criteria

Documentation

Overview

Package criteria contains all the pre-defined criteria as well as a registry to add new criteria.

Index

• Constants
• func NewCriterionDeviceRule(g *generator.Generator, name string, passReason, failReason Reason, ...) *ast.Rule
• func NewCriterionRule(g *generator.Generator, name string, passReason, failReason Reason, ...) *ast.Rule
• func NewCriterionSessionRule(g *generator.Generator, name string, passReason, failReason Reason, ...) *ast.Rule
• func NewCriterionTerm(value bool, reasons ...Reason) *ast.Term
• func NewCriterionTermWithAdditionalData(value bool, reason Reason, additionalData map[string]interface{}) *ast.Term
• func Register(criterionConstructor CriterionConstructor)
• type Criterion
  • func Accept(generator *Generator) Criterion
  • func AuthenticatedUser(generator *Generator) Criterion
  • func CORSPreflight(generator *Generator) Criterion
  • func Claims(generator *Generator) Criterion
  • func ClientCertificate(generator *Generator) Criterion
  • func Device(generator *Generator) Criterion
  • func Domain(generator *Generator) Criterion
  • func Email(generator *Generator) Criterion
  • func HTTPMethod(generator *Generator) Criterion
  • func HTTPPath(generator *Generator) Criterion
  • func InvalidClientCertificate(generator *Generator) Criterion
  • func Reject(generator *Generator) Criterion
  • func UserID(generator *Generator) Criterion
• type CriterionConstructor
  • func All() []CriterionConstructor
• type CriterionDataType
• type Generator
• type Reason
• type Reasons
  • func NewReasons(reasons ...Reason) Reasons
  • func (rs Reasons) Add(r Reason)
  • func (rs Reasons) Has(r Reason) bool
  • func (rs Reasons) Strings() []string
  • func (rs Reasons) Union(other Reasons) Reasons

Constants

const (
	ReasonAccept                        = "accept"
	ReasonClaimOK                       = "claim-ok"
	ReasonClaimUnauthorized             = "claim-unauthorized"
	ReasonClientCertificateOK           = "client-certificate-ok"
	ReasonClientCertificateUnauthorized = "client-certificate-unauthorized"
	ReasonClientCertificateRequired     = "client-certificate-required"
	ReasonCORSRequest                   = "cors-request"
	ReasonDeviceOK                      = "device-ok"
	ReasonDeviceUnauthenticated         = "device-unauthenticated"
	ReasonDeviceUnauthorized            = "device-unauthorized"
	ReasonDomainOK                      = "domain-ok"
	ReasonDomainUnauthorized            = "domain-unauthorized"
	ReasonEmailOK                       = "email-ok"
	ReasonEmailUnauthorized             = "email-unauthorized"
	ReasonHTTPMethodOK                  = "http-method-ok"
	ReasonHTTPMethodUnauthorized        = "http-method-unauthorized"
	ReasonHTTPPathOK                    = "http-path-ok"
	ReasonHTTPPathUnauthorized          = "http-path-unauthorized"
	ReasonInvalidClientCertificate      = "invalid-client-certificate"
	ReasonNonCORSRequest                = "non-cors-request"
	ReasonNonPomeriumRoute              = "non-pomerium-route"
	ReasonPomeriumRoute                 = "pomerium-route"
	ReasonReject                        = "reject"
	ReasonRouteNotFound                 = "route-not-found"
	ReasonUserOK                        = "user-ok"
	ReasonUserUnauthenticated           = "user-unauthenticated" // user needs to log in
	ReasonUserUnauthorized              = "user-unauthorized"    // user does not have access
	ReasonValidClientCertificate        = "valid-client-certificate"
)

Well-known reasons.

Functions

func NewCriterionDeviceRule

func NewCriterionDeviceRule(
	g *generator.Generator,
	name string,
	passReason, failReason Reason,
	body ast.Body,
	deviceType string,
) *ast.Rule

NewCriterionDeviceRule generates a new rule for a criterion which requires a device and session. If there is no device "device-unauthenticated" is returned. If there is no session "user-unauthenticated" is returned.

func NewCriterionRule

func NewCriterionRule(
	g *generator.Generator,
	name string,
	passReason, failReason Reason,
	body ast.Body,
) *ast.Rule

NewCriterionRule generates a new rule for a criterion.

func NewCriterionSessionRule

func NewCriterionSessionRule(
	g *generator.Generator,
	name string,
	passReason, failReason Reason,
	body ast.Body,
) *ast.Rule

NewCriterionSessionRule generates a new rule for a criterion which requires a session. If there is no session "user-unauthenticated" is returned.

func NewCriterionTerm

func NewCriterionTerm(value bool, reasons ...Reason) *ast.Term

NewCriterionTerm creates a new rego term for a criterion:

[true, {"reason"}]

func NewCriterionTermWithAdditionalData

func NewCriterionTermWithAdditionalData(value bool, reason Reason, additionalData map[string]interface{}) *ast.Term

NewCriterionTermWithAdditionalData creates a new rego term for a criterion with additional data:

[true, {"reason"}, {"key": "value"}]

func Register

func Register(criterionConstructor CriterionConstructor)

Register registers a criterion.

Types

type Criterion

type Criterion = generator.Criterion

A Criterion generates rego rules based on data.

func Accept

func Accept(generator *Generator) Criterion

Accept returns a Criterion which always returns true.

func AuthenticatedUser

func AuthenticatedUser(generator *Generator) Criterion

AuthenticatedUser returns a Criterion which returns true if the current user is logged in.

func CORSPreflight

func CORSPreflight(generator *Generator) Criterion

CORSPreflight returns a Criterion which returns true if the input request is a CORS preflight request.

func Claims

func Claims(generator *Generator) Criterion

Claims returns a Criterion on allowed IDP claims.

func ClientCertificate

func ClientCertificate(generator *Generator) Criterion

ClientCertificate returns a Criterion on a client certificate.

func Device

func Device(generator *Generator) Criterion

Device returns a Criterion based on the User's device state.

func Domain

func Domain(generator *Generator) Criterion

Domain returns a Criterion on a user's email address domain.

func Email

func Email(generator *Generator) Criterion

Email returns a Criterion on a user's email address.

func HTTPMethod

func HTTPMethod(generator *Generator) Criterion

HTTPMethod returns a Criterion which matches an HTTP method.

func HTTPPath

func HTTPPath(generator *Generator) Criterion

HTTPPath returns a Criterion which matches an HTTP path.

func InvalidClientCertificate

func InvalidClientCertificate(generator *Generator) Criterion

InvalidClientCertificate returns a Criterion which returns true if the client certificate is invalid.

func Reject

func Reject(generator *Generator) Criterion

Reject returns a Criterion which always returns false.

func UserID

func UserID(generator *Generator) Criterion

UserID returns a Criterion on a user's id.

type CriterionConstructor

type CriterionConstructor = generator.CriterionConstructor

A CriterionConstructor is a function which returns a Criterion for a Generator.

func All

func All() []CriterionConstructor

All returns all the known criterion constructors.

type CriterionDataType

type CriterionDataType = generator.CriterionDataType

The CriterionDataType indicates the expected type of data for the criterion.

const (
	// CriterionDataTypeCertificateMatcher indicates the expected data type is
	// a certificate matcher.
	CriterionDataTypeCertificateMatcher CriterionDataType = "certificate_matcher"
	// CriterionDataTypeStringListMatcher indicates the expected data type is a string list matcher.
	CriterionDataTypeStringListMatcher CriterionDataType = "string_list_matcher"
	// CriterionDataTypeStringMatcher indicates the expected data type is a string matcher.
	CriterionDataTypeStringMatcher CriterionDataType = "string_matcher"
)

type Generator

type Generator = generator.Generator

A Generator generates a rego script from a policy.

type Reason

type Reason string

A Reason is a reason for why a policy criterion passes or fails.

type Reasons

type Reasons map[Reason]struct{}

Reasons is a collection of reasons.

func NewReasons

func NewReasons(reasons ...Reason) Reasons

NewReasons creates a new Reasons collection.

func (Reasons) Add

func (rs Reasons) Add(r Reason)

Add adds a reason to the collection.

func (Reasons) Has

func (rs Reasons) Has(r Reason) bool

Has returns true if the reason is found in the collection.

func (Reasons) Strings

func (rs Reasons) Strings() []string

Strings returns the reason collection as a slice of strings.

func (Reasons) Union

func (rs Reasons) Union(other Reasons) Reasons

Union merges two reason collections together.