Repository: kestra-io/kestra
File: core/src/main/java/io/kestra/core/runners/AclChecker.java (Java)

Code before:
package io.kestra.core.runners;

import io.kestra.core.services.FlowService;

import java.util.List;
import java.util.Objects;

public interface AclChecker {

    void checkAllowAllNamespace();

    void checkAllowNamespace(String namespace);

    void checkAllowNamespaces(List<String> namespaces);

    void checkAllowResources(AllowedResources allowedResources);

    interface AllowedResources {
        void checkAllowed(RunContext.FlowInfo flowInfo);
    }

    class AllowAllNamespace implements AllowedResources {
        private final FlowService flowService;

        AllowAllNamespace(FlowService flowService) {
            this.flowService = Objects.requireNonNull(flowService);
        }

        @Override
        public void checkAllowed(RunContext.FlowInfo flowInfo) {
            this.flowService.checkAllowedAllNamespaces(flowInfo.tenantId(), flowInfo.tenantId(), flowInfo.namespace());
        }
    }

    class AllowNamespaces implements AllowedResources {
        private final FlowService flowService;
        private final List<String> namespaces;

        AllowNamespaces(FlowService flowService, List<String> namespaces) {
            this.flowService = Objects.requireNonNull(flowService);
            this.namespaces = Objects.requireNonNull(namespaces);
            if (namespaces.isEmpty()) {
                throw new IllegalArgumentException("At least one namespace must be provided");
            }
        }

        @Override

Review comment (suggestion):
I find the class names here slightly confusing with plural vs singular. Maybe could we consider: 

* `SingleNamespace` instead of `AllowNamespace`
* `MultipleNamespaces` instead of `AllowNamespaces`
* `AllNamespaces` instead of `AllowAllNamespace`

`Allow` prefix is redondant for me and could be removed as we use inner classes here.

Code after:
package io.kestra.core.runners;

import java.util.List;

/**
 * Check if the current taskrun has access to the requested resources.
 *
 * <p>
 * IMPORTANT: remember to call the <code>check()</code> method to check the ACL.
 *
 * @see AllowedResources
 */
public interface AclChecker {

    /**Tasks that need to access resources outside their namespace should use this interface to check ACL (Allowed namespaces in EE).
     * Allow all namespaces.
     * <p>
     * IMPORTANT: remember to call the <code>check()</code> method to check the ACL.
     */
    AllowedResources allowAllNamespaces();

    /**
     * Allow only the given namespace.
     * <p>
     * IMPORTANT: remember to call the <code>check()</code> method to check the ACL.
     */
    AllowedResources allowNamespace(String namespace);

    /**
     * Allow only the given namespaces.
     * <p>
     * IMPORTANT: remember to call the <code>check()</code> method to check the ACL.
     */
    AllowedResources allowNamespaces(List<String> namespaces);

    /**
     * Represents a set of allowed resources.
     * Tasks that need to access resources outside their namespace should call the <code>check()</code> method to check the ACL (Allowed namespaces in EE).
     */
    interface AllowedResources {
        /**
         * Check if the current taskrun has access to the requested resources.
         */
        void check();
    }
}