boolpolicy

type AndNode ¶

type AndNode struct {
	Left, Right Node
}

AndNode represents Left AND Right.

func (a *AndNode) Eval(refs []bool) bool

func (a *AndNode) String() string

type AuditInfo ¶

type AuditInfo struct {
	IdentityAuditInfos []IdentityAuditInfo
}

AuditInfo represents the audit info of a policy identity. It is a sequence of per-component audit infos in the same order as Identities.

func (a *AuditInfo) Bytes() ([]byte, error)

func (a *AuditInfo) EnrollmentID() string

func (a *AuditInfo) RevocationHandle() string

type AuditInfoDeserializer ¶

type AuditInfoDeserializer struct{}

AuditInfoDeserializer deserialises raw audit info bytes into the AuditInfo struct for the enrollment-ID / revocation-handle path.

func (a *AuditInfoDeserializer) DeserializeAuditInfo(_ context.Context, _ driver.Identity, raw []byte) (driver2.AuditInfo, error)

type AuditInfoMatcher ¶

type AuditInfoMatcher interface {
	GetAuditInfoMatcher(ctx context.Context, owner driver.Identity, auditInfo []byte) (driver.Matcher, error)
}

AuditInfoMatcher builds a Matcher for a single component identity.

type IdentityAuditInfo ¶

type IdentityAuditInfo struct {
	AuditInfo []byte
}

IdentityAuditInfo holds the audit info bytes for one component identity.

type InfoMatcher ¶

type InfoMatcher struct {
	AuditInfoMatcher []tdriver.Matcher
}

InfoMatcher matches a policy identity against its own audit info.

func (e *InfoMatcher) Match(ctx context.Context, raw []byte) error

type Node ¶

type Node interface {
	// Eval evaluates the node against a slice of resolved boolean values.
	// A RefNode with index i returns refs[i]; out-of-range indices return false.
	Eval(refs []bool) bool
	String() string
}

Node is the common interface for all AST nodes produced by Parse.

func Parse(input string) (Node, error)

type OrNode ¶

type OrNode struct {
	Left, Right Node
}

OrNode represents Left OR Right.

func (o *OrNode) Eval(refs []bool) bool

func (o *OrNode) String() string

type PolicyIdentity ¶

type PolicyIdentity struct {
	// Policy is the policy expression string, e.g. "$0 OR ($1 AND $2)".
	// It is parsed at verification time via the boolexpr package.
	Policy string `asn1:"utf8"`
	// Identities is the ordered slice of component identities.
	// $0 refers to Identities[0], $1 to Identities[1], and so on.
	Identities [][]byte
}

PolicyIdentity holds a boolean policy expression and the ordered list of component identities that the $N references index into.

func Unwrap(raw []byte) (pi *PolicyIdentity, ok bool, err error)

func (p *PolicyIdentity) Bytes() ([]byte, error)

func (p *PolicyIdentity) Deserialize(raw []byte) error

func (p *PolicyIdentity) Serialize() ([]byte, error)

type PolicySignature ¶

type PolicySignature struct {
	Signatures [][]byte
}

PolicySignature is the on-wire signature envelope for a policy identity. It carries one slot per component identity; slots for parties that did not sign are left nil/empty. This allows OR policies to be satisfied by a strict subset of the component signers.

Wire format: ASN.1 SEQUENCE OF OCTET STRING (mirrors MultiSignature).

func (s *PolicySignature) Bytes() ([]byte, error)

func (s *PolicySignature) FromBytes(raw []byte) error

type PolicyVerifier ¶

type PolicyVerifier struct {
	// Policy is the parsed boolean AST, produced by Parse.
	Policy Node
	// Verifiers is indexed by $N; each entry verifies the corresponding
	// component identity's individual signature.
	Verifiers []driver.Verifier
}

PolicyVerifier verifies a PolicySignature against a parsed policy AST. It implements driver.Verifier.

Verification walks the policy AST:

• RefNode{i}: sigs[i] must be non-empty and Verifiers[i].Verify must succeed.
• AndNode: both sub-trees must verify successfully.
• OrNode: at least one sub-tree must verify successfully.

This means a valid PolicySignature need only carry signatures for the identities actually required by the satisfied policy branch.

func (v *PolicyVerifier) Verify(msg, sigBytes []byte) error

type RefNode ¶

type RefNode struct {
	Index int
}

RefNode references a single boolean value by its index (e.g. $3).

func (r *RefNode) Eval(refs []bool) bool

func (r *RefNode) String() string

type TypedIdentityDeserializer ¶

type TypedIdentityDeserializer struct {
	VerifierDeserializer VerifierDES
	AuditInfoMatcher     AuditInfoMatcher
}

TypedIdentityDeserializer handles the Policy identity type for both verifier deserialization and audit-info operations. It mirrors multisig.TypedIdentityDeserializer exactly.

func NewTypedIdentityDeserializer(verifierDeserializer VerifierDES, auditInfoMatcher AuditInfoMatcher) *TypedIdentityDeserializer

func (d *TypedIdentityDeserializer) DeserializeVerifier(ctx context.Context, typ identity.Type, raw []byte) (driver.Verifier, error)

func (d *TypedIdentityDeserializer) GetAuditInfo(ctx context.Context, id driver.Identity, typ identity.Type, rawIdentity []byte, p driver.AuditInfoProvider) ([]byte, error)

func (d *TypedIdentityDeserializer) GetAuditInfoMatcher(ctx context.Context, owner driver.Identity, auditInfo []byte) (driver.Matcher, error)

func (d *TypedIdentityDeserializer) Recipients(id driver.Identity, typ identity.Type, raw []byte) ([]driver.Identity, error)

type VerifierDES ¶

type VerifierDES interface {
	DeserializeVerifier(ctx context.Context, id driver.Identity) (driver.Verifier, error)
}

VerifierDES deserializes a single component identity into a driver.Verifier. The concrete implementation is the parent multiplex deserializer, so that policy identities containing any registered sub-type are handled correctly.