Documentation
¶
Index ¶
- func DefaultHTTPClient() *http.Client
- func NeedsCELCompat(s string) bool
- func ParseValidationEnvAllowlist(parts []string) map[string]struct{}
- func RewriteCELCompat(input string) (string, error)
- type EvalOptions
- type EvalResult
- type Program
- type Runtime
- func (e *Runtime) CompileFilter(expression string, tokenizer *tiktoken.Tiktoken) (Program, error)
- func (e *Runtime) CompilePrefilter(expression string) (Program, error)
- func (e *Runtime) CompileValidation(expression string) (Program, error)
- func (e *Runtime) Eval(prg Program, finding, captures map[string]string) (any, error)
- func (e *Runtime) EvalFilter(prg Program, finding map[string]any, attributes map[string]string) (bool, error)
- func (e *Runtime) EvalPrefilter(prg Program, attributes map[string]string) (bool, error)
- func (e *Runtime) EvalValidation(ctx context.Context, prg Program, ...) (EvalResult, error)
- func (e *Runtime) EvalValidationWithComponents(ctx context.Context, prg Program, finding, captures map[string]string, ...) (EvalResult, error)
- func (e *Runtime) EvalWithAttributes(prg Program, finding, captures, attributes map[string]string) (any, error)
- func (e *Runtime) EvalWithComponents(prg Program, finding, captures map[string]string, components map[string]any) (any, error)
- func (e *Runtime) EvalWithContext(ctx context.Context, prg Program, ...) (any, error)
- func (e *Runtime) SetHTTPClient(c *http.Client)
- func (e *Runtime) SetTokenizerProvider(provider func() *tiktoken.Tiktoken)
- func (e *Runtime) SetValidationRequestLimits(cfg ValidationRequestLimits) error
- type ValidationRequestLimitError
- type ValidationRequestLimitHit
- type ValidationRequestLimits
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultHTTPClient ¶
DefaultHTTPClient returns an HTTP client with reasonable timeouts.
func NeedsCELCompat ¶
func ParseValidationEnvAllowlist ¶
ParseValidationEnvAllowlist converts CLI flag fragments into a set of names.
func RewriteCELCompat ¶
RewriteCELCompat rewrites the CEL-shaped expression syntax used by existing configs into Expr syntax. It is intentionally narrow; unsupported CEL syntax should fail at Expr compile with both original and rewritten expressions.
Types ¶
type EvalOptions ¶
type EvalOptions struct {
Debug bool
}
type EvalResult ¶
type EvalResult struct {
Value any
Debug map[string]any
RequestLimitHit *ValidationRequestLimitHit
}
type Program ¶
type Program = *compiledProgram
Program is the compiled expression representation used by validation, filters, and prefilters.
type Runtime ¶
type Runtime struct {
// These endpoints are used for tests, not for real scans.
STSEndpoint string
GCPTokenEndpoint string
AzureTokenEndpoint string
AzureStorageEndpoint string
AzureAppConfigEndpoint string
AzureServiceBusEndpoint string
AllowedEnv map[string]struct{}
// contains filtered or unexported fields
}
Runtime holds compiled Expr programs and validation services (if needed).
func (*Runtime) CompileFilter ¶
func (*Runtime) CompilePrefilter ¶
func (*Runtime) CompileValidation ¶
func (*Runtime) EvalFilter ¶
func (e *Runtime) EvalFilter(prg Program, finding map[string]any, attributes map[string]string) (bool, error)
Compile and runtime bindings expose the same names. Dynamic values are layered onto a shallow copy so compiled programs can share static function bindings.
func (*Runtime) EvalPrefilter ¶
func (*Runtime) EvalValidation ¶
func (e *Runtime) EvalValidation(ctx context.Context, prg Program, finding, captures, attributes map[string]string, opts EvalOptions) (EvalResult, error)
func (*Runtime) EvalValidationWithComponents ¶ added in v1.7.4
func (e *Runtime) EvalValidationWithComponents(ctx context.Context, prg Program, finding, captures map[string]string, components map[string]any, attributes map[string]string, opts EvalOptions) (EvalResult, error)
EvalValidationWithComponents evaluates a validation program with structured component findings isolated from the primary rule's named capture groups.
func (*Runtime) EvalWithAttributes ¶
func (*Runtime) EvalWithComponents ¶ added in v1.7.4
func (e *Runtime) EvalWithComponents(prg Program, finding, captures map[string]string, components map[string]any) (any, error)
EvalWithComponents evaluates a validation program with primary named regex captures and structured component findings.
func (*Runtime) EvalWithContext ¶
func (*Runtime) SetHTTPClient ¶
func (*Runtime) SetTokenizerProvider ¶
func (*Runtime) SetValidationRequestLimits ¶ added in v1.7.1
func (e *Runtime) SetValidationRequestLimits(cfg ValidationRequestLimits) error
SetValidationRequestLimits applies request-level validation limits to the Runtime's shared HTTP client.
type ValidationRequestLimitError ¶ added in v1.7.1
type ValidationRequestLimitError struct {
Hit ValidationRequestLimitHit
}
ValidationRequestLimitError is returned by the validation HTTP transport when a target has exhausted its request budget.
func (*ValidationRequestLimitError) Error ¶ added in v1.7.1
func (e *ValidationRequestLimitError) Error() string
type ValidationRequestLimitHit ¶ added in v1.7.1
type ValidationRequestLimitHit struct {
RuleID string
Target string
MaxRequests int
RequestsSent int
}
ValidationRequestLimitHit describes a validation request rejected before it reached the provider.
type ValidationRequestLimits ¶ added in v1.7.1
type ValidationRequestLimits struct {
// MaxRequestsPerTarget is the maximum number of requests admitted to each
// target origin over the lifetime of the Runtime.
MaxRequestsPerTarget int
// RequestsPerSecond is the aggregate request rate across all validation
// targets and rules.
RequestsPerSecond float64
// RequestsPerSecondByRule contains exact rule-ID request rates. A rule rate
// composes with, rather than replaces, RequestsPerSecond.
RequestsPerSecondByRule map[string]float64
}
ValidationRequestLimits controls outbound validation requests. Zero values disable the corresponding limit.
Source Files