Module authz

Structs§

AuthzEvent: One recorded authorization change: its revision, who made it, when, and what.
AuthzHistoryReply: A page of authorization change history.
AuthzHistoryReq: Read the authorization change history for a subject, paged by revision. The audit surface the first compliance conversation opens: who granted what, when.
BindRolesReq: Bind roles to a user (replace the user’s whole role set).
BindingsReply: One user’s bound role names.
DefineRoleReq: Define or replace a role (upsert, carries the full grant set).
DeleteRoleReq: Delete a role by name.
GetBindingsReq: Request one user’s bound role names.
GetRoleReq: Request one role by name.
Grant: One capability grant: an effect on a feature:action, optionally scoped to a resource pattern.
ListRolesReply: Every matching role with its full grant set.
ListRolesReq: Request to list roles, optionally filtered. Absent filters list every role, the same bounded-registry browse as ListProjections.
ResourcePattern: A resource selector on a grant: literal, prefixed, or the whole feature.
Role: A named set of grants, bound to users. A user’s effective capability is the union of the grants of every bound role, minus any matching deny.
RoleBinding: The roles bound to one user (by the server-stamped user_id).
WhoamiReply: The caller’s bound roles and their flattened grants.
WhoamiReq: Request the caller’s own effective capabilities.

Action: The verb a grant permits, derived from the command code by feature_action.
AuthzError: An authorization command failure.
AuthzEventKind: What an AuthzEvent recorded.
AuthzReply: Reply to any authorization command, shaped per request.
AuthzSubject: Which authorization subject an AuthzHistoryReq reads the change log of.
Effect: Whether a grant permits or forbids. Deny always wins over Allow.
Feature: The managed surface a grant applies to. Maps to the command bands, so a grant on Kv is orthogonal to one on Projection.
ResourceKind: How a ResourcePattern matches a request’s resource selector.

ACTION_COUNT: The number of Action variants (including the Unrecognized catch-all): the stride of the shared coarse-capability bitmask layout (action_index). The stride must cover every action so one feature’s last action bit never collides with the next feature’s first.

action_index: The bit index of a (feature, action) in the coarse-capability bitmask, a pure function shared by every enforcer so the fork and the plane cannot drift. Feature/Action are VariantArray enums, so the ordinal is stable per wire revision.
delegated_allow: The on-behalf-of check: an agent acting for a user is permitted an op only when both its own grants and the invoking user’s grants permit it. The agent can never exceed the user who invoked it (permission intersection).
feature_action: The (feature, action) a managed command code authorizes against. None for a code with no capability semantics (hello, backend hello, client metadata, batch, and the authz band itself), which is gated another way.
grants_allow: Whether grants permit (feature, action) on resource, deny-wins. An empty set permits nothing (there is no allow to match). resource is the selector decoded from a request, or None for an unkeyed op.
validate_role_name: The canonical role-name rule, shared by the SDK, the server, and the console so a name accepted by one tier is never rejected by the next. A valid name is non-empty, at most MAX_ROLE_NAME_BYTES bytes, and made only of ASCII letters, digits, -, _, and .. Enforced on define and bind, never on replay: a journaled role loads regardless, so tightening the rule cannot strand existing state.