adk_authorizer behaviour (erlang_adk v0.7.0)

View Source

Behaviour for production authentication-bound authorization policy.

Implementations receive an identity which has already been authenticated by a trusted HTTP/OIDC boundary. They must make a decision for the exact operation and resource; possession of an authenticated identity alone is not authorization.

Summary

Types

action/0
decision/0
identity/0
resource/0

Callbacks

authorize/4

Types

action/0

-type action() :: list_agents | start_run | observe_run | control_run | resume_run.

decision/0

-type decision() ::
          #{principal := binary(), user_id := binary(), owner_scope := binary(), action := action()}.

identity/0

-type identity() :: adk_jwt_policy:identity().

resource/0

-type resource() :: map().

Callbacks

authorize/4

-callback authorize(Policy :: term(), Identity :: identity(), Action :: action(), Resource :: resource()) ->
                       {ok, decision()} | {error, unauthenticated | forbidden}.