Documentation
¶
Overview ¶
Package security provides fine-grained authorization for Scheme runtime operations. It defines the Authorizer interface and context helpers that gate primitives like file I/O, code loading, and process control.
The package has no dependencies on the rest of wile and can be imported independently.
Index ¶
Constants ¶
const ( ResourceFile = "file" ResourceCode = "code" ResourceEnv = "env" ResourceProcess = "process" )
Well-known resource constants. Extensions may define additional resources without modifying this package.
const ( ActionRead = "read" ActionWrite = "write" ActionDelete = "delete" ActionStat = "stat" ActionLoad = "load" ActionExit = "exit" )
Well-known action constants. Extensions may define additional actions without modifying this package.
Variables ¶
var ErrAccessDenied = werr.NewStaticError("access denied")
ErrAccessDenied is the sentinel error returned when an Authorizer denies an operation. Use errors.Is to check for it; the error may be wrapped with additional context by callers.
Functions ¶
func Check ¶
func Check(ctx context.Context, req AccessRequest) error
Check authorizes req against the Authorizer in ctx. If no Authorizer is set, the operation is allowed (open by default). Returns nil on success or a wrapped ErrAccessDenied on denial.
func WithAuthorizer ¶
func WithAuthorizer(ctx context.Context, auth Authorizer) context.Context
WithAuthorizer returns a child context carrying the given Authorizer. Primitives retrieve it via FromContext or Check.
Types ¶
type AccessRequest ¶
AccessRequest describes an operation that requires authorization. Resource and Action use well-known string constants defined below. Target is operation-specific (e.g., a file path, environment variable name, or library name).
type Authorizer ¶
type Authorizer interface {
Authorize(req AccessRequest) error
}
Authorizer decides whether an operation is allowed. Implementations must be safe for concurrent use.
Authorize returns nil to allow the operation, or an error wrapping ErrAccessDenied to deny it. Returning a non-nil error that does not wrap ErrAccessDenied is treated as a deny with an unexpected cause.
func All ¶
func All(authorizers ...Authorizer) Authorizer
All returns an Authorizer that requires every authorizer in the list to allow the operation. The first denial short-circuits and its error is returned. An empty list allows everything.
func FilesystemRoot ¶
func FilesystemRoot(root string) Authorizer
FilesystemRoot returns an Authorizer that restricts file and code operations to paths under root. Non-file/code resources are allowed.
Paths are cleaned and resolved to absolute form before comparison. Symlink traversal is NOT followed — this is a lexical check only. For production use with symlinks, resolve the root and targets with filepath.EvalSymlinks before constructing the authorizer.
func FromContext ¶
func FromContext(ctx context.Context) Authorizer
FromContext returns the Authorizer stored in ctx, or nil if none.
func ReadOnly ¶
func ReadOnly() Authorizer
ReadOnly returns an Authorizer that allows read and stat operations but denies write, delete, and exit.
type AuthorizerFunc ¶
type AuthorizerFunc func(AccessRequest) error
AuthorizerFunc adapts a plain function to the Authorizer interface.
func (AuthorizerFunc) Authorize ¶
func (p AuthorizerFunc) Authorize(req AccessRequest) error
Authorize implements Authorizer.
Source Files