permission

Documentation

Overview

Package permission models explicit, scoped access grants independently from the approval UI and the operating-system sandbox implementation.

Index

• func Empty(profile Profile) bool
• type FileSystem
• type Manager
  • func NewManager(workspace string) (*Manager, error)
  • func (m *Manager) AllowsNetwork(protocol, domain string) bool
  • func (m *Manager) AllowsURL(raw string) bool
  • func (m *Manager) AllowsUnrestrictedNetwork() bool
  • func (m *Manager) BeginTurn()
  • func (m *Manager) Grant(profile Profile, scope Scope) (Profile, error)
  • func (m *Manager) ReadRoots() []string
  • func (m *Manager) Snapshot() Snapshot
  • func (m *Manager) WriteRoots() []string
• type Network
• type Profile
• type Request
• type Scope
• type Snapshot

Functions

func Empty

func Empty(profile Profile) bool

Types

type FileSystem

type FileSystem struct {
	Read  []string `json:"read,omitempty" yaml:"read,omitempty"`
	Write []string `json:"write,omitempty" yaml:"write,omitempty"`
}

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

func NewManager

func NewManager(workspace string) (*Manager, error)

func (*Manager) AllowsNetwork

func (m *Manager) AllowsNetwork(protocol, domain string) bool

func (*Manager) AllowsURL

func (m *Manager) AllowsURL(raw string) bool

func (*Manager) AllowsUnrestrictedNetwork

func (m *Manager) AllowsUnrestrictedNetwork() bool

AllowsUnrestrictedNetwork is deliberately strict. The shell sandbox is only opened when both protocol and domain were explicitly granted as wildcards; domain-specific grants remain enforceable only by URL-aware tools.

func (*Manager) BeginTurn

func (m *Manager) BeginTurn()

BeginTurn expires all access that was approved for only the previous user turn. Session grants remain active until the process exits.

func (*Manager) Grant

func (m *Manager) Grant(profile Profile, scope Scope) (Profile, error)

func (*Manager) ReadRoots

func (m *Manager) ReadRoots() []string

func (*Manager) Snapshot

func (m *Manager) Snapshot() Snapshot

func (*Manager) WriteRoots

func (m *Manager) WriteRoots() []string

type Network

type Network struct {
	Domains   []string `json:"domains,omitempty" yaml:"domains,omitempty"`
	Protocols []string `json:"protocols,omitempty" yaml:"protocols,omitempty"`
}

type Profile

type Profile struct {
	FileSystem FileSystem `json:"file_system,omitempty" yaml:"file_system,omitempty"`
	Network    Network    `json:"network,omitempty" yaml:"network,omitempty"`
}

type Request

type Request struct {
	Reason      string  `json:"reason"`
	Permissions Profile `json:"permissions"`
}

type Scope

type Scope string

const (
	ScopeTurn    Scope = "turn"
	ScopeSession Scope = "session"
)

type Snapshot

type Snapshot struct {
	Turn    Profile `json:"turn"`
	Session Profile `json:"session"`
}