guard

Documentation

Overview

Package guard provides a deterministic authorization policy engine. No scripting: decisions come from explicit rules. Default deny.

Index

• type Constraint
• type Decision
• type Engine
  • func New() *Engine
  • func (e *Engine) AddRule(r Rule) error
  • func (e *Engine) Evaluate(req Request) Decision
  • func (e *Engine) Explain(req Request) Explanation
  • func (e *Engine) Rules() []Rule
• type Explanation
• type Request
• type Rule

Types

type Constraint

type Constraint struct {
	MaxTTLSeconds int               `json:"max_ttl_seconds,omitempty"`
	Resources     []string          `json:"resources,omitempty"`
	Attrs         map[string]string `json:"attrs,omitempty"`
}

Constraint limits an AllowWithConstraints decision.

type Decision

type Decision string

Decision is the result of Evaluate.

const (
	Allow                Decision = "allow"
	Deny                 Decision = "deny"
	RequireApproval      Decision = "require-approval"
	RequireQuorum        Decision = "require-quorum"
	AllowWithConstraints Decision = "allow-with-constraints"
)

type Engine

type Engine struct {
	// contains filtered or unexported fields
}

Engine evaluates requests. Default decision is Deny.

func New

func New() *Engine

New creates an empty deny-by-default engine.

func (*Engine) AddRule

func (e *Engine) AddRule(r Rule) error

AddRule appends a rule.

func (*Engine) Evaluate

func (e *Engine) Evaluate(req Request) Decision

Evaluate returns the decision for req (default Deny).

func (*Engine) Explain

func (e *Engine) Explain(req Request) Explanation

Explain returns the decision and reason trail.

func (*Engine) Rules

func (e *Engine) Rules() []Rule

Rules returns a copy of rules for inspection.

type Explanation

type Explanation struct {
	Decision    Decision    `json:"decision"`
	MatchedRule string      `json:"matched_rule,omitempty"`
	Reason      string      `json:"reason"`
	Constraints *Constraint `json:"constraints,omitempty"`
	Trail       []string    `json:"trail,omitempty"`
}

Explanation is a stable, inspectable reason trail.

type Request

type Request struct {
	Principal  string
	Permission string
	Resource   string
	Action     string
	Attrs      map[string]string
}

Request is evaluated against rules.

type Rule

type Rule struct {
	Name        string
	Principal   string
	Permission  string
	Resource    string
	Action      string
	Decision    Decision
	Constraints *Constraint
	Priority    int // higher wins
}

Rule is a deterministic match → decision mapping. Empty Principal/Permission/Resource/Action means wildcard for that field.