Access Policy

package goodmem // import "fury.io/pairsys/goodmem"

Direct grants + scoped role assignments for resource access policy.

Methods are called as client.AccessPolicy().<Method>(ctx, ...) on a *goodmem.Client. Service: AccessPolicyService.

Index

type AccessPolicyService
type CheckAuthorizationsRequest
type AuthorizationCheck
type CheckAuthorizationsResponse
type AuthorizationCheckResult
type CreateAuthorizationGrantRequest
type GrantAudience
type GrantAudienceAllAuthenticated
type AuthorizationGrant
type ListAuthorizationGrantsResponse
type AssignRoleRequest
type RoleAssignmentTarget
type RoleAssignment
type Role
type ListRoleAssignmentsResponse

type AccessPolicyService

type AccessPolicyService struct{ … }

Access this service as client.AccessPolicy() on a *goodmem.Client. Its methods follow.

func (s *AccessPolicyService) Check

func (s *AccessPolicyService) Check(ctx context.Context, req *models.CheckAuthorizationsRequest) (*models.CheckAuthorizationsResponse, error)

Evaluates 1 to 50 concrete operation-and-target checks under the authenticated caller's live authority and any API-key ceiling. Results are positional and advisory: missing targets and denied operations both return allowed=false, and every later resource request performs fresh authorization. Top-level creates target INSTANCE; CREATE_MEMORY and LIST_MEMORY target their parent SPACE; reads, mutations, proxy operations, and access-policy administration target concrete resources. LIST_API_KEY and LIST_RETRIEVE_MEMORY_LOG_POLICY are rejected because their current candidate-based list rules have no instance-wide preflight.

HTTP — POST /v1/access-policy:check

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
req (*models.CheckAuthorizationsRequest) — the request payload. The linked type documents every field and its JSON wire name.

Returns — (*models.CheckAuthorizationsResponse, error)

Example

decisions, err := client.AccessPolicy().Check(ctx, &models.CheckAuthorizationsRequest{
	Checks: []models.AuthorizationCheck{
		{
			Operation: models.OperationREADINSTANCE,
			Target:    models.AccessPolicyTarget{Kind: models.ResourceKindINSTANCE},
		},
	},
})
if err != nil {
	log.Fatal(err)
}
_ = decisions.Results[0].Allowed

func (s *AccessPolicyService) GrantsCreate

func (s *AccessPolicyService) GrantsCreate(ctx context.Context, req *models.CreateAuthorizationGrantRequest) (*models.AuthorizationGrant, error)

Creates one direct grant after resolving its typed policy target and requiring MANAGE_ACCESS. Direct grants cannot confer credential-read or ownership-transfer authority. ALL_AUTHENTICATED grants require an assigned-resource selector. MANAGE_ACCESS and MANAGE_USER_ENROLLMENT require a concrete principal and ANY or EXACT; MANAGE_USER_ENROLLMENT with EXACT must target USER.

HTTP — POST /v1/access-policy/grants

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
req (*models.CreateAuthorizationGrantRequest) — the request payload. The linked type documents every field and its JSON wire name.

Returns — (*models.AuthorizationGrant, error)

Example

grant, err := client.AccessPolicy().GrantsCreate(ctx, &models.CreateAuthorizationGrantRequest{
	Audience: models.GrantAudience{
		PrincipalID: goodmem.Ptr("b3303d0a-1a4a-493f-b9bf-38e37153b5a2"),
	},
	Rule: models.AccessPolicyRule{
		Operation: models.OperationREADSPACE,
		Selector:  models.SelectorEXACT,
		AssignedResource: &models.AccessPolicyTarget{
			Kind:       models.ResourceKindSPACE,
			ResourceID: goodmem.Ptr("70e025f6-76ca-4cbe-b8fc-7dab8e84590a"),
		},
	},
})
if err != nil {
	log.Fatal(err)
}
_ = grant

func (s *AccessPolicyService) GrantsDelete

func (s *AccessPolicyService) GrantsDelete(ctx context.Context, id string) (*models.AuthorizationGrant, error)

Soft-revokes one grant and returns its durable historical row. Repeating the request is idempotent while the caller retains MANAGE_ACCESS on the target.

HTTP — DELETE /v1/access-policy/grants/{id}

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
id (string) — Grant UUID

Returns — (*models.AuthorizationGrant, error)

Example

revokedGrant, err := client.AccessPolicy().GrantsDelete(
	ctx,
	"499f5f02-22ac-479f-a913-0e7ee4bb0fb4",
)
if err != nil {
	log.Fatal(err)
}
_ = revokedGrant

func (s *AccessPolicyService) GrantsGet

func (s *AccessPolicyService) GrantsGet(ctx context.Context, id string, params *AccessPolicyGrantsGetParams) (*models.AuthorizationGrant, error)

Reads one live grant, or one revoked historical grant when includeRevoked is true, after requiring MANAGE_ACCESS on its policy target.

HTTP — GET /v1/access-policy/grants/{id}

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
id (string) — Grant UUID
params (*AccessPolicyGrantsGetParams, optional) — typed query parameters; pass nil for an empty filter set. The linked pkg.go.dev page lists every field.

Returns — (*models.AuthorizationGrant, error)

Example

fetchedGrant, err := client.AccessPolicy().GrantsGet(
	ctx,
	"499f5f02-22ac-479f-a913-0e7ee4bb0fb4",
	nil,
)
if err != nil {
	log.Fatal(err)
}
_ = fetchedGrant

func (s *AccessPolicyService) GrantsList

func (s *AccessPolicyService) GrantsList(ctx context.Context, params *AccessPolicyGrantsListParams) (*Page[models.AuthorizationGrant], error)

Lists grants attached to one resource. MANAGE_ACCESS is required on that resource; continuation tokens are bound to the caller and filters.

HTTP — GET /v1/access-policy/grants

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
params (*AccessPolicyGrantsListParams, optional) — typed query parameters; pass nil for an empty filter set. The linked pkg.go.dev page lists every field.

Returns — (*Page[models.AuthorizationGrant], error)

Example

grants, err := client.AccessPolicy().GrantsList(ctx, &goodmem.AccessPolicyGrantsListParams{
	ResourceKind: goodmem.Ptr("SPACE"),
	ResourceID:   goodmem.Ptr("70e025f6-76ca-4cbe-b8fc-7dab8e84590a"),
})
if err != nil {
	log.Fatal(err)
}
_ = grants.Items()

func (s *AccessPolicyService) RoleAssignmentsCreate

func (s *AccessPolicyService) RoleAssignmentsCreate(ctx context.Context, req *models.AssignRoleRequest) (*models.RoleAssignment, error)

Assigns one code-defined role to an active principal at INSTANCE or SPACE scope after requiring MANAGE_ACCESS. ROOT is maintained only by ownership workflows.

HTTP — POST /v1/access-policy/role-assignments

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
req (*models.AssignRoleRequest) — the request payload. The linked type documents every field and its JSON wire name.

Returns — (*models.RoleAssignment, error)

Example

assignment, err := client.AccessPolicy().RoleAssignmentsCreate(ctx, &models.AssignRoleRequest{
	PrincipalID: "b3303d0a-1a4a-493f-b9bf-38e37153b5a2",
	Role:        "SPACE_VIEWER",
	AssignedResource: models.RoleAssignmentTarget{
		Kind:       "SPACE",
		ResourceID: goodmem.Ptr("70e025f6-76ca-4cbe-b8fc-7dab8e84590a"),
	},
})
if err != nil {
	log.Fatal(err)
}
_ = assignment

func (s *AccessPolicyService) RoleAssignmentsDelete

func (s *AccessPolicyService) RoleAssignmentsDelete(ctx context.Context, id string) (*models.RoleAssignment, error)

Soft-revokes one non-ROOT assignment and returns its durable historical row. Repeating the request is idempotent while the caller retains MANAGE_ACCESS.

HTTP — DELETE /v1/access-policy/role-assignments/{id}

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
id (string) — Role-assignment UUID

Returns — (*models.RoleAssignment, error)

Example

revokedAssignment, err := client.AccessPolicy().RoleAssignmentsDelete(
	ctx,
	"3d74bbb6-bc0b-420d-baa8-b433e9476399",
)
if err != nil {
	log.Fatal(err)
}
_ = revokedAssignment

func (s *AccessPolicyService) RoleAssignmentsGet

func (s *AccessPolicyService) RoleAssignmentsGet(ctx context.Context, id string, params *AccessPolicyRoleAssignmentsGetParams) (*models.RoleAssignment, error)

Reads one live assignment, or one revoked historical assignment when includeRevoked is true, after requiring MANAGE_ACCESS on its policy target.

HTTP — GET /v1/access-policy/role-assignments/{id}

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
id (string) — Role-assignment UUID
params (*AccessPolicyRoleAssignmentsGetParams, optional) — typed query parameters; pass nil for an empty filter set. The linked pkg.go.dev page lists every field.

Returns — (*models.RoleAssignment, error)

Example

fetchedAssignment, err := client.AccessPolicy().RoleAssignmentsGet(
	ctx,
	"3d74bbb6-bc0b-420d-baa8-b433e9476399",
	nil,
)
if err != nil {
	log.Fatal(err)
}
_ = fetchedAssignment

func (s *AccessPolicyService) RoleAssignmentsList

func (s *AccessPolicyService) RoleAssignmentsList(ctx context.Context, params *AccessPolicyRoleAssignmentsListParams) (*Page[models.RoleAssignment], error)

Lists assignments attached to one required INSTANCE or SPACE boundary after requiring MANAGE_ACCESS. Continuation tokens are bound to the caller and filters.

HTTP — GET /v1/access-policy/role-assignments

Parameters

ctx (context.Context) — carries the deadline and cancellation signal for the call.
params (*AccessPolicyRoleAssignmentsListParams, optional) — typed query parameters; pass nil for an empty filter set. The linked pkg.go.dev page lists every field.

Returns — (*Page[models.RoleAssignment], error)

Example

assignments, err := client.AccessPolicy().RoleAssignmentsList(
	ctx,
	&goodmem.AccessPolicyRoleAssignmentsListParams{
		ResourceKind: goodmem.Ptr("SPACE"),
		ResourceID:   goodmem.Ptr("70e025f6-76ca-4cbe-b8fc-7dab8e84590a"),
	},
)
if err != nil {
	log.Fatal(err)
}
_ = assignments.Items()

type CheckAuthorizationsRequest

type CheckAuthorizationsRequest struct{ … }

Evaluates between 1 and 50 concrete authorization checks.

Checks ([]models.AuthorizationCheck, wire checks) — Concrete checks evaluated in request order.

type AuthorizationCheck

type AuthorizationCheck struct{ … }

One concrete, advisory authorization check. Top-level creates target INSTANCE; CREATE_MEMORY and LIST_MEMORY target a parent SPACE; ordinary resource operations target the concrete resource. LIST_API_KEY and LIST_RETRIEVE_MEMORY_LOG_POLICY are not supported by this endpoint.

Operation (models.Operation, wire operation) — Operation the caller proposes to perform.
Target (models.AccessPolicyTarget, wire target) — Target required by the operation: INSTANCE for top-level creates, parent SPACE for CREATE_MEMORY or LIST_MEMORY, otherwise the concrete resource.

type CheckAuthorizationsResponse

type CheckAuthorizationsResponse struct{ … }

Positional advisory authorization results.

Results ([]models.AuthorizationCheckResult, wire results) — Results corresponding one-for-one with the request checks.

type AuthorizationCheckResult

type AuthorizationCheckResult struct{ … }

One advisory decision; false covers both an absent target and an authorization denial.

Allowed (bool, wire allowed) — Whether the caller currently has effective authority.

type CreateAuthorizationGrantRequest

type CreateAuthorizationGrantRequest struct{ … }

Creates one live direct authorization grant.

GrantID (string, optional, wire grantId) — Optional caller-provided grant UUID.
Audience (models.GrantAudience, wire audience) — Audience receiving the grant.
Rule (models.AccessPolicyRule, wire rule) — Authorization descriptor to grant.

type GrantAudience

type GrantAudience struct{ … }

Exactly one principal or the all-authenticated audience.

PrincipalID (string, optional, wire principalId) — Active HUMAN or SERVICE principal UUID.
AllAuthenticated (models.GrantAudienceAllAuthenticated, optional, wire allAuthenticated) — Set to true to address every authenticated principal.

type GrantAudienceAllAuthenticated

type GrantAudienceAllAuthenticated string

The literal true, selecting every successfully authenticated principal.

String enum (type GrantAudienceAllAuthenticated string): "True"

type AuthorizationGrant

type AuthorizationGrant struct{ … }

Current or historical direct authorization grant.

GrantID (string, wire grantId) — Durable grant UUID.
Audience (models.GrantAudience, wire audience) — Grant audience.
Rule (models.AccessPolicyRule, wire rule) — Granted authorization descriptor.
CreatedAt (int64, wire createdAt) — Creation time in epoch milliseconds.
CreatedByID (string, wire createdById) — Exact audit actor that created the grant.
RevokedAt (int64, optional, wire revokedAt) — Revocation time in epoch milliseconds, when revoked.
RevokedByID (string, optional, wire revokedById) — Exact audit actor that revoked the grant, when revoked.

type ListAuthorizationGrantsResponse

type ListAuthorizationGrantsResponse struct{ … }

One page of direct authorization grants.

Grants ([]models.AuthorizationGrant, wire grants) — Grant rows in stable creation order.
NextToken (string, optional, wire nextToken) — Opaque continuation token, omitted on the final page.

type AssignRoleRequest

type AssignRoleRequest struct{ … }

Assigns one code-defined role at an INSTANCE or SPACE boundary.

RoleAssignmentID (string, optional, wire roleAssignmentId) — Optional caller-provided role-assignment UUID.
PrincipalID (string, wire principalId) — Active principal receiving the role.
Role (string, wire role) — Code-defined non-ROOT role to assign.
AssignedResource (models.RoleAssignmentTarget, wire assignedResource) — INSTANCE or SPACE boundary receiving the assignment.

type RoleAssignmentTarget

type RoleAssignmentTarget struct{ … }

An INSTANCE or SPACE role-assignment boundary. resourceId is omitted for INSTANCE and required for SPACE.

Kind (string, wire kind) — Role-assignment target kind.
ResourceID (string, optional, wire resourceId) — Memory-space UUID; omitted for the singleton INSTANCE target.

type RoleAssignment

type RoleAssignment struct{ … }

Current or historical scoped role assignment.

RoleAssignmentID (string, wire roleAssignmentId) — Durable role-assignment UUID.
PrincipalID (string, wire principalId) — Assigned principal UUID.
Role (models.Role, wire role) — Code-defined assigned role.
AssignedResource (models.RoleAssignmentTarget, wire assignedResource) — INSTANCE or SPACE assignment boundary.
AssignedAt (int64, wire assignedAt) — Assignment time in epoch milliseconds.
AssignedByID (string, wire assignedById) — Exact audit actor that assigned the role.
RevokedAt (int64, optional, wire revokedAt) — Revocation time in epoch milliseconds, when revoked.
RevokedByID (string, optional, wire revokedById) — Exact audit actor that revoked the assignment, when revoked.

type Role

type Role string

String enum (type Role string): "ROOT" · "ADMIN" · "USER" · "SPACE_VIEWER" · "SPACE_CONTRIBUTOR" · "SPACE_CONTENT_MANAGER" · "SPACE_ADMIN"

type ListRoleAssignmentsResponse

type ListRoleAssignmentsResponse struct{ … }

One page of scoped role assignments.

RoleAssignments ([]models.RoleAssignment, wire roleAssignments) — Role assignments in stable assignment order.
NextToken (string, optional, wire nextToken) — Opaque continuation token, omitted on the final page.

Access Policy

Equivalent REST call

Equivalent REST call

Equivalent REST call

Equivalent REST call

Equivalent REST call

Equivalent REST call

Equivalent REST call

Equivalent REST call

Equivalent REST call

On this page