Documentation
¶
Overview ¶
Package execution holds the shared server-side execution guard: engagement scope + legal authorization-window enforcement with append-only audit, applied BEFORE any tool runs. Both SCA and recon authorize through this one chokepoint – never a per-caller copy of a security-critical control. A divergent copy of the gate is the worst possible debt: scope enforcement and the append-only audit trail must live in exactly one place.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Guard ¶
type Guard struct {
// contains filtered or unexported fields
}
Guard authorizes tool executions against an engagement's scope and legal authorization window, recording every decision (allow and deny) on the append-only audit log.
func NewGuard ¶
func NewGuard(engagements ports.EngagementRepository, clock ports.Clock, audit ports.AuditLogger) (*Guard, error)
NewGuard validates its dependencies and returns the guard.
func (*Guard) AuditDenial ¶
AuditDenial records a denied execution that was rejected BEFORE reaching Authorize (e.g. a submit-time fast-fail in the recon use case: out-of-scope, capability, live-recon-disabled, invalid target). It exists so no denial path is silent – every refusal lands on the append-only audit log, exactly like the denials Authorize records itself.
func (*Guard) Authorize ¶
Authorize enforces the engagement lifecycle status, then the authorization window, then scope, then the rules of engagement (tool class + blackout), audits the decision, and returns the decision timestamp. The order is lifecycle -> time -> target -> RoE so a denial reason is unambiguous. On denial it audits "<action>.denied" with a reason and returns shared.ErrForbidden; the caller must not run any tool.
func (*Guard) AuthorizeEngagementArtifact ¶
AuthorizeEngagementArtifact enforces lifecycle, authorization window, and RoE for actions over an already engagement-scoped artifact. It deliberately skips target scope matching because the action does not execute against an external target; the artifact's engagement/tenant ownership is the boundary being authorized. This keeps artifact-backed scans on the shared execution/audit chokepoint without inventing a fake target.
type Request ¶
type Request struct {
Actor string
EngagementID shared.ID
Action string
Target engagement.Target
Metadata map[string]string
}
Request describes one tool execution to authorize. Action is the audit verb (e.g. "sca.scan", "recon.subfinder"); Target is the asset that will be acted on and is matched kind-aware against the engagement scope. Metadata is recorded verbatim on the audit entry (e.g. {"kind": "...", "engagement": "..."}).
Source Files