security

Documentation

Index

• Constants
• Variables
• func CasbinHTTPMiddleware(next http.Handler, _ *casbin.Enforcer, _ SubjectExtractor) http.Handler
• func NewEnforcerFromFiles(modelPath, policyPath string) (*casbin.Enforcer, error)
• func NewFileRBACStore(baseDir string) *fileRBACStore
• type Assignment
• type AuditEvent
• type Auditor
  • func NewAuditor(baseDir string) *Auditor
  • func (a *Auditor) Write(evt AuditEvent) error
• type Permission
• type RBACService
  • func NewRBACService(store RBACStore, logger *logging.Logger) *RBACService
  • func (s *RBACService) CheckPermission(ctx context.Context, roleName, resource, action string) bool
  • func (s *RBACService) CreateRole(name, description string, perms []Permission) (Role, error)
  • func (s *RBACService) HasPermission(roleName, resource, action string) bool
• type RBACStore
• type Role
• type ScanResult
• type Scanner
  • func NewScanner(logger *logging.Logger) *Scanner
  • func (s *Scanner) ScanVulnerabilities(target string) (*ScanResult, error)
• type SubjectExtractor
  • func JWTSubjectExtractor(secret, issuer string) SubjectExtractor
• type Vulnerability

Constants

const (
	ResourceReports = "reports"
	ActionGenerate  = "generate"
	ActionExport    = "export"

	ResourceFocus  = "focus"
	ActionConvert  = "convert"
	ActionValidate = "validate"

	ResourceProviders = "providers"
	ActionConnect     = "connect"
	ActionList        = "list"

	ResourceAnalytics     = "analytics"
	ActionForecast        = "forecast"
	ActionDetectAnomalies = "anomalies"
	ActionRecommendations = "recommendations"
	ActionTrends          = "trends"
	ActionTrainModel      = "train_model"

	ResourceStreaming = "streaming"
	ActionCreateJob   = "create_job"
	ActionStartJob    = "start_job"
	ActionStopJob     = "stop_job"
	ActionDeleteJob   = "delete_job"
)

Predefined resource & action constants (grow conservatively to limit metric cardinality)

Variables

var PermissionMatrix = map[string][]string{
	ResourceReports:   {ActionGenerate, ActionExport},
	ResourceFocus:     {ActionConvert, ActionValidate},
	ResourceProviders: {ActionConnect, ActionList},
	ResourceAnalytics: {ActionForecast, ActionDetectAnomalies, ActionRecommendations, ActionTrends, ActionTrainModel},
	ResourceStreaming: {ActionCreateJob, ActionStartJob, ActionStopJob, ActionDeleteJob},
}

PermissionMatrix documents intended resource/action pairs for validation / audit. Not enforced yet.

Functions

func CasbinHTTPMiddleware

func CasbinHTTPMiddleware(next http.Handler, _ *casbin.Enforcer, _ SubjectExtractor) http.Handler

CasbinHTTPMiddleware stub passes through without authorization checks.

func NewEnforcerFromFiles

func NewEnforcerFromFiles(modelPath, policyPath string) (*casbin.Enforcer, error)

NewEnforcerFromFiles is a stub when Casbin PoC is disabled.

func NewFileRBACStore

func NewFileRBACStore(baseDir string) *fileRBACStore

NewFileRBACStore creates a new file-backed RBAC store at data/security/roles.json

Types

type Assignment

type Assignment struct {
	UserID string `json:"user_id"`
	Role   string `json:"role"`
}

Assignment represents a user-to-role mapping

type AuditEvent

type AuditEvent struct {
	Timestamp time.Time              `json:"timestamp"`
	Actor     string                 `json:"actor"`
	Action    string                 `json:"action"`
	Resource  string                 `json:"resource"`
	Result    string                 `json:"result"`
	Fields    map[string]interface{} `json:"fields,omitempty"`
}

AuditEvent represents a security-relevant event

type Auditor

type Auditor struct {
	// contains filtered or unexported fields
}

Auditor writes audit events to an append-only JSONL file

func NewAuditor

func NewAuditor(baseDir string) *Auditor

NewAuditor creates a new auditor writing to data/security/audit.log

func (*Auditor) Write

func (a *Auditor) Write(evt AuditEvent) error

Write writes an audit event as a JSON line

type Permission

type Permission struct {
	Resource string `json:"resource"`
	Action   string `json:"action"`
}

Permission represents an action allowed on a resource

type RBACService

type RBACService struct {
	// contains filtered or unexported fields
}

RBACService provides RBAC operations

func NewRBACService

func NewRBACService(store RBACStore, logger *logging.Logger) *RBACService

NewRBACService creates a new RBAC service

func (*RBACService) CheckPermission

func (s *RBACService) CheckPermission(ctx context.Context, roleName, resource, action string) bool

CheckPermission is a tracing-enabled wrapper around HasPermission that records an OTel span. It does not introduce additional allocation heavy logic; span creation is skipped when no tracer provider is configured (noop provider). Span name: rbac.has_permission Attributes:

rbac.role      - evaluated role
rbac.resource  - target resource
rbac.action    - target action
rbac.allowed   - boolean result

NOTE: We keep HasPermission for lightweight internal / test usage; middleware and centralized enforcement paths SHOULD prefer CheckPermission to gain observability.

func (*RBACService) CreateRole

func (s *RBACService) CreateRole(name, description string, perms []Permission) (Role, error)

CreateRole creates a new role with permissions

func (*RBACService) HasPermission

func (s *RBACService) HasPermission(roleName, resource, action string) bool

HasPermission checks if a role has a specific permission Deprecated: Use CheckPermission for new code to ensure tracing & metrics.

type RBACStore

type RBACStore interface {
	Load() error
	Save() error
	AddRole(role Role) error
	GetRole(name string) (Role, bool)
	ListRoles() []Role
}

RBACStore defines persistence for RBAC data

type Role

type Role struct {
	Name        string       `json:"name"`
	Description string       `json:"description,omitempty"`
	Permissions []Permission `json:"permissions"`
	CreatedAt   time.Time    `json:"created_at"`
}

Role represents a named set of permissions

type ScanResult

type ScanResult struct {
	Summary         string          `json:"summary"`
	Vulnerabilities []Vulnerability `json:"vulnerabilities"`
	GeneratedAt     time.Time       `json:"generated_at"`
}

ScanResult contains the results of a scan

type Scanner

type Scanner struct {
	// contains filtered or unexported fields
}

Scanner provides security scanning capabilities

func NewScanner

func NewScanner(logger *logging.Logger) *Scanner

NewScanner creates a new security scanner

func (*Scanner) ScanVulnerabilities

func (s *Scanner) ScanVulnerabilities(target string) (*ScanResult, error)

ScanVulnerabilities performs a stub vulnerability scan

type SubjectExtractor

type SubjectExtractor func(r *http.Request) (subjects []string)

SubjectExtractor extracts a subject (e.g., role or user) from request. Default stub returns nil.

func JWTSubjectExtractor

func JWTSubjectExtractor(secret, issuer string) SubjectExtractor

JWTSubjectExtractor stub returns an extractor that yields no subjects.

type Vulnerability

type Vulnerability struct {
	ID          string    `json:"id"`
	Severity    string    `json:"severity"`
	Description string    `json:"description"`
	Component   string    `json:"component"`
	DetectedAt  time.Time `json:"detected_at"`
}

Vulnerability represents a found security issue