cache

Documentation

Index

• func CacheKey(toolName string, args map[string]string) string
• func CacheKeyWithContext(toolName string, args map[string]string, context string) string
• func CacheKeyWithFields(toolName string, args, fields map[string]string, context string) string
• type CacheStats
• type CachedVerdict
• type VerdictCache
  • func NewVerdictCache(maxSize int, ttl time.Duration) *VerdictCache
  • func (c *VerdictCache) Get(key string) (*CachedVerdict, bool)
  • func (c *VerdictCache) Invalidate()
  • func (c *VerdictCache) Set(key string, verdict *CachedVerdict)
  • func (c *VerdictCache) Stats() CacheStats

Functions

func CacheKey

func CacheKey(toolName string, args map[string]string) string

CacheKey computes a deterministic SHA-256 cache key from a tool name and its arguments. Arguments are sorted by key so that logically identical requests (with args in different map-iteration order) produce the same key.

func CacheKeyWithContext

func CacheKeyWithContext(toolName string, args map[string]string, context string) string

CacheKeyWithContext computes a deterministic SHA-256 cache key from tool, args, and execution context.

func CacheKeyWithFields

func CacheKeyWithFields(toolName string, args, fields map[string]string, context string) string

CacheKeyWithFields computes a deterministic SHA-256 cache key from tool, args, the rule-evaluation fields, and execution context.

Fields are included because the evaluator makes decisions from the flattened field map, including derived session/cross-session values. This prevents stale verdict reuse across changes in event semantics or behavioural state.

Types

type CacheStats

type CacheStats struct {
	Hits      uint64 `json:"hits"`
	Misses    uint64 `json:"misses"`
	Size      int    `json:"size"`
	MaxSize   int    `json:"max_size"`
	Evictions uint64 `json:"evictions"`
}

CacheStats exposes operational metrics for the verdict cache.

type CachedVerdict

type CachedVerdict struct {
	Action        models.Action         `json:"action"`
	Alerts        []engine.RuleResult   `json:"alerts"`
	TriageResults []triage.TriageResult `json:"triage_results,omitempty"`
	Overridable   bool                  `json:"overridable"`
	CachedAt      time.Time             `json:"cached_at"`
}

CachedVerdict stores the result of a previous evaluation for replay on cache hit.

type VerdictCache

type VerdictCache struct {
	// contains filtered or unexported fields
}

VerdictCache is a thread-safe LRU cache with TTL-based expiry. It uses a doubly-linked list + map for O(1) get/set/eviction.

func NewVerdictCache

func NewVerdictCache(maxSize int, ttl time.Duration) *VerdictCache

NewVerdictCache creates a new verdict cache with the given capacity and TTL.

func (*VerdictCache) Get

func (c *VerdictCache) Get(key string) (*CachedVerdict, bool)

Get retrieves a cached verdict by key. Returns nil, false on miss or expiry.

func (*VerdictCache) Invalidate

func (c *VerdictCache) Invalidate()

Invalidate clears all entries from the cache. This should be called on rule hot-reload to prevent stale verdicts from being served.

func (*VerdictCache) Set

func (c *VerdictCache) Set(key string, verdict *CachedVerdict)

Set stores a verdict in the cache. If the cache is at capacity, the least recently used entry is evicted first.

func (*VerdictCache) Stats

func (c *VerdictCache) Stats() CacheStats

Stats returns a snapshot of cache operational metrics.