Documentation
¶
Overview ¶
Package security provides fine-grained authorization for Scheme runtime operations. It defines the Authorizer interface and context helpers that gate primitives like file I/O, code loading, and process control.
The package depends only on werr/ for error types and can be imported with minimal dependencies.
Index ¶
Constants ¶
const ( ResourceFile = "file" ResourceCode = "code" ResourceEnv = "env" ResourceProcess = "process" )
Well-known resource constants. Extensions may define additional resources without modifying this package.
const ( ActionRead = "read" ActionWrite = "write" ActionDelete = "delete" ActionStat = "stat" ActionLoad = "load" ActionExit = "exit" ActionExec = "exec" // structured process execution (process-spawn) ActionExecShell = "exec-shell" // shell command execution (system) )
Well-known action constants. Extensions may define additional actions without modifying this package.
Variables ¶
var ErrAccessDenied = werr.NewStaticError("access denied")
ErrAccessDenied is the sentinel error returned when an Authorizer denies an operation. Use errors.Is to check for it; the error may be wrapped with additional context by callers.
Functions ¶
func Check
deprecated
func Check(ctx context.Context, req AccessRequest) error
Check authorizes req against the Authorizer in ctx.
Deprecated: The authorizer now lives on Namespace, not context. Production gate sites use CheckWithAuthorizer(mc.Authorizer(), req). This function remains for backward compatibility but will always find nil (open by default) unless the caller explicitly injects an authorizer via WithAuthorizer(ctx, auth).
New code should use CheckWithAuthorizer directly.
func CheckWithAuthorizer ¶ added in v1.7.0
func CheckWithAuthorizer(auth Authorizer, req AccessRequest) error
CheckWithAuthorizer checks authorization using an explicit authorizer. Returns nil if auth is nil (open by default).
func WithAuthorizer ¶
func WithAuthorizer(ctx context.Context, auth Authorizer) context.Context
WithAuthorizer returns a child context carrying the given Authorizer. Primitives retrieve it via FromContext or Check.
Types ¶
type AccessRequest ¶
AccessRequest describes an operation that requires authorization. Resource and Action use well-known string constants defined below. Target is operation-specific (e.g., a file path, environment variable name, or library name).
type Authorizer ¶
type Authorizer interface {
Authorize(req AccessRequest) error
}
Authorizer decides whether an operation is allowed. Implementations must be safe for concurrent use.
Authorize returns nil to allow the operation, or an error wrapping ErrAccessDenied to deny it. Returning a non-nil error that does not wrap ErrAccessDenied is treated as a deny with an unexpected cause.
func All ¶
func All(authorizers ...Authorizer) Authorizer
All returns an Authorizer that requires every authorizer in the list to allow the operation. The first denial short-circuits and its error is returned. An empty list allows everything.
func FilesystemRoot ¶
func FilesystemRoot(root string) Authorizer
FilesystemRoot returns an Authorizer that restricts file and code operations to paths under root. Non-file/code resources are allowed.
Paths are cleaned and resolved to absolute form before comparison. Symlink traversal is NOT followed — this is a lexical check only. For production use with symlinks, resolve the root and targets with filepath.EvalSymlinks before constructing the authorizer.
func FromContext ¶
func FromContext(ctx context.Context) Authorizer
FromContext returns the Authorizer stored in ctx, or nil if none.
func ReadOnly ¶
func ReadOnly() Authorizer
ReadOnly returns an Authorizer that allows read and stat operations but denies write, delete, and exit.
type AuthorizerFunc ¶
type AuthorizerFunc func(AccessRequest) error
AuthorizerFunc adapts a plain function to the Authorizer interface.
func (AuthorizerFunc) Authorize ¶
func (p AuthorizerFunc) Authorize(req AccessRequest) error
Authorize implements Authorizer.
Source Files