Typo-proof names

wardn already rejects unknown permissions at startup. wardn gen goes one step further: when you use its constants, a misspelled permission is a compile error. (A misspelled string literal, such as Require("loan:aprove"), still compiles, and is caught at startup instead.)

Generate

Add the CLI as a tool of your module, so its version always matches the library’s:

go get -tool github.com/MogRex-Limited/wardn/cmd/wardn
go tool wardn gen                      # reads wardn.yaml, writes perm/perm.go
go tool wardn gen -o internal/authz/names.go

Or keep it next to the code that uses it:

//go:generate go tool wardn gen -f ../wardn.yaml -o perm/perm.go

Use

r.With(w.Require(perm.LoanApprove)).Post("/loans/{id}/approve", approveLoan)

w.System().Assign(ctx, userID, perm.RoleTeller, perm.ScopeBranch("lagos"))

The generated package contains:

From	Becomes
Permission loan:approve	perm.LoanApprove
Permission loan:approve_own	perm.LoanApproveOwn
Built-in wardn:roles.assign	perm.WardnRolesAssign
Role teller	perm.RoleTeller
Scope type branch	perm.ScopeBranch(id)

Descriptions from your policy become doc comments. If two names would become the same Go identifier, wardn gen stops and names both.

Keep it current in CI

go tool wardn gen -check   # fails if perm/perm.go is out of date with wardn.yaml
go tool wardn check        # fails if wardn.yaml is invalid

Nothing in a policy file can inject code into the output: identifiers are built only from characters policy names allow, values are quoted, and descriptions can’t contain line breaks.