host

Documentation

Index

• func CheckRequirements(ctx context.Context, handler RequirementsHandler, req *sdk.Requirements) bool
• func NewProviderFromSelection(types []*sdkpb.TeeTypeAndRegions) func(tee *sdkpb.Tee) bool
• func NewTeeProvider(tpe sdkpb.TeeType, regions []string) func(tee *sdkpb.Tee) bool
• type EncryptionKeyFetcher
• type ExecutionHelper
  • func NewRestrictedExecutionHelper(inner ExecutionHelper, r *sdk.Restrictions) ExecutionHelper
• type ExecutionHelperWithRawSecrets
• type Module
  • func NewRequirementSelectingModule(main ModuleAndHandler, additional []ModuleAndHandler) Module
• type ModuleAndHandler
• type ModuleBase
• type RequirementEnforcingModule
• type RequirementsHandler
• type RestrictionAwareModule

Functions

func CheckRequirements

func CheckRequirements(ctx context.Context, handler RequirementsHandler, req *sdk.Requirements) bool

CheckRequirements calls each non-nil callback in the handler for the corresponding non-nil field in req, returning false if any are false, or if the handler is nil. Unknown fields on the proto also result in a false return value.

func NewProviderFromSelection

func NewProviderFromSelection(types []*sdkpb.TeeTypeAndRegions) func(tee *sdkpb.Tee) bool

func NewTeeProvider

func NewTeeProvider(tpe sdkpb.TeeType, regions []string) func(tee *sdkpb.Tee) bool

Types

type EncryptionKeyFetcher

type EncryptionKeyFetcher interface {
	GetEncryptionKeys(ctx context.Context) ([]string, error)
}

type ExecutionHelper

type ExecutionHelper interface {
	// CallCapability blocking call to the Workflow Engine
	CallCapability(ctx context.Context, request *sdkpb.CapabilityRequest) (*sdkpb.CapabilityResponse, error)
	GetSecrets(ctx context.Context, request *sdkpb.GetSecretsRequest) ([]*sdkpb.SecretResponse, error)

	GetWorkflowExecutionID() string

	GetNodeTime() time.Time

	GetDONTime() (time.Time, error)

	EmitUserLog(log string) error

	EmitUserMetric(ctx context.Context, metric *wfpb.WorkflowUserMetric) error
}

ExecutionHelper Implemented by those running the host, for example the Workflow Engine

func NewRestrictedExecutionHelper

func NewRestrictedExecutionHelper(inner ExecutionHelper, r *sdk.Restrictions) ExecutionHelper

NewRestrictedExecutionHelper wraps ExecutionHelper with restriction enforcement derived from r. If inner implements ExecutionHelperWithRawSecrets, the returned value will as well. If r is nil, ExecutionHelper is returned unchanged.

type ExecutionHelperWithRawSecrets

type ExecutionHelperWithRawSecrets interface {
	ExecutionHelper
	GetRawSecrets(ctx context.Context, request *sdkpb.GetSecretsRequest, fetcher EncryptionKeyFetcher) ([]*vault.SecretResponse, error)
	GetOwner() string
}

type Module

type Module interface {
	ModuleBase

	// V2/"NoDAG" API - request either the list of Trigger Subscriptions or launch workflow execution
	Execute(ctx context.Context, request *sdkpb.ExecuteRequest, handler ExecutionHelper) (*sdkpb.ExecutionResult, error)
}

func NewRequirementSelectingModule

func NewRequirementSelectingModule(main ModuleAndHandler, additional []ModuleAndHandler) Module

NewRequirementSelectingModule creates a module that routes trigger executions based on subscription requirements. main is prepended as modules[0]; additional modules follow. Subscribe always runs on modules[0].

type ModuleAndHandler

type ModuleAndHandler struct {
	Module
	RequirementsHandler
}

type ModuleBase

type ModuleBase interface {
	Start()
	Close()
	IsLegacyDAG() bool
}

type RequirementEnforcingModule

type RequirementEnforcingModule interface {
	Module

	// SetRequirements must respect the requirements for the execution until it completes
	SetRequirements(executionId string, requirements *sdkpb.Requirements)
}

type RequirementsHandler

type RequirementsHandler struct {
	Tee func(context.Context, *sdk.Tee) bool
}

RequirementsHandler contains a callback for each public field in sdk.Requirements. Each callback receives the field value and returns a boolean indicating whether the requirement is satisfied.

type RestrictionAwareModule

type RestrictionAwareModule interface {
	Module

	// SetRestrictions must respect the restrictions for the execution until it completes
	SetRestrictions(executionId string, restrictions *sdkpb.Restrictions)
}

RestrictionAwareModule allows the module to know of the user-enforced restrictions. Enforcement by this module is NOT to be trusted by the host, however a violation is considered an indicator of a serious issue, such as compromise.