Initial commit

internal/storage/roles.go

@@ -0,0 +1,47 @@
+package storage
+
+import "time"
+
+// RoleScope separates application-wide privileges from garden membership roles.
+type RoleScope string
+
+// Supported role scopes.
+const (
+	RoleScopeApplication RoleScope = "application"
+	RoleScopeGarden      RoleScope = "garden"
+)
+
+// Role is a reusable, globally defined bundle of permissions.
+type Role struct {
+	Name        string    `json:"name"`
+	Scope       RoleScope `json:"scope"`
+	GardenID    *int      `json:"garden_id,omitempty"`
+	Label       string    `json:"label"`
+	System      bool      `json:"system"`
+	Permissions []string  `json:"permissions"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
+// GardenRolePermissionOverride grants or revokes one role permission in a
+// single garden without modifying the shared role template.
+type GardenRolePermissionOverride struct {
+	GardenID   int    `json:"garden_id"`
+	RoleName   string `json:"role_name"`
+	Permission string `json:"permission"`
+	Granted    bool   `json:"granted"`
+}
+
+// RoleModelInterface manages application roles, garden role templates, and
+// garden-specific permission overrides.
+type RoleModelInterface interface {
+	List(scope RoleScope) ([]Role, error)
+	ListForGarden(gardenID int) ([]Role, error)
+	Get(name string) (Role, error)
+	GetForGarden(gardenID int, name string) (Role, error)
+	Create(role Role) (Role, error)
+	Update(role Role) (Role, error)
+	Delete(name string) error
+	ListGardenOverrides(gardenID int) ([]GardenRolePermissionOverride, error)
+	ReplaceGardenOverrides(gardenID int, roleName string, overrides []GardenRolePermissionOverride) error
+}