Documentation
¶
Overview ¶
Package cardtrust owns the single implementation of the "trusted card sender" predicate used by every server-authored display surface that must apply the Decision-2 residual-risk masking (card-message-protocol P1, round-3 P1-2): for a type-17 message, surface the stored `plain` only when the sender is a bot / webhook identity; otherwise mask to `[卡片]`.
Why a shared package: the predicate is a security boundary and will evolve (a second synthetic-sender prefix, bot-status/space scoping, …). Keeping it in ONE place makes drift impossible — previously webhook and messages_search each carried a private copy, so a hardening in one surface silently left the other leaking attacker-controlled plain.
Layering: this imports the table-backed modules/botidentity library only; robot, app_bot, and incomingwebhook do NOT import it, so there is no cycle. The `iwh_` prefix is re-declared here (production code must not cross-import modules/incomingwebhook per its display.go layering note); a test pins it to the exported contract constant.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver answers Trusted(fromUID). Construct ONCE per module (store on the handler/struct or a package singleton) so the LRU persists across the per-recipient push fan-out and across search pages — a large group's offline push then costs one identity query instead of one per recipient.
func (*Resolver) Trusted ¶
Trusted reports whether a type-17 message from fromUID may surface its stored plain. Webhook synthetic senders (iwh_ prefix) are trusted by construction; bot senders are resolved from active robot / published app_bot rows and cached. **Fail-closed**: on a lookup error the sender is treated as untrusted and the error verdict is NOT cached (so a transient DB blip cannot mask a legit bot's cards for the whole TTL).
Source Files