chore(release): prepare for v0.3.0

Add support for the salary privilege in the privilege handler. 
Implement associated logic to process and validate the 
salary privilege in the test cases. Update the data 
structures to include the new privilege and ensure 
correct functionality in the privilege processing flow.

.gitlab-ci.yml

@@ -1,41 +1,38 @@
-variables:
-  GOCACHE: "${CI_PROJECT_DIR}/_go/cache"
+include:
+- template: 'Workflows/MergeRequest-Pipelines.gitlab-ci.yml'
+- project: unboundsoftware/ci-templates
+  file: Defaults.gitlab-ci.yml
+- project: unboundsoftware/ci-templates
+  file: Release.gitlab-ci.yml
+- project: unboundsoftware/ci-templates
+  file: Pre-Commit-Go.gitlab-ci.yml
 
-before_script:
-  - mkdir -p ${CI_PROJECT_DIR}/_go/{pkg,bin,cache}
-  - rm -rf /go/pkg || true
-  - mkdir -p /go
-  - ln -s ${CI_PROJECT_DIR}/_go/pkg /go/pkg
-  - ln -s ${CI_PROJECT_DIR}/_go/bin /go/bin
-
-cache:
-  key: "$CI_COMMIT_REF_NAME"
-  paths:
-    - _go
-  untracked: true
+image: amd64/golang:1.25.1@sha256:70de49a6a9bfd1bde2b332fde29d04a8cc65047464fa97ddb94251b05e572bc0
 
 stages:
-  - deps
-  - test
+- deps
+- test
 
 deps:
   stage: deps
-  image: golang:1.13
   script:
-    - go get -mod=readonly
+  - go mod download
 
 test:
   stage: test
   dependencies:
-    - deps
-  image: golang:1.13
+  - deps
   script:
-    - go fmt $(go list ./...)
-    - go vet $(go list ./...)
-    - unset "${!CI@}"
-    - CGO_ENABLED=1 go test -p 1 -mod=readonly -race -coverprofile=.testCoverage.txt -covermode=atomic -coverpkg=$(go list ./... | tr '\n' , | sed 's/,$//') ./...
-    - go tool cover -html=.testCoverage.txt -o coverage.html
-    - go tool cover -func=.testCoverage.txt
-  artifacts:
-    paths:
-      - coverage.html
+  - CGO_ENABLED=1 go test -mod=readonly -race -coverprofile=coverage.txt -covermode=atomic -coverpkg=$(go list ./... | tr '\n' , | sed 's/,$//') ./...
+  - go tool cover -html=coverage.txt -o coverage.html
+  - go tool cover -func=coverage.txt
+  - curl -Os https://uploader.codecov.io/latest/linux/codecov
+  - chmod +x codecov
+  - ./codecov -t ${CODECOV_TOKEN} -R $CI_PROJECT_DIR -C $CI_COMMIT_SHA -r $CI_PROJECT_PATH
+
+vulnerabilities:
+  stage: test
+  image: amd64/golang:1.25.1@sha256:70de49a6a9bfd1bde2b332fde29d04a8cc65047464fa97ddb94251b05e572bc0
+  script:
+  - go install golang.org/x/vuln/cmd/govulncheck@latest
+  - govulncheck ./...

.golangci.yml

@@ -0,0 +1,22 @@
+version: "2"
+run:
+  allow-parallel-runners: true
+linters:
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

.pre-commit-config.yaml

@@ -0,0 +1,46 @@
+# See https://pre-commit.com for more information
+# See https://pre-commit.com/hooks.html for more hooks
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v6.0.0
+  hooks:
+  - id: trailing-whitespace
+  - id: end-of-file-fixer
+  - id: check-yaml
+    args:
+    - --allow-multiple-documents
+  - id: check-added-large-files
+- repo: https://gitlab.com/devopshq/gitlab-ci-linter
+  rev: v1.0.6
+  hooks:
+  - id: gitlab-ci-linter
+    args:
+    - --project
+    - unboundsoftware/shiny/authz_client
+- repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
+  rev: v9.22.0
+  hooks:
+  - id: commitlint
+    stages: [ commit-msg ]
+    additional_dependencies: [ '@commitlint/config-conventional' ]
+- repo: https://github.com/dnephin/pre-commit-golang
+  rev: v0.5.1
+  hooks:
+  - id: go-mod-tidy
+  - id: go-imports
+    args:
+    - -local
+    - gitlab.com/unboundsoftware/shiny/authz_client
+- repo: https://github.com/lietu/go-pre-commit
+  rev: v0.1.0
+  hooks:
+  - id: go-test
+  - id: gofumpt
+- repo: https://github.com/golangci/golangci-lint
+  rev: v2.4.0
+  hooks:
+  - id: golangci-lint-full
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.28.0
+  hooks:
+  - id: gitleaks

CHANGELOG.md

@@ -0,0 +1,182 @@
+## [0.3.0] - 2025-09-06
+
+### 🚀 Features
+
+- *(ci)* Add defaults pipeline template for CI workflow
+- Add salary privilege to privilege management system
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/sparetimecoders/goamqp to v0.3.3
+- *(deps)* Update module github.com/stretchr/testify to v1.11.0
+- *(deps)* Update module github.com/stretchr/testify to v1.11.1
+## [0.2.0] - 2025-04-11
+
+### 🚀 Features
+
+- Add timeout configuration to golangci-lint
+- Add setup method for privilege event consumers
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/stretchr/testify to v1.10.0
+- *(ci)* Update go image to amd64 architecture version
+- *(deps)* Update module github.com/sparetimecoders/goamqp to v0.3.2
+
+### 🚜 Refactor
+
+- *(ci)* Remove pre-commit job and add new template
+## [0.1.4] - 2024-10-05
+
+### 🐛 Bug Fixes
+
+- *(deps)* Update module github.com/stretchr/testify to v1.9.0
+- *(deps)* Update module github.com/sparetimecoders/goamqp to v0.3.1
+
+### 💼 Other
+
+- *(deps)* Bump github.com/sparetimecoders/goamqp from 0.2.1 to 0.3.0
+
+### ⚙️ Miscellaneous Tasks
+
+- Update to Go 1.21.6
+- Update to Go 1.22.0
+- Add gitleaks to pre-commit setup
+- Update golangci-lint to use full version
+- Add release flow
+- Remove old release job
+## [0.1.3] - 2023-12-26
+
+### 🐛 Bug Fixes
+
+- Prohibit concurrent read/write
+
+### 💼 Other
+
+- *(deps)* Bump github.com/sparetimecoders/goamqp from 0.1.4 to 0.1.5
+- *(deps)* Bump github.com/sparetimecoders/goamqp from 0.1.5 to 0.2.0
+- *(deps)* Bump github.com/sparetimecoders/goamqp from 0.2.0 to 0.2.1
+
+### ⚙️ Miscellaneous Tasks
+
+- Update Go version
+- Make releases handle multi-line release notes
+- Update to Go 1.20.7
+- Update pre-commit versions
+- Update to Golang 1.21.0
+- Update to Go 1.21.1 for vulnerabilities
+- Use 1.21.1 in go.mod for Dependabot
+- Update to go 1.21.3 and remove patch level
+- Update version of Go
+## [0.1.2] - 2023-06-04
+
+### 💼 Other
+
+- *(deps)* Bump github.com/stretchr/testify from 1.8.2 to 1.8.3
+- *(deps)* Bump github.com/stretchr/testify from 1.8.3 to 1.8.4
+
+### ⚙️ Miscellaneous Tasks
+
+- Update pre-commit and fix golangci-lint
+- Update golangci-lint
+## [0.1.1] - 2023-05-11
+
+### 🐛 Bug Fixes
+
+- Run builds with Go 1.19.2 to fix vulnerabilities
+
+### 💼 Other
+
+- *(deps)* Bump github.com/stretchr/testify from 1.8.0 to 1.8.1
+- *(deps)* Bump github.com/sparetimecoders/goamqp from 0.1.1 to 0.1.2
+- *(deps)* Bump github.com/sparetimecoders/goamqp from 0.1.2 to 0.1.3
+- *(deps)* Bump github.com/stretchr/testify from 1.8.1 to 1.8.2
+- *(deps)* Bump github.com/sparetimecoders/goamqp from 0.1.3 to 0.1.4
+
+### ⚙️ Miscellaneous Tasks
+
+- Add vulnerability-check
+- Replace deprecated ioutil.ReadAll
+- Add pre-commit and remove those checks from test step
+- Add local module to pre-commit config
+- Add release handling
+- Update to Go 1.19.5
+- Change dependabot rebase strategy
+- Update to golang 1.20.1
+- Update Go verion for vulnerabilities scan
+- Update to Go 1.20.3
+- Update Go version and fix gitlabci lint
+## [0.1.0] - 2022-07-20
+
+### 🐛 Bug Fixes
+
+- Pipeline
+
+### 💼 Other
+
+- Add params to codecov
+- *(deps)* Bump github.com/stretchr/testify from 1.7.0 to 1.7.1
+- *(deps)* Bump gitlab.com/sparetimecoders/goamqp from 0.4.0 to 0.5.0
+- *(deps)* Bump github.com/stretchr/testify from 1.7.1 to 1.7.2
+- *(deps)* Bump github.com/stretchr/testify from 1.7.2 to 1.7.4
+- *(deps)* Bump github.com/stretchr/testify from 1.7.4 to 1.7.5
+- *(deps)* Bump github.com/stretchr/testify from 1.7.5 to 1.8.0
+
+### ⚙️ Miscellaneous Tasks
+
+- Add dependabot config
+- Remove dependabot-standalone
+- Change to codecov binary instead of bash uploader
+- Switch to moved goamqp
+## [0.0.8] - 2021-05-15
+
+### ⚙️ Miscellaneous Tasks
+
+- Add codecov upload
+- Simplify pipeline
+- Change coverage badge to codecov.io
+- Add CI workflows
+- Rename master -> main
+- Group imports
+- Update to latest version of goamqp
+## [0.0.7] - 2020-04-12
+
+### 🐛 Bug Fixes
+
+- Update to Go 1.14 to fix test errors
+- Use go mod download
+- Sort companies before comparing since map-iteration is not stable
+## [0.0.6] - 2020-04-12
+
+### 🐛 Bug Fixes
+
+- Path to repo
+
+### ⚙️ Miscellaneous Tasks
+
+- Add tests
+- Modify event structure
+## [0.0.5] - 2019-12-31
+
+### 🚀 Features
+
+- Add handling of removed privilege
+## [0.0.4] - 2019-12-08
+
+### 🚀 Features
+
+- Add name and registration number to event
+## [0.0.3] - 2019-11-22
+
+### 🐛 Bug Fixes
+
+- Print unexpected messages
+## [0.0.2] - 2019-11-06
+
+### 🚀 Features
+
+- Initial version
+
+### 🐛 Bug Fixes
+
+- Rename module

README.md

@@ -1,3 +1,4 @@
 # Shiny authz-client
 
-[![Build Status](https://gitlab.com/unboundsoftware/shiny/authz-client/badges/master/pipeline.svg)](https://gitlab.com/unboundsoftware/shiny/authz-client/commits/master)[![coverage report](https://gitlab.com/unboundsoftware/shiny/authz-client/badges/master/coverage.svg)](https://gitlab.com/unboundsoftware/shiny/authz-client/commits/master)
+[![Build Status](https://gitlab.com/unboundsoftware/shiny/authz_client/badges/main/pipeline.svg)](https://gitlab.com/unboundsoftware/shiny/authz_client/commits/main)
+[![codecov](https://codecov.io/gl/unboundsoftware:shiny/authz_client/branch/main/graph/badge.svg?token=AQS7QVLCEQ)](https://codecov.io/gl/unboundsoftware:shiny/authz_client)

client.go

@@ -3,9 +3,12 @@ package client
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"reflect"
+	"sync"
+
+	"github.com/sparetimecoders/goamqp"
 )
 
 // CompanyPrivileges contains the privileges for a combination of email address and company id
@@ -17,36 +20,15 @@ type CompanyPrivileges struct {
 	Invoicing  bool `json:"invoicing"`
 	Accounting bool `json:"accounting"`
 	Supplier   bool `json:"supplier"`
-}
-
-// PrivilegeAdded is the event sent when a new privilege is added
-type PrivilegeAdded struct {
-	Email              string `json:"email"`
-	CompanyID          string `json:"companyId"`
-	Name               string `json:"name"`
-	RegistrationNumber string `json:"registrationNumber"`
-	Admin              bool   `json:"admin"`
-	Company            bool   `json:"company"`
-	Consumer           bool   `json:"consumer"`
-	Time               bool   `json:"time"`
-	Invoicing          bool   `json:"invoicing"`
-	Accounting         bool   `json:"accounting"`
-	Supplier           bool   `json:"supplier"`
-}
-
-// PrivilegeRemoved is the event sent when a privilege is removed
-type PrivilegeRemoved struct {
-	Email              string `json:"email"`
-	CompanyID          string `json:"companyId"`
-	Name               string `json:"name"`
-	RegistrationNumber string `json:"registrationNumber"`
+	Salary     bool `json:"salary"`
 }
 
 // PrivilegeHandler processes PrivilegeAdded-events and fetches the initial set of privileges from an authz-service
 type PrivilegeHandler struct {
+	*sync.RWMutex
 	client     *http.Client
 	baseURL    string
-	privileges map[string]map[string]CompanyPrivileges
+	privileges map[string]map[string]*CompanyPrivileges
 }
 
 // OptsFunc is used to configure the PrivilegeHandler
@@ -62,9 +44,10 @@ func WithBaseURL(url string) OptsFunc {
 // New creates a new PrivilegeHandler. Pass OptsFuncs to configure.
 func New(opts ...OptsFunc) *PrivilegeHandler {
 	handler := &PrivilegeHandler{
+		RWMutex:    &sync.RWMutex{},
 		client:     &http.Client{},
 		baseURL:    "http://authz-service",
-		privileges: map[string]map[string]CompanyPrivileges{},
+		privileges: map[string]map[string]*CompanyPrivileges{},
 	}
 	for _, opt := range opts {
 		opt(handler)
@@ -79,11 +62,13 @@ func (h *PrivilegeHandler) Fetch() error {
 		return err
 	}
 
-	buff, err := ioutil.ReadAll(resp.Body)
+	buff, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return err
 	}
 
+	h.RLock()
+	defer h.RUnlock()
 	err = json.Unmarshal(buff, &h.privileges)
 	if err != nil {
 		return err
@@ -91,52 +76,91 @@ func (h *PrivilegeHandler) Fetch() error {
 	return nil
 }
 
+func (h *PrivilegeHandler) Setup() []goamqp.Setup {
+	return []goamqp.Setup{
+		goamqp.TransientEventStreamConsumer("User.Added", h.Process, UserAdded{}),
+		goamqp.TransientEventStreamConsumer("User.Removed", h.Process, UserRemoved{}),
+		goamqp.TransientEventStreamConsumer("Privilege.Added", h.Process, PrivilegeAdded{}),
+		goamqp.TransientEventStreamConsumer("Privilege.Removed", h.Process, PrivilegeRemoved{}),
+	}
+}
+
 // Process privilege-related events and update the internal state
-func (h *PrivilegeHandler) Process(msg interface{}) bool {
+func (h *PrivilegeHandler) Process(msg interface{}, _ goamqp.Headers) (interface{}, error) {
 	switch ev := msg.(type) {
+	case *UserAdded:
+		if priv, exists := h.privileges[ev.Email]; exists {
+			priv[ev.CompanyID] = &CompanyPrivileges{}
+		} else {
+			h.Lock()
+			defer h.Unlock()
+			h.privileges[ev.Email] = map[string]*CompanyPrivileges{
+				ev.CompanyID: {},
+			}
+		}
+		return nil, nil
+	case *UserRemoved:
+		if priv, exists := h.privileges[ev.Email]; exists {
+			h.Lock()
+			defer h.Unlock()
+			delete(priv, ev.CompanyID)
+		}
+		return nil, nil
 	case *PrivilegeAdded:
-		h.setPrivileges(ev)
-		return true
+		h.Lock()
+		defer h.Unlock()
+		h.setPrivileges(ev.Email, ev.CompanyID, ev.Privilege, true)
+		return nil, nil
 	case *PrivilegeRemoved:
-		h.removePrivileges(ev)
-		return true
+		h.Lock()
+		defer h.Unlock()
+		h.setPrivileges(ev.Email, ev.CompanyID, ev.Privilege, false)
+		return nil, nil
 	default:
 		fmt.Printf("Got unexpected message type (%s): '%+v'\n", reflect.TypeOf(msg).String(), msg)
-		return false
+		return nil, fmt.Errorf("unexpected event type: '%s'", reflect.TypeOf(msg))
 	}
 }
 
-func (h *PrivilegeHandler) setPrivileges(ev *PrivilegeAdded) {
-	if priv, exists := h.privileges[ev.Email]; exists {
-		priv[ev.CompanyID] = CompanyPrivileges{
-			Admin:      ev.Admin,
-			Company:    ev.Company,
-			Consumer:   ev.Consumer,
-			Time:       ev.Time,
-			Invoicing:  ev.Invoicing,
-			Accounting: ev.Accounting,
-			Supplier:   ev.Supplier,
+func (h *PrivilegeHandler) setPrivileges(email, companyId string, privilege Privilege, set bool) {
+	if priv, exists := h.privileges[email]; exists {
+		if c, exists := priv[companyId]; exists {
+			switch privilege {
+			case PrivilegeAdmin:
+				c.Admin = set
+			case PrivilegeCompany:
+				c.Company = set
+			case PrivilegeConsumer:
+				c.Consumer = set
+			case PrivilegeTime:
+				c.Time = set
+			case PrivilegeInvoicing:
+				c.Invoicing = set
+			case PrivilegeAccounting:
+				c.Accounting = set
+			case PrivilegeSupplier:
+				c.Supplier = set
+			case PrivilegeSalary:
+				c.Salary = set
+			}
+		} else {
+			priv[companyId] = &CompanyPrivileges{}
+			h.setPrivileges(email, companyId, privilege, set)
 		}
 	} else {
-		h.privileges[ev.Email] = map[string]CompanyPrivileges{
-			ev.CompanyID: {},
-		}
-		h.setPrivileges(ev)
-	}
-}
-
-func (h *PrivilegeHandler) removePrivileges(ev *PrivilegeRemoved) {
-	if priv, exists := h.privileges[ev.Email]; exists {
-		delete(priv, ev.CompanyID)
+		h.privileges[email] = map[string]*CompanyPrivileges{}
+		h.setPrivileges(email, companyId, privilege, set)
 	}
 }
 
 // CompaniesByUser return a slice of company ids matching the provided email and predicate func
 func (h *PrivilegeHandler) CompaniesByUser(email string, predicate func(privileges CompanyPrivileges) bool) []string {
+	h.RLock()
+	defer h.RUnlock()
 	var result []string
 	if p, exists := h.privileges[email]; exists {
 		for k, v := range p {
-			if predicate(v) {
+			if predicate(*v) {
 				result = append(result, k)
 			}
 		}
@@ -146,9 +170,11 @@ func (h *PrivilegeHandler) CompaniesByUser(email string, predicate func(privileg
 
 // IsAllowed return true if the provided predicate return true for the privileges matching the provided email and companyID, return false otherwise
 func (h *PrivilegeHandler) IsAllowed(email, companyID string, predicate func(privileges CompanyPrivileges) bool) bool {
+	h.RLock()
+	defer h.RUnlock()
 	if p, exists := h.privileges[email]; exists {
 		if v, exists := p[companyID]; exists {
-			return predicate(v)
+			return predicate(*v)
 		}
 	}
 

client_test.go

@@ -2,18 +2,97 @@ package client
 
 import (
 	"fmt"
-	"github.com/stretchr/testify/assert"
 	"net/http"
 	"net/http/httptest"
+	"sort"
 	"testing"
+
+	"github.com/sparetimecoders/goamqp"
+	"github.com/stretchr/testify/assert"
 )
 
 func TestPrivilegeHandler_Process_InvalidType(t *testing.T) {
 	handler := New(WithBaseURL("base"))
 
-	result := handler.Process("abc")
+	result, err := handler.Process("abc", goamqp.Headers{})
 
-	assert.False(t, result)
+	assert.Nil(t, result)
+	assert.EqualError(t, err, "unexpected event type: 'string'")
+}
+
+func TestPrivilegeHandler_Process_PrivilegeRemoved(t *testing.T) {
+	handler := New(WithBaseURL("base"))
+
+	result, err := handler.Process(&PrivilegeAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+		Privilege: PrivilegeAdmin,
+	}, goamqp.Headers{})
+	assert.Nil(t, result)
+	assert.NoError(t, err)
+
+	companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+		return privileges.Admin
+	})
+
+	assert.Equal(t, []string{"abc-123"}, companies)
+
+	result, err = handler.Process(&PrivilegeRemoved{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+		Privilege: PrivilegeAdmin,
+	}, goamqp.Headers{})
+	assert.Nil(t, result)
+	assert.NoError(t, err)
+
+	companies = handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+		return privileges.Admin
+	})
+
+	assert.Empty(t, companies)
+}
+
+func TestPrivilegeHandler_Process_UserAdded_And_UserRemoved(t *testing.T) {
+	handler := New(WithBaseURL("base"))
+
+	result, err := handler.Process(&UserAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+	}, goamqp.Headers{})
+	assert.Nil(t, result)
+	assert.NoError(t, err)
+
+	result, err = handler.Process(&UserAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-456",
+	}, goamqp.Headers{})
+	assert.Nil(t, result)
+	assert.NoError(t, err)
+
+	companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+		return true
+	})
+	sort.Strings(companies)
+	assert.Equal(t, []string{"abc-123", "abc-456"}, companies)
+
+	result, err = handler.Process(&UserRemoved{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+	}, goamqp.Headers{})
+	assert.Nil(t, result)
+	assert.NoError(t, err)
+
+	result, err = handler.Process(&UserRemoved{
+		Email:     "jim@example.org",
+		CompanyID: "abc-456",
+	}, goamqp.Headers{})
+	assert.Nil(t, result)
+	assert.NoError(t, err)
+
+	companies = handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+		return true
+	})
+	assert.Empty(t, companies)
 }
 
 func TestPrivilegeHandler_GetCompanies_Email_Not_Found(t *testing.T) {
@@ -29,41 +108,48 @@ func TestPrivilegeHandler_GetCompanies_Email_Not_Found(t *testing.T) {
 func TestPrivilegeHandler_GetCompanies_No_Companies_Found(t *testing.T) {
 	handler := New(WithBaseURL("base"))
 
-	result := handler.Process(&PrivilegeAdded{
-		Email:      "jim@example.org",
-		CompanyID:  "abc-123",
-		Admin:      false,
-		Company:    false,
-		Consumer:   false,
-		Time:       false,
-		Invoicing:  false,
-		Accounting: false,
-		Supplier:   false,
-	})
-	assert.True(t, result)
+	result, err := handler.Process(&UserAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+	}, goamqp.Headers{})
+	assert.Nil(t, result)
+	assert.NoError(t, err)
 
 	companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
 		return privileges.Admin
 	})
 
 	assert.Empty(t, companies)
+
+	companies = handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+		return true
+	})
+
+	assert.Equal(t, []string{"abc-123"}, companies)
+
+	result, err = handler.Process(&UserRemoved{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+	}, goamqp.Headers{})
+	assert.Nil(t, result)
+	assert.NoError(t, err)
+
+	companies = handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
+		return true
+	})
+	assert.Empty(t, companies)
 }
 
 func TestPrivilegeHandler_GetCompanies_Company_With_Company_Access_Found(t *testing.T) {
 	handler := New(WithBaseURL("base"))
 
-	result := handler.Process(&PrivilegeAdded{
-		Email:      "jim@example.org",
-		CompanyID:  "abc-123",
-		Admin:      false,
-		Company:    true,
-		Consumer:   false,
-		Time:       false,
-		Invoicing:  false,
-		Accounting: false,
-		Supplier:   false,
-	})
-	assert.True(t, result)
+	result, err := handler.Process(&PrivilegeAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+		Privilege: PrivilegeCompany,
+	}, goamqp.Headers{})
+	assert.Nil(t, result)
+	assert.NoError(t, err)
 
 	companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
 		return privileges.Company
@@ -75,26 +161,95 @@ func TestPrivilegeHandler_GetCompanies_Company_With_Company_Access_Found(t *test
 func TestPrivilegeHandler_GetCompanies_Company_With_Admin_Access_Found(t *testing.T) {
 	handler := New(WithBaseURL("base"))
 
-	result := handler.Process(&PrivilegeAdded{
-		Email:      "jim@example.org",
-		CompanyID:  "abc-123",
-		Admin:      true,
-		Company:    false,
-		Consumer:   false,
-		Time:       false,
-		Invoicing:  false,
-		Accounting: false,
-		Supplier:   false,
-	})
-	assert.True(t, result)
+	result, err := handler.Process(&PrivilegeAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+		Privilege: PrivilegeConsumer,
+	}, goamqp.Headers{})
+	assert.Nil(t, result)
+	assert.NoError(t, err)
 
 	companies := handler.CompaniesByUser("jim@example.org", func(privileges CompanyPrivileges) bool {
-		return privileges.Admin
+		return privileges.Consumer
 	})
 
 	assert.Equal(t, []string{"abc-123"}, companies)
 }
 
+func TestPrivilegeHandler_IsAllowed_Return_False_If_No_Privileges(t *testing.T) {
+	handler := New(WithBaseURL("base"))
+
+	result := handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
+		return privileges.Company
+	})
+
+	assert.False(t, result)
+}
+
+func TestPrivilegeHandler_IsAllowed_Return_True_If_Privilege_Exists(t *testing.T) {
+	handler := New(WithBaseURL("base"))
+
+	_, _ = handler.Process(&PrivilegeAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+		Privilege: PrivilegeTime,
+	}, goamqp.Headers{})
+
+	result := handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
+		return privileges.Time
+	})
+
+	assert.True(t, result)
+
+	_, _ = handler.Process(&PrivilegeAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+		Privilege: PrivilegeInvoicing,
+	}, goamqp.Headers{})
+
+	result = handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
+		return privileges.Invoicing
+	})
+
+	assert.True(t, result)
+
+	_, _ = handler.Process(&PrivilegeAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+		Privilege: PrivilegeAccounting,
+	}, goamqp.Headers{})
+
+	result = handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
+		return privileges.Accounting
+	})
+
+	assert.True(t, result)
+
+	_, _ = handler.Process(&PrivilegeAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+		Privilege: PrivilegeSupplier,
+	}, goamqp.Headers{})
+
+	result = handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
+		return privileges.Supplier
+	})
+
+	assert.True(t, result)
+
+	_, _ = handler.Process(&PrivilegeAdded{
+		Email:     "jim@example.org",
+		CompanyID: "abc-123",
+		Privilege: PrivilegeSalary,
+	}, goamqp.Headers{})
+
+	result = handler.IsAllowed("jim@example.org", "abc-123", func(privileges CompanyPrivileges) bool {
+		return privileges.Salary
+	})
+
+	assert.True(t, result)
+}
+
 func TestPrivilegeHandler_Fetch_Error_Response(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(500)
@@ -106,7 +261,7 @@ func TestPrivilegeHandler_Fetch_Error_Response(t *testing.T) {
 	server.Close()
 
 	err := handler.Fetch()
-	assert.EqualError(t, err, fmt.Sprintf("Get http://%s/authz: dial tcp %s: connect: connection refused", baseURL, baseURL))
+	assert.EqualError(t, err, fmt.Sprintf("Get \"http://%s/authz\": dial tcp %s: connect: connection refused", baseURL, baseURL))
 }
 
 func TestPrivilegeHandler_Fetch_Error_Unreadable_Body(t *testing.T) {
@@ -146,7 +301,8 @@ func TestPrivilegeHandler_Fetch_Valid(t *testing.T) {
       "time": true,
       "invoicing": true,
       "accounting": false,
-      "supplier": false
+      "supplier": false,
+      "salary": true
     }
   }
 }`
@@ -160,7 +316,7 @@ func TestPrivilegeHandler_Fetch_Valid(t *testing.T) {
 
 	err := handler.Fetch()
 	assert.NoError(t, err)
-	expectedPrivileges := map[string]map[string]CompanyPrivileges{
+	expectedPrivileges := map[string]map[string]*CompanyPrivileges{
 		"jim@example.org": {
 			"00010203-0405-4607-8809-0a0b0c0d0e0f": {
 				Admin:      false,
@@ -170,6 +326,7 @@ func TestPrivilegeHandler_Fetch_Valid(t *testing.T) {
 				Invoicing:  true,
 				Accounting: false,
 				Supplier:   false,
+				Salary:     true,
 			},
 		},
 	}

events.go

@@ -0,0 +1,64 @@
+package client
+
+// UserAdded is the event sent when a new user is added to a company
+type UserAdded struct {
+	Email     string `json:"email"`
+	CompanyID string `json:"companyId"`
+}
+
+// UserRemoved is the event sent when a user is removed from a company
+type UserRemoved struct {
+	Email     string `json:"email"`
+	CompanyID string `json:"companyId"`
+}
+
+// Privilege is an enumeration of all available privileges
+type Privilege string
+
+const (
+	PrivilegeAdmin      = "ADMIN"
+	PrivilegeCompany    = "COMPANY"
+	PrivilegeConsumer   = "CONSUMER"
+	PrivilegeTime       = "TIME"
+	PrivilegeInvoicing  = "INVOICING"
+	PrivilegeAccounting = "ACCOUNTING"
+	PrivilegeSupplier   = "SUPPLIER"
+	PrivilegeSalary     = "SALARY"
+)
+
+var AllPrivilege = []Privilege{
+	PrivilegeAdmin,
+	PrivilegeCompany,
+	PrivilegeConsumer,
+	PrivilegeTime,
+	PrivilegeInvoicing,
+	PrivilegeAccounting,
+	PrivilegeSupplier,
+	PrivilegeSalary,
+}
+
+func (e Privilege) IsValid() bool {
+	switch e {
+	case PrivilegeAdmin, PrivilegeCompany, PrivilegeConsumer, PrivilegeTime, PrivilegeInvoicing, PrivilegeAccounting, PrivilegeSupplier, PrivilegeSalary:
+		return true
+	}
+	return false
+}
+
+func (e Privilege) String() string {
+	return string(e)
+}
+
+// PrivilegeAdded is the event sent when a new privilege is added
+type PrivilegeAdded struct {
+	Email     string    `json:"email"`
+	CompanyID string    `json:"companyId"`
+	Privilege Privilege `json:"privilege"`
+}
+
+// PrivilegeRemoved is the event sent when a privilege is removed
+type PrivilegeRemoved struct {
+	Email     string    `json:"email"`
+	CompanyID string    `json:"companyId"`
+	Privilege Privilege `json:"privilege"`
+}

events_test.go

@@ -0,0 +1,110 @@
+package client
+
+import "testing"
+
+func TestPrivilege_IsValid(t *testing.T) {
+	tests := []struct {
+		name string
+		e    Privilege
+		want bool
+	}{
+		{
+			name: "Admin",
+			e:    "ADMIN",
+			want: true,
+		},
+		{
+			name: "Company",
+			e:    "COMPANY",
+			want: true,
+		},
+		{
+			name: "Consumer",
+			e:    "CONSUMER",
+			want: true,
+		},
+		{
+			name: "Time",
+			e:    "TIME",
+			want: true,
+		},
+		{
+			name: "Invoicing",
+			e:    "INVOICING",
+			want: true,
+		},
+		{
+			name: "Accounting",
+			e:    "ACCOUNTING",
+			want: true,
+		},
+		{
+			name: "Supplier",
+			e:    "SUPPLIER",
+			want: true,
+		},
+		{
+			name: "Invalid",
+			e:    "BLUTTI",
+			want: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.e.IsValid(); got != tt.want {
+				t.Errorf("IsValid() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestPrivilege_String(t *testing.T) {
+	tests := []struct {
+		name string
+		e    Privilege
+		want string
+	}{
+		{
+			name: "Admin",
+			e:    "ADMIN",
+			want: "ADMIN",
+		},
+		{
+			name: "Company",
+			e:    "COMPANY",
+			want: "COMPANY",
+		},
+		{
+			name: "Consumer",
+			e:    "CONSUMER",
+			want: "CONSUMER",
+		},
+		{
+			name: "Time",
+			e:    "TIME",
+			want: "TIME",
+		},
+		{
+			name: "Invoicing",
+			e:    "INVOICING",
+			want: "INVOICING",
+		},
+		{
+			name: "Accounting",
+			e:    "ACCOUNTING",
+			want: "ACCOUNTING",
+		},
+		{
+			name: "Supplier",
+			e:    "SUPPLIER",
+			want: "SUPPLIER",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.e.String(); got != tt.want {
+				t.Errorf("String() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

go.mod

@@ -1,5 +1,19 @@
 module gitlab.com/unboundsoftware/shiny/authz_client
 
-go 1.13
+go 1.22.12
 
-require github.com/stretchr/testify v1.4.0
+toolchain go1.25.1
+
+require (
+	github.com/sparetimecoders/goamqp v0.3.3
+	github.com/stretchr/testify v1.11.1
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rabbitmq/amqp091-go v1.10.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)

go.sum

@@ -1,11 +1,20 @@
-github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/rabbitmq/amqp091-go v1.10.0 h1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=
+github.com/rabbitmq/amqp091-go v1.10.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
+github.com/sparetimecoders/goamqp v0.3.3 h1:z/nfTPmrjeU/rIVuNOgsVLCimp3WFoNFvS3ZzXRJ6HE=
+github.com/sparetimecoders/goamqp v0.3.3/go.mod h1:W9NRCpWLE+Vruv2dcRSbszNil2O826d2Nv6kAkETW5o=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}