opa

Documentation

Overview

Package opa provides OPA-based HTTP request authorization middleware.

Index

• Constants
• func Middleware(ctx context.Context, cfg Config, next http.Handler) (http.Handler, error)
• type Config

Constants

const DefaultPolicy = `` /* 145-byte string literal not displayed */

DefaultPolicy allows all requests from localhost and restricts remote access to non-admin paths.

Functions

func Middleware

func Middleware(ctx context.Context, cfg Config, next http.Handler) (http.Handler, error)

Middleware returns an http.Handler that evaluates OPA policy before delegating to next. The policy must define a boolean "allow" rule under package cachew.authz. If allow is true the request proceeds; otherwise it is rejected with 403.

Types

type Config

type Config struct {
	Policy     string `hcl:"policy,optional" help:"Inline Rego policy."`
	PolicyFile string `hcl:"policy-file,optional" help:"Path to a Rego policy file."`
	Data       string `hcl:"data,optional" help:"Inline JSON object loaded as OPA data.*"`
	DataFile   string `hcl:"data-file,optional" help:"Path to a JSON file loaded as OPA data.*"`
}

Config for OPA policy evaluation. If neither Policy nor PolicyFile is set, a default policy allowing only GET and HEAD requests is used.