Documentation
¶
Overview ¶
Package approve records the commands a human has agreed to run.
R2 permits an argv[0] outside the default allowlist -- `bin/dev`, `./scripts/setup.sh` -- because refusing them outright means people fork the project, and because the script is committed, reviewable repository content rather than a model-derived shell string. What makes that safe is the second half of the rule: a human sees the exact argv once and agrees to it.
Until this package existed, devbay printed the approval and ran the command anyway. That is the worst of both designs -- the developer is trained to scroll past a warning, and the rule provides no boundary at all. So the approval now blocks, and because blocking on every single run would be intolerable, it is remembered.
Index ¶
- func Key(project string, argv []string) string
- type Record
- type Store
- func (s *Store) Close() error
- func (s *Store) Grant(ctx context.Context, r Record) error
- func (s *Store) Granted(ctx context.Context, project string, argv []string) bool
- func (s *Store) List(ctx context.Context, project string) ([]Record, error)
- func (s *Store) Revoke(ctx context.Context, key string) (bool, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Key ¶
Key is the identity of an approval: the project and the exact argv.
Hashing the whole array rather than argv[0] is the point of the rule. A developer who approves bin/dev has approved that script, not every future invocation of it with arguments they never saw -- so [bin/dev, --seed-prod] is a different command and asks again.
Types ¶
type Record ¶
type Record struct {
// Key identifies the approval; see Key.
Key string
// Project scopes it. Approving `bin/dev` for one repository must not
// approve a file of the same name in another, because the thing being
// approved is that repository's script, not the string.
Project string
// At is where in the manifest it appeared, kept for display only -- moving
// a command from install: to start: does not change what it does.
At string
Argv []string
// When and By record who took the decision, so an audit answers "who let
// this run" rather than only "it was allowed".
When time.Time
By string
}
Record is one approved command.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store is the record of what has been approved.
func Open ¶
Open prepares the store. An empty path uses ~/.devbay/state.db, the same file the rest of devbay's state lives in.
Source Files