evaluator

Documentation

Overview

Package evaluator contains rego evaluators for evaluating authorize policy.

Index

• Variables
• type Evaluator
  • func New(ctx context.Context, store *store.Store, options ...Option) (*Evaluator, error)
  • func (e *Evaluator) Evaluate(ctx context.Context, req *Request) (*Result, error)
• type HeadersEvaluator
  • func NewHeadersEvaluator(ctx context.Context, store *store.Store) (*HeadersEvaluator, error)
  • func (e *HeadersEvaluator) Evaluate(ctx context.Context, req *HeadersRequest) (*HeadersResponse, error)
• type HeadersRequest
  • func NewHeadersRequestFromPolicy(policy *config.Policy) *HeadersRequest
• type HeadersResponse
• type Option
  • func WithAuthenticateURL(authenticateURL string) Option
  • func WithClientCA(clientCA []byte) Option
  • func WithGoogleCloudServerlessAuthenticationServiceAccount(serviceAccount string) Option
  • func WithJWTClaimsHeaders(headers config.JWTClaimHeaders) Option
  • func WithPolicies(policies []config.Policy) Option
  • func WithSigningKey(signingKey string) Option
• type PolicyEvaluator
  • func NewPolicyEvaluator(ctx context.Context, store *store.Store, configPolicy *config.Policy) (*PolicyEvaluator, error)
  • func (e *PolicyEvaluator) Evaluate(ctx context.Context, req *PolicyRequest) (*PolicyResponse, error)
• type PolicyRequest
• type PolicyResponse
  • func NewPolicyResponse() *PolicyResponse
• type Request
• type RequestHTTP
  • func NewRequestHTTP(method string, requestURL url.URL, headers map[string]string, ...) RequestHTTP
• type RequestSession
• type Result
• type RuleResult
  • func MergeRuleResultsWithOr(results ...RuleResult) RuleResult
  • func NewRuleResult(value bool, reasons ...criteria.Reason) RuleResult

Variables

var (
	GCPIdentityTokenExpiration       = time.Minute * 45 // tokens expire after one hour according to the GCP docs
	GCPIdentityDocURL                = "http://metadata/computeMetadata/v1/instance/service-accounts/default/identity"
	GCPIdentityNow                   = time.Now
	GCPIdentityMaxBodySize     int64 = 1024 * 1024 * 10
)

GCP pre-defined values.

Types

type Evaluator

type Evaluator struct {
	// contains filtered or unexported fields
}

An Evaluator evaluates policies.

func New

func New(ctx context.Context, store *store.Store, options ...Option) (*Evaluator, error)

New creates a new Evaluator.

func (*Evaluator) Evaluate

func (e *Evaluator) Evaluate(ctx context.Context, req *Request) (*Result, error)

Evaluate evaluates the rego for the given policy and generates the identity headers.

type HeadersEvaluator

type HeadersEvaluator struct {
	// contains filtered or unexported fields
}

A HeadersEvaluator evaluates the headers.rego script.

func NewHeadersEvaluator

func NewHeadersEvaluator(ctx context.Context, store *store.Store) (*HeadersEvaluator, error)

NewHeadersEvaluator creates a new HeadersEvaluator.

func (*HeadersEvaluator) Evaluate

func (e *HeadersEvaluator) Evaluate(ctx context.Context, req *HeadersRequest) (*HeadersResponse, error)

Evaluate evaluates the headers.rego script.

type HeadersRequest

type HeadersRequest struct {
	EnableGoogleCloudServerlessAuthentication bool           `json:"enable_google_cloud_serverless_authentication"`
	EnableRoutingKey                          bool           `json:"enable_routing_key"`
	FromAudience                              string         `json:"from_audience"`
	KubernetesServiceAccountToken             string         `json:"kubernetes_service_account_token"`
	ToAudience                                string         `json:"to_audience"`
	Session                                   RequestSession `json:"session"`
	PassAccessToken                           bool           `json:"pass_access_token"`
	PassIDToken                               bool           `json:"pass_id_token"`
}

HeadersRequest is the input to the headers.rego script.

func NewHeadersRequestFromPolicy

func NewHeadersRequestFromPolicy(policy *config.Policy) *HeadersRequest

NewHeadersRequestFromPolicy creates a new HeadersRequest from a policy.

type HeadersResponse

type HeadersResponse struct {
	Headers http.Header
}

HeadersResponse is the output from the headers.rego script.

type Option

type Option func(*evaluatorConfig)

An Option customizes the evaluator config.

func WithAuthenticateURL

func WithAuthenticateURL(authenticateURL string) Option

WithAuthenticateURL sets the authenticate URL in the config.

func WithClientCA

func WithClientCA(clientCA []byte) Option

WithClientCA sets the client CA in the config.

func WithGoogleCloudServerlessAuthenticationServiceAccount

func WithGoogleCloudServerlessAuthenticationServiceAccount(serviceAccount string) Option

WithGoogleCloudServerlessAuthenticationServiceAccount sets the google cloud serverless authentication service account in the config.

func WithJWTClaimsHeaders

func WithJWTClaimsHeaders(headers config.JWTClaimHeaders) Option

WithJWTClaimsHeaders sets the JWT claims headers in the config.

func WithPolicies

func WithPolicies(policies []config.Policy) Option

WithPolicies sets the policies in the config.

func WithSigningKey

func WithSigningKey(signingKey string) Option

WithSigningKey sets the signing key and algorithm in the config.

type PolicyEvaluator

type PolicyEvaluator struct {
	// contains filtered or unexported fields
}

A PolicyEvaluator evaluates policies.

func NewPolicyEvaluator

func NewPolicyEvaluator(ctx context.Context, store *store.Store, configPolicy *config.Policy) (*PolicyEvaluator, error)

NewPolicyEvaluator creates a new PolicyEvaluator.

func (*PolicyEvaluator) Evaluate

func (e *PolicyEvaluator) Evaluate(ctx context.Context, req *PolicyRequest) (*PolicyResponse, error)

Evaluate evaluates the policy rego scripts.

type PolicyRequest

type PolicyRequest struct {
	HTTP                     RequestHTTP    `json:"http"`
	Session                  RequestSession `json:"session"`
	IsValidClientCertificate bool           `json:"is_valid_client_certificate"`
}

PolicyRequest is the input to policy evaluation.

type PolicyResponse

type PolicyResponse struct {
	Allow, Deny RuleResult
	Traces      []contextutil.PolicyEvaluationTrace
}

PolicyResponse is the result of evaluating a policy.

func NewPolicyResponse

func NewPolicyResponse() *PolicyResponse

NewPolicyResponse creates a new PolicyResponse.

type Request

type Request struct {
	Policy  *config.Policy
	HTTP    RequestHTTP
	Session RequestSession
}

Request contains the inputs needed for evaluation.

type RequestHTTP

type RequestHTTP struct {
	Method            string            `json:"method"`
	Path              string            `json:"path"`
	URL               string            `json:"url"`
	Headers           map[string]string `json:"headers"`
	ClientCertificate string            `json:"client_certificate"`
	IP                string            `json:"ip"`
}

RequestHTTP is the HTTP field in the request.

func NewRequestHTTP

func NewRequestHTTP(
	method string,
	requestURL url.URL,
	headers map[string]string,
	rawClientCertificate string,
	ip string,
) RequestHTTP

NewRequestHTTP creates a new RequestHTTP.

type RequestSession

type RequestSession struct {
	ID string `json:"id"`
}

RequestSession is the session field in the request.

type Result

type Result struct {
	Allow   RuleResult
	Deny    RuleResult
	Headers http.Header
	Traces  []contextutil.PolicyEvaluationTrace
}

Result is the result of evaluation.

type RuleResult

type RuleResult struct {
	Value          bool
	Reasons        criteria.Reasons
	AdditionalData map[string]interface{}
}

A RuleResult is the result of evaluating a rule.

func MergeRuleResultsWithOr

func MergeRuleResultsWithOr(results ...RuleResult) RuleResult

MergeRuleResultsWithOr merges all the results using `or`.

func NewRuleResult

func NewRuleResult(value bool, reasons ...criteria.Reason) RuleResult

NewRuleResult creates a new RuleResult.