engine

Documentation

Overview

Package engine deterministically evaluates and aggregates SQL security rules.

Index

• Constants
• Variables
• type Engine
  • func (Engine) Evaluate(ast *model.AST, evalContext EvalContext, rules []Rule, layers RuleLayers) (model.Assessment, error)
• type EvalContext
• type Rule
• type RuleConfig
• type RuleLayer
• type RuleLayers
• type RuleResult

Constants

const (
	// DialectAll makes a rule applicable to every supported SQL dialect.
	DialectAll model.DBDialect = "all"
)

Variables

var (
	// ErrInvalidInput indicates that an evaluation input is incomplete or invalid.
	ErrInvalidInput = errors.New("invalid engine input")
	// ErrInvalidRule indicates that a rule contract is incomplete or inconsistent.
	ErrInvalidRule = errors.New("invalid rule")
	// ErrInvalidRuleConfig indicates that layered rule configuration is invalid.
	ErrInvalidRuleConfig = errors.New("invalid rule configuration")
	// ErrRuleEvaluation indicates that a rule could not produce a trustworthy result.
	ErrRuleEvaluation = errors.New("rule evaluation failed")
)

Types

type Engine

type Engine struct{}

Engine evaluates rules without retaining state or performing external I/O.

func (Engine) Evaluate

func (Engine) Evaluate(
	ast *model.AST,
	evalContext EvalContext,
	rules []Rule,
	layers RuleLayers,
) (model.Assessment, error)

Evaluate applies ordered rules and aggregates deny > approve > warn > allow.

type EvalContext

type EvalContext struct {
	AST              *model.AST
	AgentLevel       string
	Agent            *model.Agent
	Datasource       *model.Datasource
	Policy           *model.PolicyDecision
	MetadataProvider any
	Thresholds       map[string]float64
	// RuntimeResult is present only after a bounded query result has been validated.
	RuntimeResult *model.QueryResult
}

EvalContext contains the immutable inputs available to a rule evaluation. MetadataProvider intentionally remains an unconstrained slot until T06 defines its domain methods; the engine never invokes or mutates it.

type Rule

type Rule interface {
	ID() string
	Dialect() model.DBDialect
	Level() model.RiskLevel
	Enabled() bool
	Eval(EvalContext) (RuleResult, error)
}

Rule evaluates one AST and returns an explainable four-state conclusion. Implementations must be deterministic and safe for concurrent calls.

type RuleConfig

type RuleConfig struct {
	Enabled      *bool
	Thresholds   map[string]float64
	ExplicitDeny bool
}

RuleConfig overrides one rule at a single configuration layer. ExplicitDeny is sticky across all later layers.

type RuleLayer

type RuleLayer map[string]RuleConfig

RuleLayer maps rule IDs to their settings at one ownership level.

type RuleLayers

type RuleLayers struct {
	Global     RuleLayer
	Datasource RuleLayer
	Agent      RuleLayer
}

RuleLayers are merged from Global to Datasource to Agent. Callers must not mutate the maps while an evaluation is in progress.

type RuleResult

type RuleResult struct {
	Decision   model.Decision
	Message    string
	Suggestion string
}

RuleResult is one rule's four-state conclusion.