rego

Documentation

Index

• type Engine
  • func NewEngine(opts ...EngineOption) *Engine
  • func (r *Engine) Capabilities() *ast.Capabilities
  • func (r *Engine) Verify(ctx context.Context, policy *engine.Policy, input []byte, args map[string]any) (*engine.EvaluationResult, error)
• type EngineOption
  • func WithAllowedNetworkDomains(domains ...string) EngineOption
  • func WithEnablePrint(enable bool) EngineOption
  • func WithIncludeRawData(include bool) EngineOption
  • func WithOperatingMode(mode EnvironmentMode) EngineOption
• type EnvironmentMode

Types

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

Engine policy checker for chainloop attestations and materials

func NewEngine

func NewEngine(opts ...EngineOption) *Engine

NewEngine creates a new policy engine with the given options default operating mode is EnvironmentModeRestrictive default allowed network domains are www.chainloop.dev and www.cisa.gov user provided allowed network domains are appended to the base ones

func (*Engine) Capabilities

func (r *Engine) Capabilities() *ast.Capabilities

Capabilities returns the capabilities of the environment based on the mode of operation defaulting to EnvironmentModeRestrictive if not provided.

func (*Engine) Verify

func (r *Engine) Verify(ctx context.Context, policy *engine.Policy, input []byte, args map[string]any) (*engine.EvaluationResult, error)

type EngineOption

type EngineOption func(*newEngineOptions)

func WithAllowedNetworkDomains

func WithAllowedNetworkDomains(domains ...string) EngineOption

func WithEnablePrint

func WithEnablePrint(enable bool) EngineOption

func WithIncludeRawData

func WithIncludeRawData(include bool) EngineOption

func WithOperatingMode

func WithOperatingMode(mode EnvironmentMode) EngineOption

type EnvironmentMode

type EnvironmentMode int32

EnvironmentMode defines the mode of running the policy engine

const (
	// EnvironmentModeRestrictive restricts operations that the compiler can do
	EnvironmentModeRestrictive EnvironmentMode = 0
	// EnvironmentModePermissive allows all operations on the compiler
	EnvironmentModePermissive EnvironmentMode = 1
)