policy

package
v0.0.0-...-02bc413 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 26, 2026 License: MIT Imports: 11 Imported by: 0

Documentation

Overview

Package policy provides snapshot inspection, diff, dry-run, and portable policy manifest contracts.

Index

Constants

View Source 
const DefaultMaxStaleness = 2 * time.Minute
View Source 
const DefaultSyncInterval = 30 * time.Second

Variables

View Source 
var (
	ErrNilDecoder                 = errors.New("policy decoder is nil")
	ErrMissingDecoder             = errors.New("policy decoder is not registered")
	ErrNilEvaluator               = errors.New("policy decoder returned a nil evaluator")
	ErrDocumentLimitExceeded      = errors.New("policy document size limit exceeded")
	ErrPolicyLimitExceeded        = errors.New("policy compiler policy limit exceeded")
	ErrTotalDocumentLimitExceeded = errors.New("policy compiler total document size limit exceeded")
)
View Source 
var (
	ErrInvalidManifest       = errors.New("invalid policy manifest")
	ErrDuplicateRecord       = errors.New("duplicate policy record")
	ErrManifestLimitExceeded = errors.New("policy manifest size limit exceeded")
)
View Source 
var (
	ErrNilRepository       = errors.New("policy synchronizer repository is nil")
	ErrNilCompiler         = errors.New("policy synchronizer compiler is nil")
	ErrNilEngine           = errors.New("policy synchronizer engine is nil")
	ErrInvalidSyncInterval = errors.New("policy synchronizer interval is invalid")
	ErrInvalidMaxStaleness = errors.New("policy synchronizer maximum staleness is invalid")
	ErrStaleManifest       = errors.New("policy repository manifest is stale")
	ErrPolicyStale         = errors.New("authorization policy verification is stale")
)
View Source 
var ErrNilSnapshot = errors.New("policy snapshot is nil")

Functions

func Encode 

func Encode(manifest Manifest) ([]byte, error)

Types

type Algorithm 

type Algorithm string
const (
	AlgorithmDenyOverrides   Algorithm = "deny-overrides"
	AlgorithmAllowOverrides  Algorithm = "allow-overrides"
	AlgorithmFirstApplicable Algorithm = "first-applicable"
	AlgorithmPriorityOrder   Algorithm = "priority-order"
)

type Compiler 

type Compiler struct {
	// contains filtered or unexported fields
}

Compiler activates portable manifests through an explicit model decoder registry. The registry is copied at construction and is safe for concurrent Compile calls when its decoders are safe for concurrent use.

func NewCompiler 

func NewCompiler(
	decoders map[Model]Decoder,
	options ...CompilerOption,
) (*Compiler, error)

func (*Compiler) Compile 

func (compiler *Compiler) Compile(
	manifest Manifest,
) (*authorization.Snapshot, error)

type CompilerLimits 

type CompilerLimits struct {
	MaxDocumentBytes      int
	MaxPolicies           int
	MaxTotalDocumentBytes int
}

type CompilerOption 

type CompilerOption func(*Compiler)

func WithCompilerLimits 

func WithCompilerLimits(limits CompilerLimits) CompilerOption

type DecisionComparison 

type DecisionComparison struct {
	Index     int
	Current   authorization.Decision
	Candidate authorization.Decision
	Changed   bool
}

type Decoder 

type Decoder interface {
	Decode(json.RawMessage) (authorization.Evaluator, error)
}

Decoder converts one validated model document into an immutable evaluator.

type DecoderFunc 

type DecoderFunc func(json.RawMessage) (authorization.Evaluator, error)

func (DecoderFunc) Decode 

func (decode DecoderFunc) Decode(
	document json.RawMessage,
) (authorization.Evaluator, error)

type DryRunReport 

type DryRunReport struct {
	FromRevision authorization.Revision
	ToRevision   authorization.Revision
	Decisions    []DecisionComparison
}

func DryRun 

func DryRun(
	ctx context.Context,
	current *authorization.Snapshot,
	candidate *authorization.Snapshot,
	requests []authorization.Request,
) (DryRunReport, error)

type Format 

type Format string
const FormatV1 Format = "authorization.policy/v1"

type Manifest 

type Manifest struct {
	Format    Format                 `json:"format"`
	Revision  authorization.Revision `json:"revision"`
	Algorithm Algorithm              `json:"algorithm"`
	Policies  []Record               `json:"policies"`
}

func Decode 

func Decode(encoded []byte) (Manifest, error)

func (Manifest) Validate 

func (manifest Manifest) Validate() error

type Model 

type Model string
const (
	ModelACL       Model = "acl"
	ModelRBAC      Model = "rbac"
	ModelABAC      Model = "abac"
	ModelComposite Model = "composite"
)

type Record 

type Record struct {
	ID          authorization.PolicyID `json:"id"`
	Revision    authorization.Revision `json:"revision"`
	Model       Model                  `json:"model"`
	Priority    int                    `json:"priority,omitempty"`
	ActiveFrom  *time.Time             `json:"active_from,omitempty"`
	ActiveUntil *time.Time             `json:"active_until,omitempty"`
	Metadata    map[string]string      `json:"metadata,omitempty"`
	Document    json.RawMessage        `json:"document"`
}

type Repository 

type Repository interface {
	Load(context.Context) (Manifest, error)
	Update(context.Context, authorization.Revision, Manifest) (Manifest, error)
}

Repository is the storage-neutral optimistic-concurrency contract for portable policy manifests.

type SnapshotDiff 

type SnapshotDiff struct {
	FromRevision     authorization.Revision
	ToRevision       authorization.Revision
	AlgorithmChanged bool
	Added            []authorization.PolicyID
	Removed          []authorization.PolicyID
	Changed          []authorization.PolicyID
}

func Diff 

func Diff(current, candidate *authorization.Snapshot) (SnapshotDiff, error)

type Synchronizer 

type Synchronizer struct {
	// contains filtered or unexported fields
}

Synchronizer keeps an engine converged with its authoritative repository. Direct repository polling is the correctness path; external invalidation transports may call Observe to reduce propagation latency.

func NewSynchronizer 

func NewSynchronizer(
	repository Repository,
	compiler *Compiler,
	engine *authorization.Engine,
	options ...SynchronizerOption,
) (*Synchronizer, error)

func (*Synchronizer) Decide 

func (synchronizer *Synchronizer) Decide(
	ctx context.Context,
	request authorization.Request,
) (authorization.Decision, error)

Decide enforces the maximum age of the last successful repository verification before delegating to the active immutable engine snapshot.

func (*Synchronizer) LastVerified 

func (synchronizer *Synchronizer) LastVerified() (time.Time, bool)

LastVerified reports the time of the latest successful authoritative repository verification, including a same-revision verification.

func (*Synchronizer) Observe 

func (synchronizer *Synchronizer) Observe(
	ctx context.Context,
	revision authorization.Revision,
) error

Observe handles an untrusted invalidation revision by reloading the source of truth. It rejects hints ahead of the repository state.

func (*Synchronizer) Reload 

func (synchronizer *Synchronizer) Reload(ctx context.Context) (bool, error)

Reload activates a newer repository manifest. Equal revisions are a no-op; older repository state fails rather than rolling the engine back.

func (*Synchronizer) Run 

func (synchronizer *Synchronizer) Run(ctx context.Context) error

Run performs an immediate repository check and then polls until cancellation or the first reload error. Returning errors prevents silent stale operation.

type SynchronizerOption 

type SynchronizerOption func(*Synchronizer)

func WithMaxStaleness 

func WithMaxStaleness(maxStaleness time.Duration) SynchronizerOption

func WithSyncInterval 

func WithSyncInterval(interval time.Duration) SynchronizerOption

func WithSynchronizerClock 

func WithSynchronizerClock(clock func() time.Time) SynchronizerOption

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.