authzsql

package
v0.0.0-...-aa7570c Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 13, 2026 License: MIT Imports: 5 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AssignGlobalRoleToUserParams 

type AssignGlobalRoleToUserParams struct {
	UserID   uuid.UUID
	RoleName string
}

type AssignRoleToServiceAccountParams 

type AssignRoleToServiceAccountParams struct {
	ServiceAccountID uuid.UUID
	RoleName         string
}

type AssignTeamRoleToUserParams 

type AssignTeamRoleToUserParams struct {
	UserID         uuid.UUID
	RoleName       string
	TargetTeamSlug slug.Slug
}

type DBTX 

type DBTX interface {
	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
	QueryRow(context.Context, string, ...interface{}) pgx.Row
}

type GetRolesForServiceAccountsRow 

type GetRolesForServiceAccountsRow struct {
	ServiceAccountID uuid.UUID
	Roles            []byte
}

type GetRolesForUsersRow 

type GetRolesForUsersRow struct {
	UserID uuid.UUID
	Roles  []byte
}

type GitHubAuthorizationRoleCheckParams 

type GitHubAuthorizationRoleCheckParams struct {
	RoleName          string
	AuthorizationName string
}

type HasGlobalAuthorizationParams 

type HasGlobalAuthorizationParams struct {
	UserID            uuid.UUID
	AuthorizationName string
}

type HasTeamAuthorizationParams 

type HasTeamAuthorizationParams struct {
	UserID            uuid.UUID
	AuthorizationName string
	TeamSlug          slug.Slug
}

type HasTeamMembershipParams 

type HasTeamMembershipParams struct {
	UserID            uuid.UUID
	AuthorizationName string
	TeamSlug          slug.Slug
}

type ListRolesForServiceAccountParams 

type ListRolesForServiceAccountParams struct {
	ServiceAccountID uuid.UUID
	Offset           int32
	Limit            int32
}

type ListRolesParams 

type ListRolesParams struct {
	ExcludeGlobal bool
	Offset        int32
	Limit         int32
}

type Querier 

type Querier interface {
	AssignGlobalRoleToUser(ctx context.Context, arg AssignGlobalRoleToUserParams) error
	AssignRoleToServiceAccount(ctx context.Context, arg AssignRoleToServiceAccountParams) error
	AssignTeamRoleToUser(ctx context.Context, arg AssignTeamRoleToUserParams) error
	CountRoles(ctx context.Context) (int64, error)
	CountRolesForServiceAccount(ctx context.Context, serviceAccountID uuid.UUID) (int64, error)
	GetRoleByName(ctx context.Context, name string) (*Role, error)
	GetRolesForServiceAccounts(ctx context.Context, serviceAccountIds []uuid.UUID) ([]*GetRolesForServiceAccountsRow, error)
	// TODO: This should be rewritten to fetch rows from the roles table instead as it uses the authz.Role struct, which reflects rows from the roles table.
	GetRolesForUsers(ctx context.Context, userIds []uuid.UUID) ([]*GetRolesForUsersRow, error)
	GitHubAuthorizationRoleCheck(ctx context.Context, arg GitHubAuthorizationRoleCheckParams) (bool, error)
	HasGlobalAuthorization(ctx context.Context, arg HasGlobalAuthorizationParams) (bool, error)
	HasTeamAuthorization(ctx context.Context, arg HasTeamAuthorizationParams) (bool, error)
	// Strict team membership check WITHOUT admin bypass
	// Used for security-sensitive operations like elevations and reading secret values
	HasTeamMembership(ctx context.Context, arg HasTeamMembershipParams) (bool, error)
	ListRoles(ctx context.Context, arg ListRolesParams) ([]*Role, error)
	ListRolesForServiceAccount(ctx context.Context, arg ListRolesForServiceAccountParams) ([]*Role, error)
	RevokeRoleFromServiceAccount(ctx context.Context, arg RevokeRoleFromServiceAccountParams) error
	ServiceAccountCanAssignRole(ctx context.Context, arg ServiceAccountCanAssignRoleParams) (bool, error)
	ServiceAccountHasGlobalAuthorization(ctx context.Context, arg ServiceAccountHasGlobalAuthorizationParams) (bool, error)
	ServiceAccountHasRole(ctx context.Context, arg ServiceAccountHasRoleParams) (bool, error)
	ServiceAccountHasTeamAuthorization(ctx context.Context, arg ServiceAccountHasTeamAuthorizationParams) (bool, error)
	// Strict team membership check for service accounts WITHOUT admin bypass
	ServiceAccountHasTeamMembership(ctx context.Context, arg ServiceAccountHasTeamMembershipParams) (bool, error)
	UserCanAssignRole(ctx context.Context, arg UserCanAssignRoleParams) (bool, error)
}

type Queries 

type Queries struct {
	// contains filtered or unexported fields
}

func New 

func New(db DBTX) *Queries

func (*Queries) AssignGlobalRoleToUser 

func (q *Queries) AssignGlobalRoleToUser(ctx context.Context, arg AssignGlobalRoleToUserParams) error

func (*Queries) AssignRoleToServiceAccount 

func (q *Queries) AssignRoleToServiceAccount(ctx context.Context, arg AssignRoleToServiceAccountParams) error

func (*Queries) AssignTeamRoleToUser 

func (q *Queries) AssignTeamRoleToUser(ctx context.Context, arg AssignTeamRoleToUserParams) error

func (*Queries) CountRoles 

func (q *Queries) CountRoles(ctx context.Context) (int64, error)

func (*Queries) CountRolesForServiceAccount 

func (q *Queries) CountRolesForServiceAccount(ctx context.Context, serviceAccountID uuid.UUID) (int64, error)

func (*Queries) GetRoleByName 

func (q *Queries) GetRoleByName(ctx context.Context, name string) (*Role, error)

func (*Queries) GetRolesForServiceAccounts 

func (q *Queries) GetRolesForServiceAccounts(ctx context.Context, serviceAccountIds []uuid.UUID) ([]*GetRolesForServiceAccountsRow, error)

func (*Queries) GetRolesForUsers 

func (q *Queries) GetRolesForUsers(ctx context.Context, userIds []uuid.UUID) ([]*GetRolesForUsersRow, error)

TODO: This should be rewritten to fetch rows from the roles table instead as it uses the authz.Role struct, which reflects rows from the roles table.

func (*Queries) GitHubAuthorizationRoleCheck 

func (q *Queries) GitHubAuthorizationRoleCheck(ctx context.Context, arg GitHubAuthorizationRoleCheckParams) (bool, error)

func (*Queries) HasGlobalAuthorization 

func (q *Queries) HasGlobalAuthorization(ctx context.Context, arg HasGlobalAuthorizationParams) (bool, error)

func (*Queries) HasTeamAuthorization 

func (q *Queries) HasTeamAuthorization(ctx context.Context, arg HasTeamAuthorizationParams) (bool, error)

func (*Queries) HasTeamMembership 

func (q *Queries) HasTeamMembership(ctx context.Context, arg HasTeamMembershipParams) (bool, error)

Strict team membership check WITHOUT admin bypass Used for security-sensitive operations like elevations and reading secret values

func (*Queries) ListRoles 

func (q *Queries) ListRoles(ctx context.Context, arg ListRolesParams) ([]*Role, error)

func (*Queries) ListRolesForServiceAccount 

func (q *Queries) ListRolesForServiceAccount(ctx context.Context, arg ListRolesForServiceAccountParams) ([]*Role, error)

func (*Queries) RevokeRoleFromServiceAccount 

func (q *Queries) RevokeRoleFromServiceAccount(ctx context.Context, arg RevokeRoleFromServiceAccountParams) error

func (*Queries) ServiceAccountCanAssignRole 

func (q *Queries) ServiceAccountCanAssignRole(ctx context.Context, arg ServiceAccountCanAssignRoleParams) (bool, error)

func (*Queries) ServiceAccountHasGlobalAuthorization 

func (q *Queries) ServiceAccountHasGlobalAuthorization(ctx context.Context, arg ServiceAccountHasGlobalAuthorizationParams) (bool, error)

func (*Queries) ServiceAccountHasRole 

func (q *Queries) ServiceAccountHasRole(ctx context.Context, arg ServiceAccountHasRoleParams) (bool, error)

func (*Queries) ServiceAccountHasTeamAuthorization 

func (q *Queries) ServiceAccountHasTeamAuthorization(ctx context.Context, arg ServiceAccountHasTeamAuthorizationParams) (bool, error)

func (*Queries) ServiceAccountHasTeamMembership 

func (q *Queries) ServiceAccountHasTeamMembership(ctx context.Context, arg ServiceAccountHasTeamMembershipParams) (bool, error)

Strict team membership check for service accounts WITHOUT admin bypass

func (*Queries) UserCanAssignRole 

func (q *Queries) UserCanAssignRole(ctx context.Context, arg UserCanAssignRoleParams) (bool, error)

func (*Queries) WithTx 

func (q *Queries) WithTx(tx pgx.Tx) *Queries

type RevokeRoleFromServiceAccountParams 

type RevokeRoleFromServiceAccountParams struct {
	ServiceAccountID uuid.UUID
	RoleName         string
}

type Role 

type Role struct {
	Name        string
	Description string
	// If true, the role can only be assigned globally
	IsOnlyGlobal bool
}

type ServiceAccountCanAssignRoleParams 

type ServiceAccountCanAssignRoleParams struct {
	RoleName         string
	ServiceAccountID uuid.UUID
	TeamSlug         *slug.Slug
}

type ServiceAccountHasGlobalAuthorizationParams 

type ServiceAccountHasGlobalAuthorizationParams struct {
	ServiceAccountID  uuid.UUID
	AuthorizationName string
}

type ServiceAccountHasRoleParams 

type ServiceAccountHasRoleParams struct {
	ServiceAccountID uuid.UUID
	RoleName         string
}

type ServiceAccountHasTeamAuthorizationParams 

type ServiceAccountHasTeamAuthorizationParams struct {
	ServiceAccountID  uuid.UUID
	AuthorizationName string
	TeamSlug          slug.Slug
}

type ServiceAccountHasTeamMembershipParams 

type ServiceAccountHasTeamMembershipParams struct {
	ServiceAccountID  uuid.UUID
	AuthorizationName string
	TeamSlug          slug.Slug
}

type UserCanAssignRoleParams 

type UserCanAssignRoleParams struct {
	UserID         uuid.UUID
	RoleName       string
	TargetTeamSlug *slug.Slug
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.