engine

type Action string

type Authorizer interface {
	// ProjectsAuthorized returns a subset of the requested projects (Projects)
	// allowed by the subjects/action/resource tuple.
	ProjectsAuthorized(context.Context, Subjects, Action, Resource, Projects) ([]string, error)

	// FilterAuthorizedProjects returns a sublist of the passed-in pairs
	// allowed by the subjects.
	FilterAuthorizedPairs(context.Context, Subjects, []Pair) ([]Pair, error)

	// FilterAuthorizedProjects returns a list of allowed projects
	// for the given subjects
	FilterAuthorizedProjects(context.Context, Subjects) ([]string, error)
}

type Engine interface {
	// Authorizer and Writer are never used together (the authz section of the
	// service needs Authorizer, the policy section cares about Writer), so we
	// collect them here instead of introducing a Engine interface.
	Authorizer
	Writer
}

type Pair struct {
	Resource Resource `json:"resource"`
	Action   Action   `json:"action"`
}

type Project string

type Projects []string

type Resource string

type Subjects []string

type Writer interface {
	SetPolicies(context.Context, map[string]interface{}, map[string]interface{}) error
}