grant

Documentation

Index

• Constants
• Variables
• type ImportFromProviderCriteria
• type Option
  • func DryRun() Option
  • func SkipNotifications() Option
  • func SkipRevokeAccessInProvider() Option
• type Service
  • func NewService(deps ServiceDeps) *Service
  • func (s *Service) BulkRevoke(ctx context.Context, filter domain.RevokeGrantsFilter, actor, reason string) ([]*domain.Grant, error)
  • func (s *Service) Create(ctx context.Context, grant *domain.Grant) error
  • func (s *Service) DormancyCheck(ctx context.Context, criteria domain.DormancyCheckCriteria) error
  • func (s *Service) GenerateExcludedGrantIDsForSmartInactiveGrants(ctx context.Context, filter domain.ListGrantsFilter) ([]string, error)
  • func (s *Service) GenerateSummary(ctx context.Context, filter domain.ListGrantsFilter) (*domain.SummaryResult, error)
  • func (s *Service) GenerateUserExcludedGrantIDsForSmartInactiveGrants(ctx context.Context, filter domain.ListGrantsFilter) ([]string, error)
  • func (s *Service) GetByID(ctx context.Context, id string) (*domain.Grant, error)
  • func (s *Service) GetGrantsTotalCount(ctx context.Context, filter domain.ListGrantsFilter) (int64, error)
  • func (s *Service) GrantDriftCheck(ctx context.Context, req domain.GrantDriftCheckRequest) error
  • func (s *Service) ImportFromProvider(ctx context.Context, criteria ImportFromProviderCriteria) ([]*domain.Grant, error)
  • func (s *Service) List(ctx context.Context, filter domain.ListGrantsFilter) ([]domain.Grant, error)
  • func (s *Service) ListUserRoles(ctx context.Context, owner string) ([]string, error)
  • func (s *Service) Prepare(ctx context.Context, appeal domain.Appeal) (*domain.Grant, error)
  • func (s *Service) Restore(ctx context.Context, id, actor, reason string) (*domain.Grant, error)
  • func (s *Service) Revoke(ctx context.Context, id, actor, reason string, opts ...Option) (*domain.Grant, error)
  • func (s *Service) SetAppealService(a appealService)
  • func (s *Service) Update(ctx context.Context, payload *domain.GrantUpdate) (*domain.Grant, error)
• type ServiceDeps

Constants

const (
	AuditKeyRevoke          = "grant.revoke"
	AuditKeyUpdate          = "grant.update"
	AuditKeyRestore         = "grant.restore"
	AuditKeyDriftRemediaton = "grant.drift_remediation"
)

Variables

var (
	ErrEmptyIDParam        = errors.New("grant id can't be empty")
	ErrGrantNotFound       = errors.New("grant not found")
	ErrEmptyImportedGrants = errors.New("imported grants not found")
	ErrEmptyOwner          = errors.New("owner can't be empty")
)

Types

type ImportFromProviderCriteria

type ImportFromProviderCriteria struct {
	ProviderID    string `validate:"required"`
	ResourceIDs   []string
	ResourceTypes []string
	ResourceURNs  []string
}

type Option

type Option func(*options)

func DryRun

func DryRun() Option

func SkipNotifications

func SkipNotifications() Option

func SkipRevokeAccessInProvider

func SkipRevokeAccessInProvider() Option

type Service

type Service struct {
	AppealService appealService
	// contains filtered or unexported fields
}

func NewService

func NewService(deps ServiceDeps) *Service

func (*Service) BulkRevoke

func (s *Service) BulkRevoke(ctx context.Context, filter domain.RevokeGrantsFilter, actor, reason string) ([]*domain.Grant, error)

func (*Service) Create

func (s *Service) Create(ctx context.Context, grant *domain.Grant) error

func (*Service) DormancyCheck

func (s *Service) DormancyCheck(ctx context.Context, criteria domain.DormancyCheckCriteria) error

func (*Service) GenerateExcludedGrantIDsForSmartInactiveGrants

func (s *Service) GenerateExcludedGrantIDsForSmartInactiveGrants(ctx context.Context, filter domain.ListGrantsFilter) ([]string, error)

GenerateExcludedGrantIDsForSmartInactiveGrants handles the group/resource/provider-scoped smart inactive grant dedup triggered by InactiveGrantPolicy=SMART InactiveGrantFilterKeys must be non-empty (and each key must have a corresponding non-empty value in the filter) to prevent accidentally fetching all grants at once. Keys in ignoredInactiveGrantFilterKeys (offset, size, order_by, statuses) are silently skipped — they are always reset in the inner queries and do not count toward the non-empty requirement. Keys in invalidInactiveGrantFilterKeys are rejected with an explicit error.

func (*Service) GenerateSummary

func (s *Service) GenerateSummary(ctx context.Context, filter domain.ListGrantsFilter) (*domain.SummaryResult, error)

func (*Service) GenerateUserExcludedGrantIDsForSmartInactiveGrants

func (s *Service) GenerateUserExcludedGrantIDsForSmartInactiveGrants(ctx context.Context, filter domain.ListGrantsFilter) ([]string, error)

func (*Service) GetByID

func (s *Service) GetByID(ctx context.Context, id string) (*domain.Grant, error)

func (*Service) GetGrantsTotalCount

func (s *Service) GetGrantsTotalCount(ctx context.Context, filter domain.ListGrantsFilter) (int64, error)

func (*Service) GrantDriftCheck

func (s *Service) GrantDriftCheck(ctx context.Context, req domain.GrantDriftCheckRequest) error

GrantDriftCheck orchestrates drift detection, remediation, and alerting for all managed bot accounts. A grant is "drifted" when Guardian records it as active but the provider no longer has the access. All findings are sent as a single summary alert to adminTeam.

func (*Service) ImportFromProvider

func (s *Service) ImportFromProvider(ctx context.Context, criteria ImportFromProviderCriteria) ([]*domain.Grant, error)

func (*Service) List

func (s *Service) List(ctx context.Context, filter domain.ListGrantsFilter) ([]domain.Grant, error)

func (*Service) ListUserRoles

func (s *Service) ListUserRoles(ctx context.Context, owner string) ([]string, error)

func (*Service) Prepare

func (s *Service) Prepare(ctx context.Context, appeal domain.Appeal) (*domain.Grant, error)

func (*Service) Restore

func (s *Service) Restore(ctx context.Context, id, actor, reason string) (*domain.Grant, error)

func (*Service) Revoke

func (s *Service) Revoke(ctx context.Context, id, actor, reason string, opts ...Option) (*domain.Grant, error)

func (*Service) SetAppealService

func (s *Service) SetAppealService(a appealService)

func (*Service) Update

func (s *Service) Update(ctx context.Context, payload *domain.GrantUpdate) (*domain.Grant, error)

type ServiceDeps

type ServiceDeps struct {
	Repository      repository
	ProviderService providerService
	ResourceService resourceService

	Notifier     notifier
	AlertManager alertManager
	Validator    *validator.Validate
	Logger       log.Logger
	AuditLogger  auditLogger
}