policy

Documentation

Overview

Package policy implements directory scope and file pattern enforcement for intercepted requests.

Index

• type ContentKeywordResult
• type ContentPrompt
• type ContentPromptResponse
• type Decision
• type Engine
  • func NewEngine(cfg config.PolicyConfig) *Engine
  • func (e *Engine) AddDenyContentKeyword(keyword string)
  • func (e *Engine) AddDenyContentTag(tag string)
  • func (e *Engine) AddDenyPattern(pattern string)
  • func (e *Engine) AddToContentBlacklist(path string)
  • func (e *Engine) AddToContentWhitelist(path string)
  • func (e *Engine) EvaluateContentKeywords(body string, filePaths []string) ContentKeywordResult
  • func (e *Engine) EvaluateContentTags(body string) Decision
  • func (e *Engine) EvaluateFiles(paths []string) Decision
  • func (e *Engine) EvaluateScope(paths []string) Decision
  • func (e *Engine) GetAllowedDirectories() []string
  • func (e *Engine) GetContentBlacklist() []string
  • func (e *Engine) GetContentWhitelist() []string
  • func (e *Engine) GetDenyContentKeywords() []string
  • func (e *Engine) GetDenyContentTags() []string
  • func (e *Engine) GetDenyPatterns() []string
  • func (e *Engine) IsBypassed() bool
  • func (e *Engine) RemoveDenyContentKeyword(keyword string)
  • func (e *Engine) RemoveDenyContentTag(tag string)
  • func (e *Engine) RemoveDenyPattern(pattern string)
  • func (e *Engine) RemoveFromContentBlacklist(path string)
  • func (e *Engine) RemoveFromContentWhitelist(path string)
  • func (e *Engine) SetAllowedDirectories(dirs []string)
  • func (e *Engine) SetBypassed(b bool)
  • func (e *Engine) SetDenyContentKeywords(keywords []string)
  • func (e *Engine) SetDenyContentTags(tags []string)
  • func (e *Engine) SetDenyPatterns(patterns []string)
• type HeadlessResolver
  • func (h HeadlessResolver) PromptUser(prompt ContentPrompt) ContentPromptResponse
• type PromptAction
• type PromptResolver

Types

type ContentKeywordResult

type ContentKeywordResult struct {
	HasMatch       bool
	MatchedKeyword string
	AutoAllowed    []string // file paths resolved by whitelist
	AutoBlocked    []string // file paths resolved by blacklist
	NeedPrompt     []string // file paths needing user decision
}

ContentKeywordResult holds the outcome of a content keyword evaluation.

type ContentPrompt

type ContentPrompt struct {
	ID             string   `json:"id"`
	SessionID      string   `json:"session_id"`
	URL            string   `json:"url"`
	MatchedKeyword string   `json:"matched_keyword"`
	FilePaths      []string `json:"file_paths"`
}

ContentPrompt is sent to the UI when a content keyword match requires user input.

type ContentPromptResponse

type ContentPromptResponse struct {
	Action PromptAction `json:"action"`
}

ContentPromptResponse is the user's decision from the UI.

type Decision

type Decision struct {
	Allowed bool
	Reason  string
}

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

func NewEngine

func NewEngine(cfg config.PolicyConfig) *Engine

func (*Engine) AddDenyContentKeyword

func (e *Engine) AddDenyContentKeyword(keyword string)

AddDenyContentKeyword appends a single deny content keyword.

func (*Engine) AddDenyContentTag

func (e *Engine) AddDenyContentTag(tag string)

AddDenyContentTag appends a single deny content tag.

func (*Engine) AddDenyPattern

func (e *Engine) AddDenyPattern(pattern string)

AddDenyPattern appends a single deny pattern.

func (*Engine) AddToContentBlacklist

func (e *Engine) AddToContentBlacklist(path string)

AddToContentBlacklist adds a file path to the content keyword blacklist.

func (*Engine) AddToContentWhitelist

func (e *Engine) AddToContentWhitelist(path string)

AddToContentWhitelist adds a file path to the content keyword whitelist.

func (*Engine) EvaluateContentKeywords

func (e *Engine) EvaluateContentKeywords(body string, filePaths []string) ContentKeywordResult

EvaluateContentKeywords scans the body for deny_content_keywords and partitions detected file paths into whitelist-allowed, blacklist-blocked, and needs-prompt.

func (*Engine) EvaluateContentTags

func (e *Engine) EvaluateContentTags(body string) Decision

EvaluateContentTags scans the body for deny_content_tags. This is a hard block — no user prompt, no whitelist/blacklist.

func (*Engine) EvaluateFiles

func (e *Engine) EvaluateFiles(paths []string) Decision

EvaluateFiles checks if any detected file paths match deny_file_patterns.

func (*Engine) EvaluateScope

func (e *Engine) EvaluateScope(paths []string) Decision

EvaluateScope checks if any detected file paths fall outside the allowed directories. If no allowed directories are configured, all paths are allowed.

func (*Engine) GetAllowedDirectories

func (e *Engine) GetAllowedDirectories() []string

GetAllowedDirectories returns the current allowed directories.

func (*Engine) GetContentBlacklist

func (e *Engine) GetContentBlacklist() []string

GetContentBlacklist returns file paths that are always blocked by content keyword checks.

func (*Engine) GetContentWhitelist

func (e *Engine) GetContentWhitelist() []string

GetContentWhitelist returns file paths that bypass content keyword checks.

func (*Engine) GetDenyContentKeywords

func (e *Engine) GetDenyContentKeywords() []string

GetDenyContentKeywords returns the current deny content keywords.

func (*Engine) GetDenyContentTags

func (e *Engine) GetDenyContentTags() []string

GetDenyContentTags returns the current deny content tags.

func (*Engine) GetDenyPatterns

func (e *Engine) GetDenyPatterns() []string

GetDenyPatterns returns the current deny file patterns.

func (*Engine) IsBypassed

func (e *Engine) IsBypassed() bool

func (*Engine) RemoveDenyContentKeyword

func (e *Engine) RemoveDenyContentKeyword(keyword string)

RemoveDenyContentKeyword removes a single deny content keyword.

func (*Engine) RemoveDenyContentTag

func (e *Engine) RemoveDenyContentTag(tag string)

RemoveDenyContentTag removes a single deny content tag.

func (*Engine) RemoveDenyPattern

func (e *Engine) RemoveDenyPattern(pattern string)

RemoveDenyPattern removes a single deny pattern.

func (*Engine) RemoveFromContentBlacklist

func (e *Engine) RemoveFromContentBlacklist(path string)

RemoveFromContentBlacklist removes a file path from the blacklist.

func (*Engine) RemoveFromContentWhitelist

func (e *Engine) RemoveFromContentWhitelist(path string)

RemoveFromContentWhitelist removes a file path from the whitelist.

func (*Engine) SetAllowedDirectories

func (e *Engine) SetAllowedDirectories(dirs []string)

SetAllowedDirectories replaces the allowed directories list.

func (*Engine) SetBypassed

func (e *Engine) SetBypassed(b bool)

func (*Engine) SetDenyContentKeywords

func (e *Engine) SetDenyContentKeywords(keywords []string)

SetDenyContentKeywords replaces all deny content keywords.

func (*Engine) SetDenyContentTags

func (e *Engine) SetDenyContentTags(tags []string)

SetDenyContentTags replaces all deny content tags.

func (*Engine) SetDenyPatterns

func (e *Engine) SetDenyPatterns(patterns []string)

SetDenyPatterns replaces all deny file patterns.

type HeadlessResolver

type HeadlessResolver struct{}

HeadlessResolver blocks all content keyword matches without prompting.

func (HeadlessResolver) PromptUser

func (h HeadlessResolver) PromptUser(prompt ContentPrompt) ContentPromptResponse

type PromptAction

type PromptAction string

PromptAction represents the user's decision on a content keyword prompt.

const (
	PromptAllowOnce   PromptAction = "allow_once"
	PromptAllowAlways PromptAction = "allow_always"
	PromptBlockOnce   PromptAction = "block_once"
	PromptBlockAlways PromptAction = "block_always"
)

type PromptResolver

type PromptResolver interface {
	PromptUser(prompt ContentPrompt) ContentPromptResponse
}

PromptResolver pauses a request and waits for user input.