policy

Documentation

Overview

Package policy evaluates broker authorization rules.

Index

• func FirstValue(values []string) string
• func MatchAll(mode MatchMode, patterns []string, values []string) bool
• func SingletonValues(values map[string]string) map[string][]string
• type AttrSpec
• type Decision
• type DecisionOptions
• type Effect
• type FieldSpec
• type Grant
• type GrantMode
• type GrantPolicy
• type MatchMode
• type OperationSpec
  • func (op OperationSpec) AllowsGrantMode(mode GrantMode) bool
• type Policy
  • func LoadFile(file string, registry Registry) (*Policy, error)
  • func Parse(data []byte, registry Registry) (*Policy, error)
  • func (p *Policy) Decide(request Request, opts DecisionOptions) Decision
  • func (p *Policy) Rules() []Rule
• type Registry
  • func (r Registry) Operation(name string) (OperationSpec, bool)
  • func (r Registry) Validate() error
  • func (r Registry) ValidateRequest(request Request) error
• type Request
• type Rule
• type Target
• type TargetMatcher
  • func (t *TargetMatcher) UnmarshalJSON(data []byte) error
• type TargetSpec

Functions

func FirstValue

func FirstValue(values []string) string

FirstValue returns the first canonical value or an empty string.

func MatchAll

func MatchAll(mode MatchMode, patterns []string, values []string) bool

MatchAll reports whether every concrete value satisfies a matcher.

func SingletonValues

func SingletonValues(values map[string]string) map[string][]string

SingletonValues converts provider scalar values into canonical policy lists.

Types

type AttrSpec

type AttrSpec struct {
	Match        MatchMode
	GrantMatch   MatchMode
	GrantMayOmit bool
}

AttrSpec describes one request attr.

type Decision

type Decision struct {
	Effect                Effect
	Allowed               bool
	Reason                string
	MatchedDenyRuleIDs    []string
	MatchedGrantRuleIDs   []string
	MatchedAllowRuleIDs   []string
	MatchedRequestRuleIDs []string
	GrantID               string
	GrantPolicy           *GrantPolicy
}

Decision is the result of policy evaluation.

type DecisionOptions

type DecisionOptions struct {
	ForGrantRequest bool
	Now             time.Time
	ActiveGrants    []Grant
}

DecisionOptions controls one evaluation.

type Effect

type Effect string

Effect is a rule or decision effect.

const (
	EffectAllow   Effect = "allow"
	EffectRequest Effect = "request"
	EffectDeny    Effect = "deny"
	EffectNoMatch Effect = "no_match"
)

type FieldSpec

type FieldSpec struct {
	Required bool
	Match    MatchMode
}

FieldSpec describes one target field.

type Grant

type Grant struct {
	ID        string
	Client    string
	Operation string
	Target    Target
	Attrs     map[string][]string
	ExpiresAt time.Time
	UsesLeft  int
	Unlimited bool
}

Grant is an active generated allow rule.

type GrantMode

type GrantMode string

GrantMode identifies the execution shape approved by a request rule.

const (
	GrantModeWindow    GrantMode = "window"
	GrantModeExecution GrantMode = "execution"
)

type GrantPolicy

type GrantPolicy struct {
	Mode              string          `json:"mode"`
	DefaultMinutes    int             `json:"default_minutes"`
	MaxMinutes        int             `json:"max_minutes"`
	RequestTTLMinutes int             `json:"request_ttl_minutes"`
	DefaultMaxUses    usebudget.Limit `json:"default_max_uses"`
	MaxUses           usebudget.Limit `json:"max_uses"`
}

GrantPolicy bounds requestable approval grants.

type MatchMode

type MatchMode string

MatchMode selects how a provider-owned policy field is matched.

const (
	// MatchGlob applies path.Match semantics. Wildcards do not cross '/'.
	MatchGlob MatchMode = "glob"
	// MatchAnyGlob accepts a value set when any concrete value matches.
	MatchAnyGlob MatchMode = "any_glob"
	// MatchPathGlob additionally permits a complete "**" path segment.
	MatchPathGlob MatchMode = "path_glob"
	// MatchRecursivePathGlob permits "**" anywhere and lets it cross '/'.
	MatchRecursivePathGlob MatchMode = "recursive_path_glob"
	// MatchPathOutsidePrefix accepts paths outside every configured prefix.
	MatchPathOutsidePrefix MatchMode = "path_outside_prefix"
	// MatchIntegerMaximum treats policy values as inclusive integer ceilings.
	MatchIntegerMaximum MatchMode = "integer_maximum"
)

type OperationSpec

type OperationSpec struct {
	TargetKinds []string
	Attrs       []string
	Grantable   bool
	GrantMode   GrantMode
	GrantModes  []GrantMode
}

OperationSpec describes one provider operation.

func (OperationSpec) AllowsGrantMode

func (op OperationSpec) AllowsGrantMode(mode GrantMode) bool

AllowsGrantMode reports whether a registered operation supports mode.

type Policy

type Policy struct {
	// contains filtered or unexported fields
}

Policy is a normalized policy document.

func LoadFile

func LoadFile(file string, registry Registry) (*Policy, error)

LoadFile reads and parses a policy file.

func Parse

func Parse(data []byte, registry Registry) (*Policy, error)

Parse parses a policy document.

func (*Policy) Decide

func (p *Policy) Decide(request Request, opts DecisionOptions) Decision

Decide evaluates one classified request.

func (*Policy) Rules

func (p *Policy) Rules() []Rule

Rules returns a copy of normalized rules for diagnostics and tests.

type Registry

type Registry struct {
	Operations map[string]OperationSpec
	Targets    map[string]TargetSpec
	Attrs      map[string]AttrSpec
}

Registry is provider-owned vocabulary for policy validation.

func (Registry) Operation

func (r Registry) Operation(name string) (OperationSpec, bool)

Operation returns a defensive copy of a registered operation.

func (Registry) Validate

func (r Registry) Validate() error

Validate checks that a provider registry is internally consistent.

func (Registry) ValidateRequest

func (r Registry) ValidateRequest(request Request) error

ValidateRequest checks a provider-classified request against the registry.

type Request

type Request struct {
	Client    string
	Operation string
	Target    Target
	Attrs     map[string][]string
}

Request is the provider-classified authorization unit.

type Rule

type Rule struct {
	ID          string
	Effect      Effect
	Clients     []string
	Operations  []string
	Targets     []TargetMatcher
	Attrs       map[string][]string
	GrantPolicy *GrantPolicy
	Description string
}

Rule is one normalized policy rule.

type Target

type Target struct {
	Kind   string
	Fields map[string][]string
}

Target identifies one provider resource.

type TargetMatcher

type TargetMatcher struct {
	Kind   string
	Fields map[string][]string
}

TargetMatcher is one target constraint in a rule.

func (*TargetMatcher) UnmarshalJSON

func (t *TargetMatcher) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes arbitrary string or string-array target fields.

type TargetSpec

type TargetSpec struct {
	Fields map[string]FieldSpec
}

TargetSpec describes one target kind.