policy

Documentation

Index

• func ApplyPolicy(findings []models.Finding, domain string, cfg *PolicyConfig) []models.Finding
• func GetThreshold(ruleID, key string, defaultValue float64, cfg *PolicyConfig) float64
• func ShouldFail(domain string, findings []models.Finding, cfg *PolicyConfig) bool
• func Validate(cfg *PolicyConfig, availableRuleIDs []string) []error
• type DomainConfig
• type EnforcementConfig
• type PolicyConfig
  • func LoadPolicy(path string) (*PolicyConfig, error)
• type RuleConfig

Functions

func ApplyPolicy

func ApplyPolicy(findings []models.Finding, domain string, cfg *PolicyConfig) []models.Finding

func GetThreshold

func GetThreshold(ruleID, key string, defaultValue float64, cfg *PolicyConfig) float64

GetThreshold returns the configured float64 parameter value for a rule, or defaultValue when no override is present. It is safe to call with cfg == nil.

Lookup order:

1. cfg == nil → defaultValue
2. cfg.Rules[ruleID] absent → defaultValue
3. cfg.Rules[ruleID].Params[key] absent → defaultValue
4. Otherwise → configured value

func ShouldFail

func ShouldFail(domain string, findings []models.Finding, cfg *PolicyConfig) bool

ShouldFail reports whether any finding in findings has a severity at or above the configured fail_on_severity threshold for the given domain.

It returns false when:

• cfg is nil (no policy loaded)
• no enforcement block is configured for domain
• fail_on_severity is empty or an unrecognised value
• findings is empty

It returns true when at least one finding has a severity whose rank is greater than or equal to the configured threshold rank. SeverityRank ordering: CRITICAL (5) > HIGH (4) > MEDIUM (3) > LOW (2) > INFO (1).

func Validate

func Validate(cfg *PolicyConfig, availableRuleIDs []string) []error

Validate checks cfg for semantic correctness and returns all validation errors found. An empty slice means the config is valid.

Checks performed:

• version must be 1
• domain names must be one of: cost, security, dataprotection
• domain min_severity must be a valid severity value if set
• rule IDs must appear in availableRuleIDs
• rule severity overrides must be valid severity values if set
• enforcement domain names must be one of: cost, security, dataprotection
• enforcement fail_on_severity must be a valid severity value if set

All errors are collected before returning; Validate never stops at the first error.

Types

type DomainConfig

type DomainConfig struct {
	Enabled     bool   `yaml:"enabled"`
	MinSeverity string `yaml:"min_severity,omitempty"`
}

type EnforcementConfig

type EnforcementConfig struct {
	FailOnSeverity string `yaml:"fail_on_severity,omitempty"`
}

type PolicyConfig

type PolicyConfig struct {
	Version     int                          `yaml:"version"`
	Domains     map[string]DomainConfig      `yaml:"domains"`
	Rules       map[string]RuleConfig        `yaml:"rules"`
	Enforcement map[string]EnforcementConfig `yaml:"enforcement,omitempty"`
}

func LoadPolicy

func LoadPolicy(path string) (*PolicyConfig, error)

type RuleConfig

type RuleConfig struct {
	Enabled  *bool              `yaml:"enabled,omitempty"`
	Severity string             `yaml:"severity,omitempty"`
	Params   map[string]float64 `yaml:"params,omitempty"`
}