coder · deansheather · Apr 6, 2022 · Apr 6, 2022 · Apr 7, 2022 · Apr 7, 2022
diff --git a/coderd/access/session/actor.go b/coderd/access/session/actor.go
@@ -0,0 +1,51 @@
+package session
+
+import (
+	"github.com/coder/coder/coderd/database"
+)
+
+// ActorType is an enum of all types of Actors.
+type ActorType string
+
+// ActorTypes.
+const (
+	ActorTypeSystem    ActorType = "system"
+	ActorTypeAnonymous ActorType = "anonymous"
+	ActorTypeUser      ActorType = "user"
+)
+
+// Actor represents an unauthenticated or authenticated client accessing the
+// API. To check authorization, callers should call pass the Actor into the
+// authz package to assert access.
+type Actor interface {
+	Type() ActorType
+	// ID is the unique ID of the actor for logging purposes.
+	ID() string
+	// Name is a friendly, but consistent, name for the actor for logging
+	// purposes. E.g. "deansheather"
+	Name() string
+
+	// TODO: Steven - RBAC methods
+}
+
+// ActorTypeSystem represents the system making an authenticated request against
+// itself. This should be used if a function requires an Actor but you need to
+// skip authorization.
+type SystemActor interface {
+	Actor
+	System()
+}
+
+// AnonymousActor represents an unauthenticated API client.
+type AnonymousActor interface {
+	Actor
+	Anonymous()
+}
+
+// UserActor represents an authenticated user actor. Any consumers that wish to
+// check if the actor is a user (and access user fields such as User.ID) can
+// do a checked type cast from Actor to UserActor.
+type UserActor interface {
+	Actor
+	User() *database.User
+}
diff --git a/coderd/access/session/anonymous.go b/coderd/access/session/anonymous.go
@@ -0,0 +1,20 @@
+package session
+
+type anonymousActor struct{}
+
+// Anon is a static AnonymousActor implementation.
+var Anon AnonymousActor = anonymousActor{}
+
+func (anonymousActor) Type() ActorType {
+	return ActorTypeAnonymous
+}
+
+func (anonymousActor) ID() string {
+	return "anon"
+}
+
+func (anonymousActor) Name() string {
+	return "anonymous"
+}
+
+func (anonymousActor) Anonymous() {}
diff --git a/coderd/access/session/doc.go b/coderd/access/session/doc.go
@@ -0,0 +1,4 @@
+// Package session provides session authentication via middleware for the Coder
+// HTTP API. It also exposes the Actor type, which is the intermediary layer
+// between identity and RBAC authorization.
+package session
diff --git a/coderd/access/session/system.go b/coderd/access/session/system.go
@@ -0,0 +1,20 @@
+package session
+
+type systemActor struct{}
+
+// System is a static SystemActor implementation.
+var System SystemActor = systemActor{}
+
+func (systemActor) Type() ActorType {
+	return ActorTypeSystem
+}
+
+func (systemActor) ID() string {
+	return "system"
+}
+
+func (systemActor) Name() string {
+	return "system"
+}
+
+func (systemActor) System() {}
diff --git a/coderd/access/session/user.go b/coderd/access/session/user.go
@@ -0,0 +1,31 @@
+package session
+
+import "github.com/coder/coder/coderd/database"
+
+type userActor struct {
+	user *database.User
+}
+
+var _ UserActor = &userActor{}
+
+func NewUserActor(u *database.User) UserActor {
+	return &userActor{
+		user: u,
+	}
+}
+
+func (*userActor) Type() ActorType {
+	return ActorTypeUser
+}
+
+func (ua *userActor) ID() string {
+	return ua.user.ID.String()
+}
+
+func (ua *userActor) Name() string {
+	return ua.user.Username
+}
+
+func (ua *userActor) User() *database.User {
+	return ua.user
+}