airlockvet

Documentation

Index

• Variables

Variables

var AgentWire = &analysis.Analyzer{
	Name:     "agentwire",
	Doc:      "report readJSON/writeJSON calls in airlock/agentapi/ whose body type is declared inside agentapi/; wire shapes must live in agentsdk/wire so the SDK and airlock share one declaration",
	Requires: []*analysis.Analyzer{inspect.Analyzer},
	Run:      runAgentWire,
}

AgentWire flags readJSON / writeJSON calls in airlock/agentapi/ whose body argument is a type declared inside agentapi/. Body types from agentsdk/wire (the package that user-built agents and airlock both import) are required; anonymous shapes like map[string]any pass too, as do generated proto types. The point is to keep the wire contract in one declaration site so the agent SDK and airlock can never disagree on a field name or shape.

Opt-out per call: place `// airlockvet:allow-agentwire reason: <why>` on the same line or the line above the offending call.

var NoDBQ = &analysis.Analyzer{
	Name:     "nodbq",
	Doc:      "report direct *dbq.Queries method calls in airlock/api/; handlers must call service/{domain} instead",
	Requires: []*analysis.Analyzer{inspect.Analyzer},
	Run:      runNoDBQ,
}

NoDBQ flags method calls on *dbq.Queries from inside airlock/api. Handler code that needs database access must go through a service/{domain} method so authz.Authorize gates the call.

Opt-out per call: place `// airlockvet:allow-dbq reason: <why>` on the same line or the line above the offending expression.

var NoInlineRole = &analysis.Analyzer{
	Name:     "noinlinerole",
	Doc:      "report inline auth.Role* references; route gates through authz.Authorize with an Action",
	Requires: []*analysis.Analyzer{inspect.Analyzer},
	Run:      runNoInlineRole,
}

NoInlineRole flags references to auth.Role{Admin,Manager,User} from outside the allowlist of packages above. The AGENTS.md rule: every permission gate routes through authz.Authorize(action). Comparing a principal's role to a constant in a service body is exactly the drift this catches — frontend hides Bridges from manager while backend grants TenantBridgeCreate to manager+ was the original motivating bug.

Opt-out per call: place `// airlockvet:allow-inline-role reason: <why>` on the same line or the line above the offending expression.

var WriteProto = &analysis.Analyzer{
	Name:     "writeproto",
	Doc:      "report writeJSON/writeJSONError/readJSON calls in airlock/api/; handlers must use proto wire helpers instead",
	Requires: []*analysis.Analyzer{inspect.Analyzer},
	Run:      runWriteProto,
}

WriteProto flags JSON-shaped wire helpers in airlock/api/. The api/ surface emits proto-encoded responses via writeProto/decodeProto; the JSON helpers exist for apihelpers consumers (sysagent, internal) but must not creep back into api/ handlers.

Identifier names checked (the package-level aliases in api/helpers.go, plus direct apihelpers selectors):

• writeJSON / apihelpers.WriteJSON
• writeJSONError / apihelpers.WriteJSONError
• readJSON / apihelpers.ReadJSON

Opt-out per call: place `// airlockvet:allow-writejson reason: <why>` on the same line or the line above the offending call.