policy

Documentation

Index

• type Ability
  • func For(engine *Engine, remoteAddr string) *Ability
  • func (a *Ability) AuthorizeTimeline(ctx context.Context) error
  • func (a *Ability) AuthorizeWrite(ctx context.Context, entity *pb.Entity) error
  • func (a *Ability) CanRead(ctx context.Context, entity *pb.Entity) bool
• type Connection
• type Engine
  • func NewEngine(filePath string) (*Engine, error)
  • func (e *Engine) Close() error
  • func (e *Engine) Evaluate(ctx context.Context, input *Input) (bool, error)
• type Entity
• type Input

Types

type Ability

type Ability struct {
	// contains filtered or unexported fields
}

func For

func For(engine *Engine, remoteAddr string) *Ability

Creates an Ability bound to a remote identity, like source ip for now

func (*Ability) AuthorizeTimeline

func (a *Ability) AuthorizeTimeline(ctx context.Context) error

func (*Ability) AuthorizeWrite

func (a *Ability) AuthorizeWrite(ctx context.Context, entity *pb.Entity) error

func (*Ability) CanRead

func (a *Ability) CanRead(ctx context.Context, entity *pb.Entity) bool

type Connection

type Connection struct {
	SourceIP string `json:"source_ip"`
}

Connection holds connection-related info for policy evaluation

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

func NewEngine

func NewEngine(filePath string) (*Engine, error)

NewEngine creates a new OPA policy engine from a Rego file path If the file is invalid, it returns an error. After creation, the engine watches for file changes and auto-reloads if its valid

func (*Engine) Close

func (e *Engine) Close() error

func (*Engine) Evaluate

func (e *Engine) Evaluate(ctx context.Context, input *Input) (bool, error)

Evaluate evaluates the policy with the given input. Returns true if allowed, false otherwise.

type Entity

type Entity struct {
	ID         string `json:"id,omitempty"`
	Components []int  `json:"components,omitempty"` // proto field numbers present
}

Entity holds entity-related info for policy evaluation

type Input

type Input struct {
	Action     string     `json:"action"` // read, write, timeline
	Connection Connection `json:"connection"`
	Entity     Entity     `json:"entity,omitempty"`
}

Input is the structure passed to OPA for policy evaluation