct {
	Permissions []PermissionDefinitionDTO `json:"permissions"`
}

ListPermissionsResponse is the response body for GET /open/v1/apps/{cid}/permissions.

type Organization 

type Organization struct {
	ID        string `json:"id"`
	Name      string `json:"name"`
	Slug      string `json:"slug"`
	Version   int64  `json:"version"`
	CreatedAt string `json:"createdAt"`
	UpdatedAt string `json:"updatedAt"`
	ETag      string `json:"-"`
}

Organization is an Application-bound Organization. ETag is populated for create, get, and update responses.

type OrganizationCreateOptions 

type OrganizationCreateOptions struct {
	IdempotencyKey string
}

OrganizationCreateOptions carries an optional Idempotency-Key for exactly-once creates.

type OrganizationIfMatchOptions 

type OrganizationIfMatchOptions struct {
	IfMatch string
}

OrganizationIfMatchOptions carries an optional quoted ETag/version precondition.

type OrganizationInvitation 

type OrganizationInvitation struct {
	ID             string                               `json:"id"`
	Email          string                               `json:"email"`
	Role           OrganizationMemberRole               `json:"role"`
	Status         OrganizationInvitationStatus         `json:"status"`
	DeliveryStatus OrganizationInvitationDeliveryStatus `json:"deliveryStatus"`
	ExpiresAt      string                               `json:"expiresAt"`
	CreatedAt      string                               `json:"createdAt"`
	UpdatedAt      string                               `json:"updatedAt"`
}

OrganizationInvitation is a safe invitation detail. It never contains a redemption proof.

type OrganizationInvitationDeliveryStatus 

type OrganizationInvitationDeliveryStatus string

OrganizationInvitationDeliveryStatus is the invitation email delivery outcome. 

const (
	OrganizationInvitationDeliveryNotRequested OrganizationInvitationDeliveryStatus = "NOT_REQUESTED"
	OrganizationInvitationDeliverySent         OrganizationInvitationDeliveryStatus = "SENT"
	OrganizationInvitationDeliveryFailed       OrganizationInvitationDeliveryStatus = "FAILED"
)

type OrganizationInvitationListOptions 

type OrganizationInvitationListOptions struct {
	Status *OrganizationInvitationStatus
	Page   *int
	Size   *int
}

OrganizationInvitationListOptions filters invitation lifecycle state and pages results.

type OrganizationInvitationPage 

type OrganizationInvitationPage struct {
	Content []OrganizationInvitation `json:"content"`
	Page    OrganizationPageMetadata `json:"page"`
}

OrganizationInvitationPage is a page of invitation details and delivery states.

type OrganizationInvitationStatus 

type OrganizationInvitationStatus string

OrganizationInvitationStatus is an Organization invitation lifecycle state. 

const (
	OrganizationInvitationPending   OrganizationInvitationStatus = "PENDING"
	OrganizationInvitationAccepted  OrganizationInvitationStatus = "ACCEPTED"
	OrganizationInvitationCancelled OrganizationInvitationStatus = "CANCELLED"
	OrganizationInvitationExpired   OrganizationInvitationStatus = "EXPIRED"
)

type OrganizationListOptions 

type OrganizationListOptions struct {
	Search    *string
	Page      *int
	Size      *int
	Sort      []string
	Direction []OrganizationSortDirection
}

OrganizationListOptions filters, pages, and sorts Organization results.

type OrganizationMember 

type OrganizationMember struct {
	MembershipID string                 `json:"membershipId"`
	UserID       string                 `json:"userId"`
	Email        string                 `json:"email"`
	DisplayName  string                 `json:"displayName"`
	Role         OrganizationMemberRole `json:"role"`
	JoinedAt     string                 `json:"joinedAt"`
	UpdatedAt    string                 `json:"updatedAt"`
	Version      int64                  `json:"version"`
}

OrganizationMember is an Organization membership detail, including its optimistic-lock version.

type OrganizationMemberListOptions 

type OrganizationMemberListOptions struct {
	Search *string
	Page   *int
	Size   *int
}

OrganizationMemberListOptions filters and pages Organization members.

type OrganizationMemberPage 

type OrganizationMemberPage struct {
	Content []OrganizationMember     `json:"content"`
	Page    OrganizationPageMetadata `json:"page"`
}

OrganizationMemberPage is a page of Organization membership details.

type OrganizationMemberRole 

type OrganizationMemberRole string

OrganizationMemberRole is the Organization role returned and accepted by the Open API. 

const (
	OrganizationMemberRoleOwner  OrganizationMemberRole = "OWNER"
	OrganizationMemberRoleAdmin  OrganizationMemberRole = "ADMIN"
	OrganizationMemberRoleMember OrganizationMemberRole = "MEMBER"
)

type OrganizationPage 

type OrganizationPage struct {
	Content []Organization           `json:"content"`
	Page    OrganizationPageMetadata `json:"page"`
}

OrganizationPage is a page of Application-bound Organizations.

type OrganizationPageMetadata 

type OrganizationPageMetadata struct {
	Size          int   `json:"size"`
	Number        int   `json:"number"`
	TotalElements int64 `json:"totalElements"`
	TotalPages    int   `json:"totalPages"`
}

OrganizationPageMetadata is the nested Spring PagedModel metadata.

type OrganizationSortDirection 

type OrganizationSortDirection string

OrganizationSortDirection controls Organization list sorting. 

const (
	OrganizationSortAscending  OrganizationSortDirection = "ASC"
	OrganizationSortDescending OrganizationSortDirection = "DESC"
)

type OrganizationSwitchResponse 

type OrganizationSwitchResponse struct {
	OrganizationID       string `json:"organizationId"`
	Continuation         string `json:"continuation"`
	TokenRefreshRequired bool   `json:"tokenRefreshRequired"`
	Message              string `json:"message,omitempty"`
}

OrganizationSwitchResponse is returned after requesting a current Organization switch.

type PasswordChangeRequest 

type PasswordChangeRequest struct {
	CurrentPassword string `json:"currentPassword"`
	NewPassword     string `json:"newPassword"`
}

PasswordChangeRequest is the authenticated password-change body.

type Permission 

type Permission struct {
	ID          string  `json:"id"`
	Resource    string  `json:"resource"`
	Action      string  `json:"action"`
	Key         string  `json:"key"`
	Name        string  `json:"name"`
	Description *string `json:"description"`
	Source      string  `json:"source"`
	Version     int64   `json:"version"`
	CreatedAt   string  `json:"createdAt"`
	UpdatedAt   string  `json:"updatedAt"`
	ETag        string  `json:"-"`
}

Permission is a canonical resource:action grant and its response ETag.

type PermissionCheckResponse 

type PermissionCheckResponse struct {
	ApplicationID  string   `json:"applicationId"`
	OrganizationID string   `json:"organizationId,omitempty"`
	Permission     string   `json:"permission"`
	Allowed        bool     `json:"allowed"`
	Roles          []string `json:"roles"`
}

PermissionCheckResponse is returned by current-user permission checks.

type PermissionDefinitionDTO 

type PermissionDefinitionDTO struct {
	Resource    string `json:"resource"`
	Action      string `json:"action"`
	Description string `json:"description,omitempty"`
}

PermissionDefinitionDTO mirrors the request/response shape used by the /open/v1/apps/{cid}/permissions endpoints. It is intentionally duplicated here (rather than imported from authz) to keep the client package free of circular dependencies.

type PermissionManifest 

type PermissionManifest struct {
	ManifestID  string                          `json:"manifestId"`
	Revision    string                          `json:"revision"`
	Permissions []PermissionManifestDeclaration `json:"permissions"`
}

type PermissionManifestClient 

type PermissionManifestClient struct {
	// contains filtered or unexported fields
}

func NewPermissionManifestClient 

func NewPermissionManifestClient(cfg PermissionManifestClientConfig) (*PermissionManifestClient, error)

func (*PermissionManifestClient) ClearPermissionManifestTokenCache 

func (c *PermissionManifestClient) ClearPermissionManifestTokenCache()

func (*PermissionManifestClient) UpsertPermissionManifest 

func (c *PermissionManifestClient) UpsertPermissionManifest(ctx context.Context, manifest PermissionManifest, idempotencyKey string) (*PermissionManifestResult, error)

func (*PermissionManifestClient) ValidatePermissionManifest 

func (c *PermissionManifestClient) ValidatePermissionManifest(ctx context.Context, manifest PermissionManifest) (*PermissionManifestResult, error)

type PermissionManifestClientConfig 

type PermissionManifestClientConfig struct {
	IssuerEndpoint    string
	PortalAPIEndpoint string
	ClientID          string
	ClientSecret      string
	Timeout           time.Duration
	TokenSkew         time.Duration
	MaxRetries        int
	MaxRetryDelay     time.Duration
	HTTPClient        *http.Client
	Observer          func(PermissionManifestObservation)
}

type PermissionManifestContinueEvent 

type PermissionManifestContinueEvent struct {
	Mode    string
	Outcome string
	Status  int
	Code    string
}

type PermissionManifestCounts 

type PermissionManifestCounts struct {
	Created     int `json:"created"`
	Updated     int `json:"updated"`
	Unchanged   int `json:"unchanged"`
	Resurrected int `json:"resurrected"`
	Conflict    int `json:"conflict"`
	Drift       int `json:"drift"`
}

type PermissionManifestDeclaration 

type PermissionManifestDeclaration struct {
	Resource    string  `json:"resource"`
	Action      string  `json:"action"`
	Name        string  `json:"name"`
	Description *string `json:"description"`
}

func (PermissionManifestDeclaration) Key 

func (d PermissionManifestDeclaration) Key() string

type PermissionManifestDrift 

type PermissionManifestDrift struct {
	Key    string `json:"key"`
	Kind   string `json:"kind"`
	Source string `json:"source"`
}

type PermissionManifestError 

type PermissionManifestError struct {
	Status            int
	Code              string
	Message           string
	CorrelationID     string
	RetryAfterSeconds int
	Body              string
}

func (*PermissionManifestError) Error 

func (e *PermissionManifestError) Error() string

type PermissionManifestFailurePolicy 

type PermissionManifestFailurePolicy int
const (
	PermissionManifestFailurePolicyUnset PermissionManifestFailurePolicy = iota
	PermissionManifestFailFast
	PermissionManifestContinue
)

type PermissionManifestItem 

type PermissionManifestItem struct {
	Key       string `json:"key"`
	Operation string `json:"operation"`
	Reason    string `json:"reason"`
}

type PermissionManifestMode 

type PermissionManifestMode string
const (
	PermissionManifestValidate PermissionManifestMode = "validate"
	PermissionManifestUpsert   PermissionManifestMode = "upsert"
)

type PermissionManifestObservation 

type PermissionManifestObservation struct {
	Mode     PermissionManifestMode
	Outcome  string
	Status   int
	Duration time.Duration
}

type PermissionManifestResult 

type PermissionManifestResult struct {
	Mode        PermissionManifestMode    `json:"mode"`
	ManifestID  string                    `json:"manifestId"`
	Revision    string                    `json:"revision"`
	Fingerprint string                    `json:"fingerprint"`
	Applied     bool                      `json:"applied"`
	Results     []PermissionManifestItem  `json:"results"`
	Drift       []PermissionManifestDrift `json:"drift"`
	Counts      PermissionManifestCounts  `json:"counts"`
}

type PermissionManifestStartupMode 

type PermissionManifestStartupMode int
const (
	PermissionManifestDisabled PermissionManifestStartupMode = iota
	PermissionManifestCIValidate
	PermissionManifestDeploymentUpsert
	PermissionManifestDevelopmentStartup
)

type PermissionManifestStartupOptions 

type PermissionManifestStartupOptions struct {
	Mode            PermissionManifestStartupMode
	FailurePolicy   PermissionManifestFailurePolicy
	IdempotencyKey  string
	OnContinueError func(PermissionManifestContinueEvent)
}

type PermissionManifestStartupResult 

type PermissionManifestStartupResult struct {
	NetworkAttempted bool
	Continued        bool
	Result           *PermissionManifestResult
}

func RunPermissionManifestStartup 

func RunPermissionManifestStartup(ctx context.Context, client *PermissionManifestClient, manifest PermissionManifest, options PermissionManifestStartupOptions) (PermissionManifestStartupResult, error)

type PermissionPage 

type PermissionPage struct {
	Content []Permission              `json:"content"`
	Page    AuthorizationPageMetadata `json:"page"`
}

PermissionPage is a deterministic page of permissions.

type PortalOpenAPIClient 

type PortalOpenAPIClient struct {
	// contains filtered or unexported fields
}

PortalOpenAPIClient is a server-side M2M client for iam-portal /open/v1/**.

It obtains client_credentials machine tokens with explicit portal:openapi:read or portal:openapi:write scope, caches read/write tokens separately, and sends only Authorization: Bearer <machine_token> to Portal resource endpoints.

func NewPortalOpenAPIClient 

func NewPortalOpenAPIClient(cfg PortalOpenAPIClientConfig) (*PortalOpenAPIClient, error)

NewPortalOpenAPIClient constructs a server-side confidential Portal Open API client.

func (*PortalOpenAPIClient) CancelOrganizationInvitation 

func (c *PortalOpenAPIClient) CancelOrganizationInvitation(ctx context.Context, organizationID, invitationID string) error

CancelOrganizationInvitation uses only organization_invitations:write. Portal owns terminal-state/idempotency semantics.

func (*PortalOpenAPIClient) ClearTokenCache 

func (c *PortalOpenAPIClient) ClearTokenCache(scopes ...PortalOpenAPIScope)

ClearTokenCache clears cached read/write tokens, or only one scope when provided.

func (*PortalOpenAPIClient) CreateOrganization 

func (c *PortalOpenAPIClient) CreateOrganization(ctx context.Context, request CreateOrganizationRequest, options *OrganizationCreateOptions) (*Organization, error)

CreateOrganization uses only organizations:write and applies Idempotency-Key when supplied.

func (*PortalOpenAPIClient) CreateOrganizationInvitation 

func (c *PortalOpenAPIClient) CreateOrganizationInvitation(ctx context.Context, organizationID string, request CreateOrganizationInvitationRequest, options *OrganizationCreateOptions) (*OrganizationInvitation, error)

CreateOrganizationInvitation uses only organization_invitations:write and applies Idempotency-Key when supplied.

func (*PortalOpenAPIClient) CreatePermission 

func (c *PortalOpenAPIClient) CreatePermission(ctx context.Context, req CreatePermissionRequest, options *AuthorizationCreateOptions) (*Permission, error)

CreatePermission uses only permissions:write and validates canonical grant grammar.

func (*PortalOpenAPIClient) CreateRegistrationGrant 

func (c *PortalOpenAPIClient) CreateRegistrationGrant(ctx context.Context, request CreateRegistrationGrantRequest) (*CreatedRegistrationGrant, error)

CreateRegistrationGrant creates an EMAIL_LINK or ACCESS_CODE grant with exactly one matching proof.

func (*PortalOpenAPIClient) CreateRole 

func (c *PortalOpenAPIClient) CreateRole(ctx context.Context, req CreateRoleRequest, options *AuthorizationCreateOptions) (*Role, error)

CreateRole uses only roles:write and applies Idempotency-Key when supplied.

func (*PortalOpenAPIClient) CreateUserRole 

func (c *PortalOpenAPIClient) CreateUserRole(ctx context.Context, userID string, req CreateUserRoleRequest, options *AuthorizationCreateOptions) (*UserRoleAssignment, error)

CreateUserRole uses only user_roles:write and the typed POST assignment route.

func (*PortalOpenAPIClient) DeleteOrganization 

func (c *PortalOpenAPIClient) DeleteOrganization(ctx context.Context, organizationID string, options *OrganizationIfMatchOptions) error

DeleteOrganization uses only organizations:write and applies If-Match when supplied.

func (*PortalOpenAPIClient) DeletePermission 

func (c *PortalOpenAPIClient) DeletePermission(ctx context.Context, id, ifMatch string) error

DeletePermission uses only permissions:write and requires a strong If-Match ETag.

func (*PortalOpenAPIClient) DeleteRole 

func (c *PortalOpenAPIClient) DeleteRole(ctx context.Context, id, ifMatch string) error

DeleteRole uses only roles:write and requires a strong If-Match ETag.

func (*PortalOpenAPIClient) DeleteUserRole 

func (c *PortalOpenAPIClient) DeleteUserRole(ctx context.Context, userID, assignmentID, ifMatch string) error

DeleteUserRole uses only user_roles:write and requires If-Match.

func (*PortalOpenAPIClient) GetMachineToken 

func (c *PortalOpenAPIClient) GetMachineToken(ctx context.Context, scope PortalOpenAPIScope) (*PortalOpenAPIMachineToken, error)

GetMachineToken returns a cached or freshly requested machine token for an explicit scope.

func (*PortalOpenAPIClient) GetOrganization 

func (c *PortalOpenAPIClient) GetOrganization(ctx context.Context, organizationID string) (*Organization, error)

GetOrganization uses only organizations:read and exposes the returned ETag.

func (*PortalOpenAPIClient) GetOrganizationInvitation 

func (c *PortalOpenAPIClient) GetOrganizationInvitation(ctx context.Context, organizationID, invitationID string) (*OrganizationInvitation, error)

GetOrganizationInvitation uses only organization_invitations:read.

func (*PortalOpenAPIClient) GetOrganizationMember 

func (c *PortalOpenAPIClient) GetOrganizationMember(ctx context.Context, organizationID, membershipID string) (*OrganizationMember, error)

GetOrganizationMember uses only organization_members:read.

func (*PortalOpenAPIClient) GetPermission 

func (c *PortalOpenAPIClient) GetPermission(ctx context.Context, id string) (*Permission, error)

GetPermission uses only permissions:read and exposes the returned ETag.

func (*PortalOpenAPIClient) GetRegistrationGrant 

func (c *PortalOpenAPIClient) GetRegistrationGrant(ctx context.Context, grantID string) (*RegistrationGrant, error)

GetRegistrationGrant returns a safe grant detail using registration_grants:read.

func (*PortalOpenAPIClient) GetRole 

func (c *PortalOpenAPIClient) GetRole(ctx context.Context, id string) (*Role, error)

GetRole uses only roles:read and exposes the returned ETag.

func (*PortalOpenAPIClient) ListOrganizationInvitations 

func (c *PortalOpenAPIClient) ListOrganizationInvitations(ctx context.Context, organizationID string, options OrganizationInvitationListOptions) (*OrganizationInvitationPage, error)

ListOrganizationInvitations uses only organization_invitations:read.

func (*PortalOpenAPIClient) ListOrganizationMembers 

func (c *PortalOpenAPIClient) ListOrganizationMembers(ctx context.Context, organizationID string, options OrganizationMemberListOptions) (*OrganizationMemberPage, error)

ListOrganizationMembers uses only organization_members:read.

func (*PortalOpenAPIClient) ListOrganizations 

func (c *PortalOpenAPIClient) ListOrganizations(ctx context.Context, options OrganizationListOptions) (*OrganizationPage, error)

ListOrganizations uses only organizations:read.

func (*PortalOpenAPIClient) ListPermissions 

func (c *PortalOpenAPIClient) ListPermissions(ctx context.Context, options AuthorizationPageOptions) (*PermissionPage, error)

ListPermissions uses only permissions:read.

func (*PortalOpenAPIClient) ListRegistrationGrantRedemptions 

func (c *PortalOpenAPIClient) ListRegistrationGrantRedemptions(ctx context.Context, grantID string, page, size *int) (*RegistrationGrantRedemptionPage, error)

ListRegistrationGrantRedemptions lists masked history using its dedicated exact scope.

func (*PortalOpenAPIClient) ListRegistrationGrants 

func (c *PortalOpenAPIClient) ListRegistrationGrants(ctx context.Context, options RegistrationGrantListOptions) (*RegistrationGrantPage, error)

ListRegistrationGrants lists grants using only registration_grants:read.

func (*PortalOpenAPIClient) ListRolePermissions 

func (c *PortalOpenAPIClient) ListRolePermissions(ctx context.Context, roleID string, options AuthorizationPageOptions) (*RolePermissionBindingPage, error)

ListRolePermissions uses only role_permissions:read and exposes the role ETag.

func (*PortalOpenAPIClient) ListRoles 

func (c *PortalOpenAPIClient) ListRoles(ctx context.Context, options AuthorizationPageOptions) (*RolePage, error)

ListRoles uses only roles:read.

func (*PortalOpenAPIClient) ListUserRoles 

func (c *PortalOpenAPIClient) ListUserRoles(ctx context.Context, userID string, options AuthorizationPageOptions) (*UserRoleAssignmentPage, error)

ListUserRoles uses only user_roles:read.

func (*PortalOpenAPIClient) PauseRegistrationGrant 

func (c *PortalOpenAPIClient) PauseRegistrationGrant(ctx context.Context, grantID string) (*RegistrationGrant, error)

PauseRegistrationGrant pauses a grant using registration_grants:write.

func (*PortalOpenAPIClient) RemoveOrganizationMember 

func (c *PortalOpenAPIClient) RemoveOrganizationMember(ctx context.Context, organizationID, membershipID string) error

RemoveOrganizationMember uses only organization_members:write. Last-owner conflicts remain typed Portal errors.

func (*PortalOpenAPIClient) ReplaceRolePermissions 

func (c *PortalOpenAPIClient) ReplaceRolePermissions(ctx context.Context, roleID string, permissionIDs []string, ifMatch string) (*RolePermissionSet, error)

ReplaceRolePermissions uses only role_permissions:write and requires If-Match.

func (*PortalOpenAPIClient) RequestJSON 

func (c *PortalOpenAPIClient) RequestJSON(ctx context.Context, method, path string, body any, out any) error

RequestJSON calls a Portal /open/v1/** JSON endpoint with a bearer machine token.

GET uses portal:openapi:read. POST, PUT, PATCH, and DELETE use portal:openapi:write. The resource request never sends Basic auth, X-IAM-Client-Id, X-Application-Id, or X-App-Key.

func (*PortalOpenAPIClient) ResendOrganizationInvitation 

func (c *PortalOpenAPIClient) ResendOrganizationInvitation(ctx context.Context, organizationID, invitationID string) (*OrganizationInvitation, error)

ResendOrganizationInvitation uses only organization_invitations:write. Retry-After is preserved on PortalOpenAPIError.

func (*PortalOpenAPIClient) ResumeRegistrationGrant 

func (c *PortalOpenAPIClient) ResumeRegistrationGrant(ctx context.Context, grantID string) (*RegistrationGrant, error)

ResumeRegistrationGrant resumes a grant using registration_grants:write.

func (*PortalOpenAPIClient) RevokeRegistrationGrant 

func (c *PortalOpenAPIClient) RevokeRegistrationGrant(ctx context.Context, grantID string, reason *string) (*RegistrationGrant, error)

RevokeRegistrationGrant revokes a grant using registration_grants:write. Reason is optional.

func (*PortalOpenAPIClient) UpdateOrganization 

func (c *PortalOpenAPIClient) UpdateOrganization(ctx context.Context, organizationID string, request UpdateOrganizationRequest, options *OrganizationIfMatchOptions) (*Organization, error)

UpdateOrganization uses only organizations:write and applies If-Match when supplied.

func (*PortalOpenAPIClient) UpdateOrganizationMemberRole 

func (c *PortalOpenAPIClient) UpdateOrganizationMemberRole(ctx context.Context, organizationID, membershipID string, role OrganizationMemberRole, options *OrganizationIfMatchOptions) (*OrganizationMember, error)

UpdateOrganizationMemberRole uses only organization_members:write and applies If-Match when supplied.

func (*PortalOpenAPIClient) UpdatePermission 

func (c *PortalOpenAPIClient) UpdatePermission(ctx context.Context, id string, req UpdatePermissionRequest, ifMatch string) (*Permission, error)

UpdatePermission uses only permissions:write and requires a strong If-Match ETag.

func (*PortalOpenAPIClient) UpdateRole 

func (c *PortalOpenAPIClient) UpdateRole(ctx context.Context, id string, req UpdateRoleRequest, ifMatch string) (*Role, error)

UpdateRole uses only roles:write and requires a strong If-Match ETag.

func (*PortalOpenAPIClient) UpdateUserRole 

func (c *PortalOpenAPIClient) UpdateUserRole(ctx context.Context, userID, assignmentID string, req UpdateUserRoleRequest, ifMatch string) (*UserRoleAssignment, error)

UpdateUserRole uses only user_roles:write and requires If-Match.

type PortalOpenAPIClientConfig 

type PortalOpenAPIClientConfig struct {
	// Issuer is the IAM issuer/auth server base URL. Tokens are requested from
	// {Issuer}/oauth2/token.
	Issuer string
	// PortalEndpoint is the iam-portal base URL used for /open/v1/** resource requests.
	PortalEndpoint string
	// ClientID is the M2M confidential ApplicationClient.clientId.
	ClientID string
	// ClientSecret is the M2M confidential ApplicationClient secret. Never expose
	// it to browser or native client code.
	ClientSecret string
	// Timeout is applied when HTTPClient is nil. Default 5s.
	Timeout time.Duration
	// TokenSkew is subtracted from expires_in before caching. Default 30s.
	TokenSkew time.Duration
	// HTTPClient optionally overrides the HTTP transport. If nil, a client with
	// Timeout is created.
	HTTPClient *http.Client
}

PortalOpenAPIClientConfig configures the server-side confidential client for iam-portal /open/v1/** requests.

type PortalOpenAPIError 

type PortalOpenAPIError struct {
	Status     int
	Code       string
	Body       string
	RetryAfter string
}

PortalOpenAPIError describes a failed Portal /open/v1/** resource request.

func (*PortalOpenAPIError) Error 

func (e *PortalOpenAPIError) Error() string

func (*PortalOpenAPIError) Unwrap 

func (e *PortalOpenAPIError) Unwrap() error

Unwrap lets callers use errors.Is(err, ErrPortalOpenAPIRequest).

type PortalOpenAPIMachineToken 

type PortalOpenAPIMachineToken struct {
	AccessToken string
	Scope       PortalOpenAPIScope
	ExpiresAt   time.Time
}

PortalOpenAPIMachineToken is a cached machine token for one explicit scope.

type PortalOpenAPIScope 

type PortalOpenAPIScope string

PortalOpenAPIScope is one of the explicit M2M scopes supported by iam-portal. 

const (
	// PortalOpenAPIReadScope is the explicit client_credentials scope for read calls.
	PortalOpenAPIReadScope PortalOpenAPIScope = "portal:openapi:read"
	// PortalOpenAPIWriteScope is the explicit client_credentials scope for write calls.
	PortalOpenAPIWriteScope PortalOpenAPIScope = "portal:openapi:write"
	// RegistrationGrantsReadScope is required for registration-grant list and detail requests.
	RegistrationGrantsReadScope PortalOpenAPIScope = "registration_grants:read"
	// RegistrationGrantsWriteScope is required for registration-grant create and lifecycle requests.
	RegistrationGrantsWriteScope PortalOpenAPIScope = "registration_grants:write"
	// RegistrationGrantsRedemptionsReadScope is required for redemption-history requests.
	RegistrationGrantsRedemptionsReadScope PortalOpenAPIScope = "registration_grants:redemptions:read"
	// OrganizationsReadScope is required for Organization list and detail requests.
	OrganizationsReadScope PortalOpenAPIScope = "organizations:read"
	// OrganizationsWriteScope is required for Organization create, update, and delete requests.
	OrganizationsWriteScope PortalOpenAPIScope = "organizations:write"
	// OrganizationInvitationsReadScope is required for Organization invitation list and detail requests.
	OrganizationInvitationsReadScope PortalOpenAPIScope = "organization_invitations:read"
	// OrganizationInvitationsWriteScope is required for Organization invitation lifecycle requests.
	OrganizationInvitationsWriteScope PortalOpenAPIScope = "organization_invitations:write"
	// OrganizationMembersReadScope is required for Organization member list and detail requests.
	OrganizationMembersReadScope PortalOpenAPIScope = "organization_members:read"
	// OrganizationMembersWriteScope is required for Organization member role and removal requests.
	OrganizationMembersWriteScope PortalOpenAPIScope = "organization_members:write"
	// RolesReadScope is required for role list and detail requests.
	RolesReadScope PortalOpenAPIScope = "roles:read"
	// RolesWriteScope is required for role lifecycle requests.
	RolesWriteScope PortalOpenAPIScope = "roles:write"
	// PermissionsReadScope is required for permission list and detail requests.
	PermissionsReadScope PortalOpenAPIScope = "permissions:read"
	// PermissionsWriteScope is required for permission lifecycle requests.
	PermissionsWriteScope PortalOpenAPIScope = "permissions:write"
	// RolePermissionsReadScope is required for role binding list requests.
	RolePermissionsReadScope PortalOpenAPIScope = "role_permissions:read"
	// RolePermissionsWriteScope is required for role binding replacement.
	RolePermissionsWriteScope PortalOpenAPIScope = "role_permissions:write"
	// UserRolesReadScope is required for user assignment list requests.
	UserRolesReadScope PortalOpenAPIScope = "user_roles:read"
	// UserRolesWriteScope is required for user assignment lifecycle requests.
	UserRolesWriteScope PortalOpenAPIScope = "user_roles:write"
)

type PortalOpenAPITokenError 

type PortalOpenAPITokenError struct {
	Status int
	Code   string
	Body   string
}

PortalOpenAPITokenError describes a failed /oauth2/token request or invalid token response.

func (*PortalOpenAPITokenError) Error 

func (e *PortalOpenAPITokenError) Error() string

func (*PortalOpenAPITokenError) Unwrap 

func (e *PortalOpenAPITokenError) Unwrap() error

Unwrap lets callers use errors.Is(err, ErrPortalOpenAPIToken).

type PreparedPermissionManifest 

type PreparedPermissionManifest struct {
	Mode        PermissionManifestMode          `json:"mode"`
	ManifestID  string                          `json:"manifestId"`
	Revision    string                          `json:"revision"`
	Fingerprint string                          `json:"fingerprint"`
	Permissions []PermissionManifestDeclaration `json:"permissions"`
}

func PreparePermissionManifest 

func PreparePermissionManifest(manifest PermissionManifest, mode PermissionManifestMode) (PreparedPermissionManifest, error)

type PublicOrganizationInvitationAcceptResponse 

type PublicOrganizationInvitationAcceptResponse struct {
	Status           string `json:"status"`
	Continuation     string `json:"continuation,omitempty"`
	ApplicationID    string `json:"applicationId"`
	OrganizationID   string `json:"organizationId"`
	OrganizationName string `json:"organizationName"`
	Role             string `json:"role"`
	AcceptedAt       string `json:"acceptedAt,omitempty"`
}

PublicOrganizationInvitationAcceptResponse is the invitation accept result.

type PublicOrganizationInvitationPreview 

type PublicOrganizationInvitationPreview struct {
	ApplicationID    string `json:"applicationId"`
	ApplicationName  string `json:"applicationName"`
	OrganizationID   string `json:"organizationId"`
	OrganizationName string `json:"organizationName"`
	InviteeEmail     string `json:"inviteeEmail"`
	Role             string `json:"role"`
	Status           string `json:"status"`
	ExpiresAt        string `json:"expiresAt"`
}

PublicOrganizationInvitationPreview is the safe public invitation preview.

type RegistrationGrant 

type RegistrationGrant struct {
	ID            string                  `json:"id"`
	Type          RegistrationGrantType   `json:"type"`
	Status        RegistrationGrantStatus `json:"status"`
	DisplayName   *string                 `json:"displayName"`
	AllowedEmail  *string                 `json:"allowedEmail"`
	AllowedDomain *string                 `json:"allowedDomain"`
	ExpiresAt     *string                 `json:"expiresAt"`
	MaxUses       *int                    `json:"maxUses"`
	UsedCount     int                     `json:"usedCount"`
	SourceType    string                  `json:"sourceType"`
	CreatedAt     string                  `json:"createdAt"`
	UpdatedAt     string                  `json:"updatedAt"`
	RevokedAt     *string                 `json:"revokedAt"`
	RevokeReason  *string                 `json:"revokeReason"`
}

RegistrationGrant is a safe grant detail. It never contains a raw proof.

type RegistrationGrantListOptions 

type RegistrationGrantListOptions struct {
	Type   *RegistrationGrantType
	Status *RegistrationGrantStatus
	Search *string
	Page   *int
	Size   *int
}

RegistrationGrantListOptions filters the grant list using the API's page parameters.

type RegistrationGrantPage 

type RegistrationGrantPage struct {
	Content []RegistrationGrant           `json:"content"`
	Page    RegistrationGrantPageMetadata `json:"page"`
}

RegistrationGrantPage is a page of safe registration grants.

type RegistrationGrantPageMetadata 

type RegistrationGrantPageMetadata struct {
	Size          int   `json:"size"`
	Number        int   `json:"number"`
	TotalElements int64 `json:"totalElements"`
	TotalPages    int   `json:"totalPages"`
}

RegistrationGrantPageMetadata is the nested Spring PagedModel metadata.

type RegistrationGrantRedemption 

type RegistrationGrantRedemption struct {
	ID            string  `json:"id"`
	Result        string  `json:"result"`
	Email         *string `json:"email"`
	AuthMethod    *string `json:"authMethod"`
	IDPID         *string `json:"idpId"`
	ClientID      *string `json:"clientId"`
	RedeemedAt    string  `json:"redeemedAt"`
	FailureReason *string `json:"failureReason"`
}

RegistrationGrantRedemption is a safe masked redemption-history entry.

type RegistrationGrantRedemptionPage 

type RegistrationGrantRedemptionPage struct {
	Content []RegistrationGrantRedemption `json:"content"`
	Page    RegistrationGrantPageMetadata `json:"page"`
}

RegistrationGrantRedemptionPage is a page of safe masked redemption history.

type RegistrationGrantStatus 

type RegistrationGrantStatus string

RegistrationGrantStatus is a safe lifecycle status returned by iam-portal. 

const (
	RegistrationGrantActive   RegistrationGrantStatus = "ACTIVE"
	RegistrationGrantPaused   RegistrationGrantStatus = "PAUSED"
	RegistrationGrantRedeemed RegistrationGrantStatus = "REDEEMED"
	RegistrationGrantExpired  RegistrationGrantStatus = "EXPIRED"
	RegistrationGrantRevoked  RegistrationGrantStatus = "REVOKED"
)

type RegistrationGrantType 

type RegistrationGrantType string

RegistrationGrantType is one safe registration-grant type returned by the API. 

const (
	RegistrationGrantEmailLink     RegistrationGrantType = "EMAIL_LINK"
	RegistrationGrantAccessCode    RegistrationGrantType = "ACCESS_CODE"
	RegistrationGrantOrgInvitation RegistrationGrantType = "ORG_INVITATION"
)

type ResolveMode 

type ResolveMode int

ResolveMode controls how the SDK loads role→permission mappings. 

const (
	// ResolveOnDemand resolves permissions on the first request for a role
	// set and caches the result. This is the default.
	ResolveOnDemand ResolveMode = iota
	// ResolveFullSync pre-loads every role→permission mapping at startup.
	ResolveFullSync
)

type ResolvePermissionsRequest 

type ResolvePermissionsRequest struct {
	ClientID string   `json:"clientId"`
	Roles    []string `json:"roles"`
}

ResolvePermissionsRequest is the request body for /open/v1/permissions:resolve.

type ResolvePermissionsResponse 

type ResolvePermissionsResponse struct {
	Permissions []string `json:"permissions"`
}

ResolvePermissionsResponse is the response body for /open/v1/permissions:resolve.

type Role 

type Role struct {
	ID          string  `json:"id"`
	Key         string  `json:"key"`
	Name        string  `json:"name"`
	Description *string `json:"description"`
	System      bool    `json:"system"`
	Version     int64   `json:"version"`
	CreatedAt   string  `json:"createdAt"`
	UpdatedAt   string  `json:"updatedAt"`
	ETag        string  `json:"-"`
}

Role is an Application-scoped role and its strong response ETag.

type RolePage 

type RolePage struct {
	Content []Role                    `json:"content"`
	Page    AuthorizationPageMetadata `json:"page"`
}

RolePage is a deterministic page of roles.

type RolePermissionBinding 

type RolePermissionBinding struct {
	RoleID       string `json:"roleId"`
	PermissionID string `json:"permissionId"`
	CreatedAt    string `json:"createdAt"`
}

RolePermissionBinding describes one persisted role-permission mapping.

type RolePermissionBindingPage 

type RolePermissionBindingPage struct {
	Content []RolePermissionBinding   `json:"content"`
	Page    AuthorizationPageMetadata `json:"page"`
	ETag    string                    `json:"-"`
}

RolePermissionBindingPage is a page of mappings plus the role ETag.

type RolePermissionSet 

type RolePermissionSet struct {
	RoleID        string   `json:"roleId"`
	PermissionIDs []string `json:"permissionIds"`
	Version       int64    `json:"version"`
	ETag          string   `json:"-"`
}

RolePermissionSet is the replacement result and new role version/ETag.

type SDK 

type SDK struct {
	// contains filtered or unexported fields
}

SDK is the high-level composite used by applications. It bundles a *Client, a JWT verifier, and a permission resolver.

Applications typically construct an SDK once at startup, install its Authenticate middleware on the router and use RequirePerm on individual routes.

func New 

func New(cfg *SDKConfig) (*SDK, error)

New constructs an SDK from cfg. It:

  1. validates cfg
  2. creates an IAM client
  3. performs OIDC discovery to obtain jwks_uri
  4. builds the JWT verifier and HTTP-backed permission resolver

func (*SDK) AcceptOrganizationInvitation 

func (s *SDK) AcceptOrganizationInvitation(ctx context.Context, invitationToken, accessToken string) (*PublicOrganizationInvitationAcceptResponse, error)

AcceptOrganizationInvitation accepts or continues a public Organization invitation flow.

func (*SDK) Authenticate 

func (s *SDK) Authenticate(opts ...AuthOption) func(http.Handler) http.Handler

Authenticate returns a net/http middleware that validates the bearer JWT and injects an authz.User into the request context.

func (*SDK) ChangePassword 

func (s *SDK) ChangePassword(ctx context.Context, accessToken string, input PasswordChangeRequest) error

ChangePassword changes the current user's password with bearer auth.

func (*SDK) CheckAccountPermission 

func (s *SDK) CheckAccountPermission(ctx context.Context, accessToken, permission, organizationID string) (*PermissionCheckResponse, error)

CheckAccountPermission checks one permission through IAM.

func (*SDK) Client 

func (s *SDK) Client() *Client

Client returns the low-level HTTP client.

func (*SDK) GetAccountPermissionSummary 

func (s *SDK) GetAccountPermissionSummary(ctx context.Context, accessToken, organizationID string) (*AccountPermissionSummary, error)

GetAccountPermissionSummary resolves current-user permissions in IAM.

func (*SDK) GetAccountSecuritySummary 

func (s *SDK) GetAccountSecuritySummary(ctx context.Context, accessToken string) (*AccountSecuritySummary, error)

GetAccountSecuritySummary returns a secret-free current-user security summary.

func (*SDK) GetCurrentAccountOrganization 

func (s *SDK) GetCurrentAccountOrganization(ctx context.Context, accessToken string) (*AccountOrganization, error)

GetCurrentAccountOrganization returns the selected Organization context, if any.

func (*SDK) GetMe 

func (s *SDK) GetMe(ctx context.Context, accessToken string, opts ...UserProfileOption) (*UserProfile, error)

GetMe returns the current user's latest profile from GET /api/v1/auth/me. It uses a short local cache keyed by request user id when available, or by a SHA-256 digest of the bearer token otherwise. Authorization checks should use FromContext and resolved permissions instead of this profile response. Profile metadata is not App User authorization attributes.

func (*SDK) HasAccountOrganizationMembership 

func (s *SDK) HasAccountOrganizationMembership(ctx context.Context, accessToken, organizationID string) (bool, error)

HasAccountOrganizationMembership derives membership from the Organization list.

func (*SDK) ListAccountOrganizations 

func (s *SDK) ListAccountOrganizations(ctx context.Context, accessToken string) ([]AccountOrganization, error)

ListAccountOrganizations lists the current user's Application-scoped Organizations.

func (*SDK) ListAccountSessions 

func (s *SDK) ListAccountSessions(ctx context.Context, accessToken string) ([]SessionView, error)

ListAccountSessions lists the current user's active sessions.

func (*SDK) LogoutAccount 

func (s *SDK) LogoutAccount(ctx context.Context, accessToken, refreshToken string) error

LogoutAccount logs out the current token/session and optionally revokes a refresh token.

func (*SDK) PreviewOrganizationInvitation 

func (s *SDK) PreviewOrganizationInvitation(ctx context.Context, invitationToken string) (*PublicOrganizationInvitationPreview, error)

PreviewOrganizationInvitation returns safe public invitation metadata without bearer auth.

func (*SDK) RequestPasswordReset 

func (s *SDK) RequestPasswordReset(ctx context.Context, email, redirectURI string) error

RequestPasswordReset starts the opaque public forgot-password flow.

func (*SDK) RequireAllPerms 

func (s *SDK) RequireAllPerms(perms []authz.PermissionKey, opts ...middleware.Option) func(http.Handler) http.Handler

RequireAllPerms is shorthand for middleware.RequireAllPerms using this SDK.

func (*SDK) RequireAnyPerm 

func (s *SDK) RequireAnyPerm(perms []authz.PermissionKey, opts ...middleware.Option) func(http.Handler) http.Handler

RequireAnyPerm is shorthand for middleware.RequireAnyPerm using this SDK.

func (*SDK) RequireNoImpersonation 

func (s *SDK) RequireNoImpersonation(opts ...middleware.Option) func(http.Handler) http.Handler

RequireNoImpersonation is shorthand for middleware.RequireNoImpersonation using this SDK.

func (*SDK) RequirePerm 

func (s *SDK) RequirePerm(perm authz.PermissionKey, opts ...middleware.Option) func(http.Handler) http.Handler

RequirePerm is shorthand for middleware.RequirePerm using this SDK.

func (*SDK) RequireStepUp 

func (s *SDK) RequireStepUp(acr string, opts ...middleware.Option) func(http.Handler) http.Handler

RequireStepUp is shorthand for middleware.RequireStepUp using this SDK.

func (*SDK) ResetPassword 

func (s *SDK) ResetPassword(ctx context.Context, token, newPassword string) error

ResetPassword completes the public password reset flow.

func (*SDK) Resolver 

func (s *SDK) Resolver() authz.Resolver

Resolver returns the permission resolver.

func (*SDK) RevokeAccountSession 

func (s *SDK) RevokeAccountSession(ctx context.Context, accessToken, sessionID string) error

RevokeAccountSession revokes one session owned by the current user.

func (*SDK) RevokeOtherAccountSessions 

func (s *SDK) RevokeOtherAccountSessions(ctx context.Context, accessToken string) error

RevokeOtherAccountSessions revokes all sessions except the current token's sid.

func (*SDK) SendEmailVerification 

func (s *SDK) SendEmailVerification(ctx context.Context, email string) (*EmailVerificationResponse, error)

SendEmailVerification starts the opaque public email verification send flow.

func (*SDK) SwitchAccountOrganization 

func (s *SDK) SwitchAccountOrganization(ctx context.Context, accessToken, organizationID string) (*OrganizationSwitchResponse, error)

SwitchAccountOrganization validates membership and returns a refresh/reauth continuation.

func (*SDK) UpdateAccountProfile 

func (s *SDK) UpdateAccountProfile(ctx context.Context, accessToken string, input AccountUpdateProfileRequest) (*UserProfile, error)

UpdateAccountProfile updates safe scalar profile fields for the current user.

func (*SDK) Verifier 

func (s *SDK) Verifier() *iamjwt.Verifier

Verifier returns the JWT verifier.

func (*SDK) VerifyEmail 

func (s *SDK) VerifyEmail(ctx context.Context, token string) (*EmailVerificationResponse, error)

VerifyEmail verifies a public email-verification token.

type SDKConfig 

type SDKConfig struct {
	// Endpoint is the base URL of the IAM server, e.g. https://iam.example.com.
	Endpoint string
	// ClientID is ApplicationClient.clientId for the WEB/M2M confidential client
	// used by this server-side SDK.
	ClientID string
	// ClientSecret authenticates the WEB/M2M confidential ApplicationClient.
	ClientSecret string
	// Audience expected in JWTs. Defaults to ClientID.
	Audience string
	// Issuer expected in JWTs. Defaults to Endpoint.
	Issuer string

	// JWKSRefresh is the interval at which the JWKS is refreshed. Default 1h.
	JWKSRefresh time.Duration
	// PermissionCacheTTL is the TTL of the role→permissions cache. Default 5m.
	PermissionCacheTTL time.Duration
	// PermissionCacheMax is the maximum number of cache entries. Default 10000.
	PermissionCacheMax int64
	// UserProfileCacheTTL is the TTL for explicit /api/v1/auth/me profile lookups. Default 1m.
	UserProfileCacheTTL time.Duration
	// UserProfileCacheMax is the maximum number of user profile cache entries. Default 10000.
	UserProfileCacheMax int64
	// DisableUserProfileCache disables caching for SDK.GetMe. Client.GetMe is always uncached.
	DisableUserProfileCache bool

	ResolveMode ResolveMode
	FailMode    FailMode

	HTTPTimeout time.Duration // default 5s
	MaxRetries  int           // default 3
}

SDKConfig is the runtime configuration accepted by New.

func (*SDKConfig) Validate 

func (c *SDKConfig) Validate() error

Validate normalises defaults and returns an error for missing required fields.

type SessionView 

type SessionView struct {
	SessionID  string `json:"sessionId"`
	IPAddress  string `json:"ipAddress,omitempty"`
	UserAgent  string `json:"userAgent,omitempty"`
	DeviceID   string `json:"deviceId,omitempty"`
	CreatedAt  string `json:"createdAt"`
	LastSeenAt string `json:"lastSeenAt"`
	Current    bool   `json:"current"`
}

SessionView is the current user's session/device view.

type UpdateOrganizationRequest 

type UpdateOrganizationRequest struct {
	Name *string `json:"name,omitempty"`
	Slug *string `json:"slug,omitempty"`
}

UpdateOrganizationRequest is the strict PATCH payload. Nil fields are omitted.

type UpdatePermissionRequest 

type UpdatePermissionRequest struct {
	Name        *string `json:"name,omitempty"`
	Description *string `json:"description,omitempty"`
}

UpdatePermissionRequest is the strict permission PATCH payload.

type UpdateRoleRequest 

type UpdateRoleRequest struct {
	Key         *string `json:"key,omitempty"`
	Name        *string `json:"name,omitempty"`
	Description *string `json:"description,omitempty"`
}

UpdateRoleRequest is the strict role PATCH payload.

type UpdateUserRoleRequest 

type UpdateUserRoleRequest struct {
	Condition *UserRoleCondition `json:"condition"`
}

UpdateUserRoleRequest replaces an assignment condition.

type UserProfile 

type UserProfile struct {
	ID                  string               `json:"id,omitempty"` // legacy /api/v1/auth/me field
	UserID              string               `json:"userId"`
	ApplicationID       string               `json:"applicationId,omitempty"`
	GlobalIdentityID    string               `json:"globalIdentityId,omitempty"`
	Email               string               `json:"email"`
	EmailVerified       bool                 `json:"emailVerified"`
	Username            string               `json:"username"`
	DisplayName         string               `json:"displayName,omitempty"`
	AvatarURL           string               `json:"avatarUrl,omitempty"`
	Status              string               `json:"status"`
	CreatedAt           string               `json:"createdAt,omitempty"`
	UpdatedAt           string               `json:"updatedAt,omitempty"`
	CurrentOrganization *AccountOrganization `json:"currentOrganization,omitempty"`
	Roles               []string             `json:"roles,omitempty"` // legacy /api/v1/auth/me field
	// Metadata is /api/v1/auth/me profile metadata, not app-scoped authorization attributes.
	Metadata map[string]any `json:"metadata,omitempty"`
}

UserProfile is the response returned by GET /api/v1/auth/me/profile.

Metadata is profile metadata for display/profile reads. It is not App User authorization attributes and must not be used as an authorization source.

type UserProfileOption 

type UserProfileOption func(*userProfileOptions)

UserProfileOption configures SDK.GetMe profile lookup behavior.

func BypassProfileCache 

func BypassProfileCache() UserProfileOption

BypassProfileCache forces SDK.GetMe to call IAM even if a cached profile exists. The fresh result replaces the cached entry.

type UserRoleAssignment 

type UserRoleAssignment struct {
	ID                   string  `json:"id"`
	UserID               string  `json:"userId"`
	RoleID               string  `json:"roleId"`
	OrganizationID       *string `json:"organizationId"`
	ConditionExpression  *string `json:"conditionExpression"`
	ConditionDescription *string `json:"conditionDescription"`
	Version              int64   `json:"version"`
	CreatedAt            string  `json:"createdAt"`
	UpdatedAt            string  `json:"updatedAt"`
	ETag                 string  `json:"-"`
}

UserRoleAssignment is an Application-scoped assignment with optimistic-lock state.

type UserRoleAssignmentPage 

type UserRoleAssignmentPage struct {
	Content []UserRoleAssignment      `json:"content"`
	Page    AuthorizationPageMetadata `json:"page"`
}

UserRoleAssignmentPage is a deterministic page of assignments.

type UserRoleCondition 

type UserRoleCondition struct {
	Expression  *string `json:"expression"`
	Description *string `json:"description"`
}

UserRoleCondition carries the optional assignment expression and description.

Source Files

View all Source files

Directories

Path Synopsis
Package authz contains the permission model primitives used by the SDK: PermissionKey, PermissionDefinition, the Resolver interface that maps roles → permissions, and the context-aware HasPermission helper.
 Package authz contains the permission model primitives used by the SDK: PermissionKey, PermissionDefinition, the Resolver interface that maps roles → permissions, and the context-aware HasPermission helper.
chi module
cmd
iam-codegen command
iam-codegen generates constants locally and validates/upserts structured manifests explicitly.
 iam-codegen generates constants locally and validates/upserts structured manifests explicitly.
iam-codegen/generator
Package generator renders Go source files for declared IAM permission definitions and parses existing permission.go sources.
 Package generator renders Go source files for declared IAM permission definitions and parses existing permission.go sources.
echo module
examples
shared-permissions
Code generated by iam-codegen from iam-permission-manifest.json.
 Code generated by iam-codegen from iam-permission-manifest.json.
gin module
Package iamtest provides testing helpers for applications built on the IAM SDK: an httptest-backed mock IAM server, a MockResolver, and a context helper to inject roles/permissions into unit tests.
 Package iamtest provides testing helpers for applications built on the IAM SDK: an httptest-backed mock IAM server, a MockResolver, and a context helper to inject roles/permissions into unit tests.
Package iamjwt provides JWT verification against an IAM JWKS endpoint.
 Package iamjwt provides JWT verification against an IAM JWKS endpoint.
Package middleware provides framework-agnostic net/http middleware that wires the IAM SDK into any Go router.
 Package middleware provides framework-agnostic net/http middleware that wires the IAM SDK into any Go router.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.