Documentation
¶
Overview ¶
Package decide is lockhttp's decision engine: one request (a CONNECT seen at the domain, or a decrypted or plain HTTP request) and the approved policy in, a verdict out: FREE, ASK or DENY. It holds no state; the gate's grants and single-use authorisations are checked by the gate between Floor and Evaluate.
Index ¶
Constants ¶
const ScoreThreshold = 3
ScoreThreshold is the exfiltration score from which a request asks (in enforce mode) or is flagged (shadow).
const UploadSize = 64 << 10
UploadSize is the body size from which a write counts as an upload.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Credentials ¶
type Credentials interface {
// Known reports whether the check is on, and whether the sha256 hex of
// the credential belongs to container (or to keyproxy when via is
// "keyproxy").
Known(container, via, sha256hex string) (on, ok bool)
}
Credentials knows the hashes of the credentials each container (and keyproxy) may send to the Claude API.
type Decision ¶
type Decision struct {
Verdict Verdict
// Rule names what decided: a policy rule id, or a built-in
// ("floor:ip-literal", "trusted", "claude:messages", "default:write").
Rule string
// Code is the refusal code of a DENY (and of an ASK refused).
Code refusal.Code
Reason string
// Warnings are shown in red on the approval screen and audited.
Warnings []string
// NeverAuto: auto mode may not answer this ASK.
NeverAuto bool
// Red frames the approval screen in red.
Red bool
// Score is the exfiltration score; Shadow is what the policy would
// have decided had it been enforced ("ask", "deny"), when shadow
// mode let the request pass.
Score int
Shadow Verdict
// Class names the request's class (read, write, upload, messaging,
// publish, receive-pack, websocket, claude, internal, connect).
Class string
}
Decision is the engine's answer.
func Evaluate ¶
Evaluate decides a request that passed the floor and matched no grant. p nil means the gate has no approved policy: only the Claude hosts are free, everything else asks.
type Request ¶
type Request struct {
Phase Phase
Container string
// Via is direct, keyproxy or nested.
Via string
Method string
// Host is the target host name (lower case, no port); Port its port.
Host string
Port int
// SNI is the TLS server name the client sent ("" when none or not
// peeked).
SNI string
Path string
RawQuery string
Header http.Header
// BodyLen is the body length, -1 when unknown (chunked); Body the
// buffered body when the gate holds it (nil otherwise).
BodyLen int64
Body []byte
// TLS reports a decrypted HTTPS request (PhaseHTTP).
TLS bool
}
Request is what the gate knows of a request.
Source Files