Documentation
¶
Overview ¶
Package approval defines the approval-gate backend abstraction. The server asks a Backend to request grants for a change's (class, target) gates, lists their state to decide whether a gate is satisfied, and revokes them after apply. The server never holds standing privilege — it only requests; humans approve in the backing provider. gcp-pam is the first real backend; Fake backs the tests.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Backend ¶
type Backend interface {
// RequestGrant ensures an open grant exists for req — create-or-reuse,
// idempotent: a second request for the same (class,target,pr,environment)
// returns the existing open grant rather than creating a duplicate.
RequestGrant(ctx context.Context, req Request) (Grant, error)
// ListGrants returns the grants on a (class, target) entitlement across all
// PRs (the caller filters by Request).
ListGrants(ctx context.Context, class, target string) ([]Grant, error)
// Revoke revokes the open grants matching req. Idempotent (a no-op when none).
Revoke(ctx context.Context, req Request) error
}
Backend is an approval provider. The server requests grants and reads their state; it can never approve (that is a human action in the provider).
type Fake ¶
type Fake struct {
// contains filtered or unexported fields
}
Fake is an in-memory Backend for tests. Grants start AWAITING; a test calls Approve to simulate an approver flipping a grant ACTIVE. Safe for concurrent use (the reconcile loop may call it while a test mutates it).
func (*Fake) Approve ¶
Approve flips the grant for req to ACTIVE (test-only: simulates an approver).
func (*Fake) ListGrants ¶
func (*Fake) RequestGrant ¶
type Grant ¶
type Grant struct {
Name string // backend-assigned resource name/id
State GrantState
Request Request // correlation, parsed back from the grant by the backend
Requester string // the requesting identity (populated by backends that pool requesters); "" when N/A
}
Grant is a backend's record of an approval grant for a Request.
type GrantState ¶
type GrantState string
GrantState is the lifecycle of an approval grant, normalised across backends.
const ( StateAwaiting GrantState = "AWAITING" // requested; awaiting an approver StateActivating GrantState = "ACTIVATING" // approved; becoming active StateActive GrantState = "ACTIVE" // approved and active StateDenied GrantState = "DENIED" StateRevoked GrantState = "REVOKED" StateExpired GrantState = "EXPIRED" )
func (GrantState) Open ¶
func (s GrantState) Open() bool
Open reports whether the state is a live, non-terminal grant.
Source Files
Directories