policy

Documentation

Index

• type ApprovalConfig
• type Engine
  • func NewEngine() *Engine
  • func NewEngineFromFile(path string) (*Engine, error)
  • func (e *Engine) AddAllowPattern(pattern, description string) error
  • func (e *Engine) AddDenyPattern(pattern, description string) error
  • func (e *Engine) GetPolicy() *Policy
  • func (e *Engine) SavePolicy(path string) error
  • func (e *Engine) SetPolicy(policy *Policy)
  • func (e *Engine) Validate(command string, riskLevel string, destructive bool) *ValidationResult
• type Pattern
  • func (p *Pattern) Compile() error
  • func (p *Pattern) Matches(command string) bool
• type Policy
  • func DefaultPolicy() *Policy
• type SandboxConfig
• type SecretRedactor
  • func NewSecretRedactor() *SecretRedactor
  • func (sr *SecretRedactor) AddPattern(pattern string) error
  • func (sr *SecretRedactor) Redact(text string) string
  • func (sr *SecretRedactor) RedactEnvVars(command string) string
• type SecretsConfig
• type ValidationResult

Types

type ApprovalConfig

type ApprovalConfig struct {
	HighRisk          bool     `yaml:"high_risk"`
	RequireConfirm    bool     `yaml:"require_confirmation"`
	DestructiveOps    bool     `yaml:"destructive_ops"`
	AllowedUsers      []string `yaml:"allowed_users"`
	RequireMultiParty bool     `yaml:"require_multi_party"`
}

ApprovalConfig defines approval requirements

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

Engine handles policy enforcement

func NewEngine

func NewEngine() *Engine

NewEngine creates a new policy engine with default policy

func NewEngineFromFile

func NewEngineFromFile(path string) (*Engine, error)

NewEngineFromFile creates a policy engine from a YAML file

func (*Engine) AddAllowPattern

func (e *Engine) AddAllowPattern(pattern, description string) error

AddAllowPattern adds a pattern to the allowlist

func (*Engine) AddDenyPattern

func (e *Engine) AddDenyPattern(pattern, description string) error

AddDenyPattern adds a pattern to the denylist

func (*Engine) GetPolicy

func (e *Engine) GetPolicy() *Policy

GetPolicy returns the current policy

func (*Engine) SavePolicy

func (e *Engine) SavePolicy(path string) error

SavePolicy saves the current policy to a YAML file

func (*Engine) SetPolicy

func (e *Engine) SetPolicy(policy *Policy)

SetPolicy sets a new policy

func (*Engine) Validate

func (e *Engine) Validate(command string, riskLevel string, destructive bool) *ValidationResult

Validate checks if a command is allowed by the policy

type Pattern

type Pattern struct {
	Pattern     string `yaml:"pattern"`
	Description string `yaml:"description"`
	// contains filtered or unexported fields
}

Pattern represents a command pattern for matching

func (*Pattern) Compile

func (p *Pattern) Compile() error

Compile compiles the regex pattern

func (*Pattern) Matches

func (p *Pattern) Matches(command string) bool

Matches checks if the command matches this pattern

type Policy

type Policy struct {
	Allowlist []Pattern      `yaml:"allowlist"`
	Denylist  []Pattern      `yaml:"denylist"`
	Approval  ApprovalConfig `yaml:"approval"`
	Secrets   SecretsConfig  `yaml:"secrets"`
	Sandbox   SandboxConfig  `yaml:"sandbox"`
}

Policy represents the security policy configuration

func DefaultPolicy

func DefaultPolicy() *Policy

DefaultPolicy returns a sensible default policy

type SandboxConfig

type SandboxConfig struct {
	Enabled       bool   `yaml:"enabled"`
	DefaultMode   string `yaml:"default_mode"` // "dry-run", "sandbox", "direct"
	NetworkAccess bool   `yaml:"network_access"`
	MaxCPU        string `yaml:"max_cpu"`
	MaxMemory     string `yaml:"max_memory"`
	MaxTime       int    `yaml:"max_time_seconds"`
}

SandboxConfig defines sandbox behavior

type SecretRedactor

type SecretRedactor struct {
	// contains filtered or unexported fields
}

SecretRedactor handles redaction of sensitive information

func NewSecretRedactor

func NewSecretRedactor() *SecretRedactor

NewSecretRedactor creates a new secret redactor with default patterns

func (*SecretRedactor) AddPattern

func (sr *SecretRedactor) AddPattern(pattern string) error

AddPattern adds a custom redaction pattern

func (*SecretRedactor) Redact

func (sr *SecretRedactor) Redact(text string) string

Redact redacts sensitive information from a string

func (*SecretRedactor) RedactEnvVars

func (sr *SecretRedactor) RedactEnvVars(command string) string

RedactEnvVars redacts environment variables from a command

type SecretsConfig

type SecretsConfig struct {
	RedactEnvVars    bool     `yaml:"redact_env_vars"`
	RedactPatterns   []string `yaml:"redact_patterns"`
	VaultIntegration bool     `yaml:"vault_integration"`
}

SecretsConfig defines secrets handling

type ValidationResult

type ValidationResult struct {
	Allowed         bool
	Reason          string
	RequiresConfirm bool
	ConfirmMessage  string
	MatchedRule     string
}

ValidationResult represents the result of policy validation