Documentation
¶
Overview ¶
Package compliance builds access reviews and signed evidence packs from data the platform already records. It is evidence for an auditor to examine, not a certification of any control framework.
Index ¶
- Constants
- Variables
- func Build(ctx context.Context, out io.Writer, meta Meta, sections []Section, ...) error
- func Redact(v any) (any, error)
- func Snapshot(ctx context.Context, db *store.DB) ([]store.AccessReviewItem, error)
- type Actor
- type CompleteResult
- type FileCheck
- type FileEntry
- type Manifest
- type Meta
- type Report
- type Section
- type Service
- func (s *Service) Complete(ctx context.Context, campaignID string, by Actor) (CompleteResult, error)
- func (s *Service) CreateCampaign(ctx context.Context, name string, dueDays, repeatDays int, by Actor) (store.AccessReviewCampaign, error)
- func (s *Service) Decide(ctx context.Context, campaignID, itemID, decision string, by Actor) error
- func (s *Service) DefaultSections(from, to time.Time) []Section
- func (s *Service) Overdue(ctx context.Context) ([]store.AccessReviewCampaign, error)
- func (s *Service) PackPath(p store.EvidencePack) string
- func (s *Service) Recover(ctx context.Context) error
- func (s *Service) RunScheduler(ctx context.Context, every time.Duration)
- func (s *Service) StartPack(ctx context.Context, from, to time.Time, by Actor) (store.EvidencePack, error)
- func (s *Service) Store() *store.DB
- func (s *Service) VerifyPack(ctx context.Context, id string) (Report, error)
- func (s *Service) Wait()
- type Signer
- type Source
- type UserRemover
Constants ¶
const ( ActionAccessRevoked = "compliance.access_revoked" ActionReviewCompleted = "compliance.access_review_completed" ActionPackGenerated = "compliance.evidence_pack_generated" )
Audit action names written by this package.
const ( // Statement is embedded in every manifest so the archive states its own limits. Statement = "" /* 140-byte string literal not displayed */ )
Variables ¶
var ( // ErrUndecided is returned when a campaign still has rows without a decision. ErrUndecided = errors.New("compliance: every row needs a keep or revoke decision before completing") // ErrApplyFailed is returned when at least one revocation could not be applied. ErrApplyFailed = errors.New("compliance: some revocations could not be applied") // ErrInvalidRange is returned for an empty, inverted or oversized date range. ErrInvalidRange = errors.New("compliance: date range must be positive and at most 366 days") // ErrPackNotReady is returned when downloading a pack that is not complete. ErrPackNotReady = errors.New("compliance: evidence pack is not complete") )
Functions ¶
func Build ¶
func Build(ctx context.Context, out io.Writer, meta Meta, sections []Section, signer *Signer, progress func(step string, done, total int)) error
Build streams sections into a zip on out, then appends the manifest and its detached signature. A returned error means out holds an incomplete archive the caller must discard.
Types ¶
type Actor ¶
type Actor struct{ Type, ID, Name string }
Actor is the human or token performing a change.
type CompleteResult ¶
type CompleteResult struct {
Revoked int
Failures []store.AccessReviewItem
}
CompleteResult says what completing a campaign did.
type FileCheck ¶
type FileCheck struct {
Name string `json:"name"`
OK bool `json:"ok"`
Reason string `json:"reason,omitempty"`
}
FileCheck is the verification result for one archived file.
type FileEntry ¶
type FileEntry struct {
Name string `json:"name"`
SHA256 string `json:"sha256"`
Bytes int64 `json:"bytes"`
}
FileEntry is one archived file in the manifest.
type Manifest ¶
type Manifest struct {
Version int `json:"version"`
PackID string `json:"pack_id"`
GeneratedAt string `json:"generated_at"`
RangeFrom string `json:"range_from"`
RangeTo string `json:"range_to"`
KeyID string `json:"key_id"`
Algorithm string `json:"signature_algorithm"`
Statement string `json:"statement"`
Files []FileEntry `json:"files"`
}
Manifest lists every file of a pack and what the pack covers.
type Report ¶
type Report struct {
Valid bool `json:"valid"`
SignatureChecked bool `json:"signature_checked"`
SignatureValid bool `json:"signature_valid"`
KeyID string `json:"key_id,omitempty"`
Files []FileCheck `json:"files"`
}
Report is the outcome of verifying a pack.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service owns access review campaigns and evidence pack generation.
func NewService ¶
func NewService(ctx context.Context, db *store.DB, dir string, signer *Signer, security Source, users UserRemover, logger *slog.Logger) *Service
NewService returns a service writing packs under dir. ctx bounds every background generation job.
func (*Service) Complete ¶
func (s *Service) Complete(ctx context.Context, campaignID string, by Actor) (CompleteResult, error)
Complete applies every revoke decision, then closes the campaign. When any revocation fails the campaign stays open, successes stay applied, and the failures are returned for the reviewer to retry or keep.
func (*Service) CreateCampaign ¶
func (s *Service) CreateCampaign(ctx context.Context, name string, dueDays, repeatDays int, by Actor) (store.AccessReviewCampaign, error)
CreateCampaign snapshots current access into a new open campaign.
func (*Service) DefaultSections ¶
DefaultSections returns the evidence files for [from, to).
func (*Service) PackPath ¶
func (s *Service) PackPath(p store.EvidencePack) string
PackPath is where a complete pack's archive lives.
func (*Service) RunScheduler ¶
RunScheduler opens the next campaign of a repeating series once the previous one is completed and its interval has elapsed.
func (*Service) StartPack ¶
func (s *Service) StartPack(ctx context.Context, from, to time.Time, by Actor) (store.EvidencePack, error)
StartPack records a running pack and generates it in the background.
func (*Service) VerifyPack ¶
VerifyPack re-checks a stored pack against its manifest and signature.
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer produces and checks detached HMAC-SHA256 signatures. The key is a derived value, never the master key.
Source Files