Documentation
¶
Index ¶
- type Compiler
- type ExecutionGraph
- type Graph
- func (g *Graph) AddRule(actionID string, set RequirementSet) error
- func (g *Graph) BindByCapability(capabilityID string, set RequirementSet) error
- func (g *Graph) ContentHash() (string, error)
- func (g *Graph) Validate(actionID string, artifacts []*pkg_artifact.ArtifactEnvelope) (bool, string, error)
- type LogicOperator
- type Node
- type PolicyEngine
- func (pe *PolicyEngine) Evaluate(expression string, input map[string]interface{}) (bool, error)
- func (pe *PolicyEngine) EvaluateRequirementSet(rs RequirementSet, input map[string]interface{}) (bool, error)
- func (pe *PolicyEngine) WarmGraph(g *Graph) error
- func (pe *PolicyEngine) WarmRequirementSet(rs *RequirementSet) error
- type Requirement
- type RequirementSet
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Compiler ¶
type Compiler struct {
}
Compiler converts high-level policy bundles into a PRG.
func NewCompiler ¶
type ExecutionGraph ¶
type ExecutionGraph struct {
RootNode *Node
}
ExecutionGraph is the compiled representation.
type Graph ¶
type Graph struct {
Rules map[string]RequirementSet
}
Graph maps an ActionID to its RequirementSet (Policy).
func (*Graph) BindByCapability ¶
func (g *Graph) BindByCapability(capabilityID string, set RequirementSet) error
BindByCapability explicitly binds a policy to a verified capability ID (GAP-05).
func (*Graph) ContentHash ¶
ContentHash computes a content-addressed hash of the entire policy graph. GOV-001: Used by Guardian to tie DecisionRecords to exact policy state.
func (*Graph) Validate ¶
func (g *Graph) Validate(actionID string, artifacts []*pkg_artifact.ArtifactEnvelope) (bool, string, error)
Validate checks if the artifacts satisfy the requirements for the action.
type LogicOperator ¶
type LogicOperator string
LogicOperator defines how requirements are combined.
const ( AND LogicOperator = "AND" OR LogicOperator = "OR" NOT LogicOperator = "NOT" )
type Node ¶
type Node struct {
Operator LogicOperator
Expr string // CEL expression
Subs []*Node
// Pre-compiled checks (logic-less optimization)
Req Requirement
}
type PolicyEngine ¶
type PolicyEngine struct {
// contains filtered or unexported fields
}
PolicyEngine evaluates PRG requirements against context.
func NewPolicyEngine ¶
func NewPolicyEngine() (*PolicyEngine, error)
func (*PolicyEngine) Evaluate ¶
func (pe *PolicyEngine) Evaluate(expression string, input map[string]interface{}) (bool, error)
func (*PolicyEngine) EvaluateRequirementSet ¶
func (pe *PolicyEngine) EvaluateRequirementSet(rs RequirementSet, input map[string]interface{}) (bool, error)
EvaluateRequirementSet recursively evaluates a RequirementSet against the input.
func (*PolicyEngine) WarmGraph ¶
func (pe *PolicyEngine) WarmGraph(g *Graph) error
func (*PolicyEngine) WarmRequirementSet ¶
func (pe *PolicyEngine) WarmRequirementSet(rs *RequirementSet) error
type Requirement ¶
type Requirement struct {
ID string `json:"id"`
Description string `json:"description"`
// Legacy Artifact Check (Optional shortcut)
ArtifactType string `json:"artifact_type,omitempty"`
SignerID string `json:"signer_id,omitempty"`
// CEL Expression (The Node 8 core feature)
// Input: "intent", "state", "artifacts" (list of artifacts)
Expression string `json:"expression,omitempty"`
// contains filtered or unexported fields
}
Requirement defines a logic condition. For Node 8 (PRG), we upgrade this to support both legacy artifact checks AND CEL.
type RequirementSet ¶
type RequirementSet struct {
ID string `json:"id"`
Logic LogicOperator `json:"logic"`
Requirements []Requirement `json:"requirements"`
Children []RequirementSet `json:"children"`
}
RequirementSet is a recursive logic tree.
func (*RequirementSet) Hash ¶
func (rs *RequirementSet) Hash() string
Hash computes a deterministic content-addressed digest of the requirement set. The result (sha256:<hex>) is bound into DecisionRecord.RequirementSetHash, so it must be a fixed-width, collision-resistant digest rather than a hex dump of the raw content string.
Source Files