Documentation
¶
Overview ¶
Package security provides fine-grained authorization for Scheme runtime operations. It defines the Authorizer interface and context helpers that gate primitives like file I/O, code loading, and process control.
The package depends only on werr/ for error types and can be imported with minimal dependencies.
Index ¶
- Constants
- Variables
- func Check(ctx context.Context, req AccessRequest) errordeprecated
- func CheckWithAuthorizer(auth Authorizer, req AccessRequest) error
- func WithAuthorizer(ctx context.Context, auth Authorizer) context.Context
- type AccessRequest
- type Authorizer
- func All(authorizers ...Authorizer) Authorizer
- func ConsoleAuthorizer() Authorizer
- func ConsoleWithLoadAuthorizer() Authorizer
- func DenyAll() Authorizer
- func FilesystemRoot(root string) Authorizer
- func FromContext(ctx context.Context) Authorizer
- func ReadOnly() Authorizer
- func SandboxAuthorizer(envPrefix string) Authorizer
- type AuthorizerFunc
Constants ¶
const ( ResourceFile = "file" ResourceCode = "code" ResourceEnv = "env" ResourceProcess = "process" )
Well-known resource constants. Extensions may define additional resources without modifying this package.
const ( ActionRead = "read" ActionWrite = "write" ActionDelete = "delete" ActionStat = "stat" ActionLoad = "load" ActionExit = "exit" ActionExec = "exec" // structured process execution (process-spawn) ActionExecShell = "exec-shell" // shell command execution (system) )
Well-known action constants. Extensions may define additional actions without modifying this package.
Variables ¶
var ErrAccessDenied = werr.NewStaticError("access denied")
ErrAccessDenied is the sentinel error returned when an Authorizer denies an operation. Use errors.Is to check for it; the error may be wrapped with additional context by callers.
Functions ¶
func Check
deprecated
func Check(ctx context.Context, req AccessRequest) error
Check authorizes req against the Authorizer in ctx.
Deprecated: The authorizer now lives on Namespace, not context. Production gate sites use CheckWithAuthorizer(mc.Authorizer(), req). This function remains for backward compatibility but will always find nil (open by default) unless the caller explicitly injects an authorizer via WithAuthorizer(ctx, auth).
New code should use CheckWithAuthorizer directly.
func CheckWithAuthorizer ¶ added in v1.7.0
func CheckWithAuthorizer(auth Authorizer, req AccessRequest) error
CheckWithAuthorizer checks authorization using an explicit authorizer. Returns nil if auth is nil (open by default).
func WithAuthorizer ¶
func WithAuthorizer(ctx context.Context, auth Authorizer) context.Context
WithAuthorizer returns a child context carrying the given Authorizer. Primitives retrieve it via FromContext or Check.
Types ¶
type AccessRequest ¶
AccessRequest describes an operation that requires authorization. Resource and Action use well-known string constants defined below. Target is operation-specific (e.g., a file path, environment variable name, or library name).
type Authorizer ¶
type Authorizer interface {
Authorize(req AccessRequest) error
}
Authorizer decides whether an operation is allowed. Implementations must be safe for concurrent use.
Authorize returns nil to allow the operation, or an error wrapping ErrAccessDenied to deny it. Returning a non-nil error that does not wrap ErrAccessDenied is treated as a deny with an unexpected cause.
func All ¶
func All(authorizers ...Authorizer) Authorizer
All returns an Authorizer that requires every authorizer in the list to allow the operation. The first denial short-circuits and its error is returned. An empty list allows everything.
func ConsoleAuthorizer ¶ added in v1.14.244
func ConsoleAuthorizer() Authorizer
ConsoleAuthorizer returns an Authorizer for the Console profile. File operations are restricted to /tmp. Environment variable reads are allowed (the envvars primitive handles virtual-vs-OS routing). Code loading and process execution are denied.
func ConsoleWithLoadAuthorizer ¶ added in v1.14.244
func ConsoleWithLoadAuthorizer() Authorizer
ConsoleWithLoadAuthorizer returns an Authorizer for the ConsoleWithLoad profile. File operations and code loading are both restricted to /tmp. Environment variable reads are allowed. Process execution is denied.
This is the security envelope wile-goast and similar embedders use to run sandboxed (eval ...) and (load ...) on Scheme files staged in /tmp.
func FilesystemRoot ¶
func FilesystemRoot(root string) Authorizer
FilesystemRoot returns an Authorizer that restricts file and code operations to paths under root. Non-file/code resources are allowed.
Paths are cleaned and resolved to absolute form before comparison. Symlink traversal is NOT followed — this is a lexical check only. For production use with symlinks, resolve the root and targets with filepath.EvalSymlinks before constructing the authorizer.
func FromContext ¶
func FromContext(ctx context.Context) Authorizer
FromContext returns the Authorizer stored in ctx, or nil if none.
func ReadOnly ¶
func ReadOnly() Authorizer
ReadOnly returns an Authorizer that allows read and stat operations but denies write, delete, and exit.
func SandboxAuthorizer ¶ added in v1.14.244
func SandboxAuthorizer(envPrefix string) Authorizer
SandboxAuthorizer returns an Authorizer that allows read-only file access, env reads with a prefix filter, and denies code loading and process execution.
Intended as a restrictive modifier that can be composed with a profile's built-in authorizer via All() to produce an intersection (most-restrictive-wins).
type AuthorizerFunc ¶
type AuthorizerFunc func(AccessRequest) error
AuthorizerFunc adapts a plain function to the Authorizer interface.
func (AuthorizerFunc) Authorize ¶
func (p AuthorizerFunc) Authorize(req AccessRequest) error
Authorize implements Authorizer.
Source Files