Documentation
¶
Overview ¶
Package shared holds value objects and errors common to all domain packages. It must not import any other internal package (innermost layer of the onion).
Index ¶
- Variables
- func CVSSBaseScore(vector string) (float64, bool)
- func CVSSv2BaseScore(vector string) (float64, bool)
- func CVSSv3BaseScore(vector string) (float64, bool)
- func CVSSv40BaseScore(vector string) (float64, bool)
- func IsMachineActor(actor string) bool
- func SeverityRank(s Severity) int
- func WithTenant(ctx context.Context, tenantID ID) context.Context
- type Audit
- type ID
- type Severity
Constants ¶
This section is empty.
Variables ¶
var ( ErrValidation = errors.New("validation error") ErrNotFound = errors.New("not found") ErrForbidden = errors.New("forbidden") // scope / authorization-window violations ErrConflict = errors.New("conflict") // optimistic-concurrency version mismatch (lost-update guard) ErrSaturated = errors.New("system saturated") // bounded admission rejected (backpressure → 503) )
Sentinel errors mapped to transport status codes by the adapter layer.
Functions ¶
func CVSSBaseScore ¶ added in v0.2.0
CVSSBaseScore scores a v4.0 vector, else a v3.x vector, else a v2 vector. Read paths that only display a number use it; paths that require v3 (the finding vector builder) keep calling CVSSv3BaseScore. The version prefixes are disjoint, so probe order never changes a result.
func CVSSv2BaseScore ¶ added in v0.2.0
CVSSv2BaseScore computes the CVSS v2 base score from a vector string, with or without the "CVSS:2.0/" prefix or the NVD parentheses ("(AV:N/AC:L/Au:N/C:P/I:P/A:P)"). Returns (0, false) for anything else. Distro advisories on older CVEs often carry only a v2 vector.
func CVSSv3BaseScore ¶
CVSSv3BaseScore computes the CVSS v3.0/v3.1 base score from a vector string (e.g. "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"). Returns (score, true) for a well-formed v3 vector, else (0, false). CVSS:4.0 vectors are scored by CVSSv40BaseScore.
func CVSSv40BaseScore ¶ added in v0.2.0
CVSSv40BaseScore computes the CVSS v4.0 score from a vector string per the FIRST.org CVSS v4.0 specification: the vector is reduced to a six-digit MacroVector (equivalence classes EQ1..EQ6), looked up, then interpolated by the severity distance from the highest-severity vector in the same MacroVector. Returns (score, true) for a well-formed v4.0 vector, else (0, false). Threat (E) and environmental metrics are honored when present; a base-only vector scores with their worst-case defaults (E:A, CR/IR/AR:H), matching the reference calculator. The lookup and max-severity tables are the published FIRST.org constants.
func IsMachineActor ¶ added in v0.1.8
IsMachineActor reports whether actor belongs to one of Synapse's reserved non-human principal families. Human-only decisions use this shared predicate so a newly added machine namespace cannot accidentally be denied in one governance workflow but accepted in another. Empty or whitespace-only identities deliberately return true: an absent authenticated actor must fail closed at authorization boundaries. Existing AI-triage callers already validate non-empty actor text before this predicate.
func SeverityRank ¶
SeverityRank orders severity from unknown (0) to critical (5); used for thresholds and tie-breaks.
Types ¶
type Audit ¶
type Audit struct {
CreatedAt time.Time
UpdatedAt time.Time
// CreatedBy / UpdatedBy attribute a record to the actor that created / last modified it
// (ownership). Empty = system/unknown (legacy rows, or write paths not yet wired).
// Engagements persist these; other record types carry the fields and adopt persistence
// incrementally – the canonical home so ownership is one shape across the domain.
CreatedBy string
UpdatedBy string
}
Audit holds common audit timestamps embedded by entities.
type ID ¶
type ID string
ID is a domain identifier (opaque string; generated by the platform layer).
const DefaultTenant ID = "default"
DefaultTenant is the non-empty tenant id the empty-string (single-tenant) default maps to. RLS tables treat the empty string as DENY, so the default deployment uses this id (it matches the fleet DefaultFleetTenant and the seeded 'default' tenant row). Use TenantOrDefault to normalize.
func TenantFrom ¶ added in v0.1.8
TenantFrom returns the explicitly bound tenant. Missing context is unsafe for RLS persistence.
func TenantOrDefault ¶ added in v0.1.8
TenantOrDefault returns id, or DefaultTenant when id is empty — so a single-tenant empty tenant and the fleet 'default' tenant resolve to the same RLS partition (letting, e.g., an image scan and the cluster/host agent that observes it correlate under one tenant).
type Severity ¶
type Severity string
Severity is the normalized severity scale shared by findings and vulnerabilities.
func SeverityFromLabel ¶ added in v0.2.0
SeverityFromLabel maps a curated qualitative severity label (GHSA/OSV database_specific.severity, NVD/distro labels) to a band. Case-insensitive; MODERATE and MEDIUM both map to medium. An unrecognized or empty label returns SeverityUnknown, so a caller can fall back to a score-derived band.
func SeverityFromScore ¶
SeverityFromScore maps a CVSS base score to the qualitative severity band.
Source Files