Documentation
¶
Index ¶
Constants ¶
const HeritageV1 = "wfinfra-v1"
Variables ¶
var ( ErrMultipleDefaults = errors.New("dnspolicy: multiple RRs set d=true") ErrEmptyOwner = errors.New("dnspolicy: o= field is empty") // ErrUnknownHeritage is reserved for future use. Parse() currently silently // skips RRs with unknown heritage values to preserve forward-compatibility; // a future stricter parser variant may return this error. ErrUnknownHeritage = errors.New("dnspolicy: unknown heritage value (parser ignored RR)") )
Functions ¶
func MatchPattern ¶
MatchPattern returns true if name matches pattern. Pattern syntax:
"@" matches the apex literal "@" "*" matches a SINGLE DNS label segment "**" matches one or more label segments "<literal>.<rest>" matches recursively
All matches are case-sensitive (DNS names are case-insensitive by spec but our pattern compare requires lowercase normalization at call sites).
Types ¶
type Adapter ¶
type Adapter interface {
DNSPolicyReader
DNSRecordWriter
}
Adapter combines policy R/W and record R/W in one type. dnsprovider.NewAdapter returns this combined interface.
type DNSPolicyReader ¶
type DNSPolicyReader interface {
GetTXT(ctx context.Context, name string) ([]string, error)
UpsertTXT(ctx context.Context, name string, values []string, ttl int) error
}
DNSPolicyReader is the narrow interface the gate needs. Tests mock this directly; only 2 methods to fake.
type DNSRecordWriter ¶
type DNSRecordWriter interface {
UpsertRecord(ctx context.Context, zone, name, recordType, data string, ttl, priority int32) (recordID string, err error)
DeleteRecord(ctx context.Context, zone, name, recordType string) error
}
DNSRecordWriter performs arbitrary DNS record mutations (post-gate).
type Policy ¶
func Parse ¶
Parse parses TXT RR strings (one per RR) into a Policy. Unknown heritage values are silently skipped (forward-compat).
func (*Policy) CheckAllowed ¶
CheckAllowed returns nil if owner may upsert (name, recordType) under this policy. Returns an error describing the denial otherwise.
Priority semantics (closes plan-cycle-1 C-3):
- Explicit pattern claims take precedence over default-owner fallback.
- If any owner (including non-caller) has an explicit pattern matching (name, recordType), only that owner may mutate.
- Default owner catches only unmatched records.
- SOA/NS protected unless explicitly listed in the owner's Types.
Source Files