Documentation
¶
Overview ¶
Package gcpenforce applies the opt-in project-existence and API-enablement checks to every GCP emulator: one gRPC interceptor and one HTTP middleware, fed by an Enforcer that Resource Manager implements.
Index ¶
- func EchoMiddleware(ctx context.Context, t Target) echo.MiddlewareFunc
- func Exempt(fullMethod string) bool
- func FromMessage(msg proto.Message, paths ...string) string
- func FromRequest(r *http.Request, queryOnly bool) string
- func Middleware(ctx context.Context, t Target, next http.Handler) http.Handler
- func NewServer(ctx context.Context, host string, opts ...grpc.ServerOption) *grpc.Server
- func NewServerFor(ctx context.Context, t Target, opts ...grpc.ServerOption) *grpc.Server
- func OperationsPath(path string) bool
- func ServerOptions(ctx context.Context, t Target) []grpc.ServerOption
- func ServiceForMethod(fullMethod, fallback string) string
- func WithGate(ctx context.Context, g *Gate) context.Context
- func WithGateFrom[T any](ctx context.Context, candidates []T) context.Context
- type Enforcer
- type Gate
- type GateProvider
- type Settings
- type Target
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EchoMiddleware ¶
func EchoMiddleware(ctx context.Context, t Target) echo.MiddlewareFunc
EchoMiddleware is Middleware for an echo router; it is a pass-through when ctx carries no Gate.
func FromMessage ¶
FromMessage extracts the project a request targets. paths are per-method override field paths (dotted proto field names, such as "topic.name") tried first. It returns "" when the request names no project.
func FromRequest ¶
FromRequest extracts the project of a REST request: a projects/{id} path segment, else the project query parameter. With queryOnly the path is ignored (APIs whose object names may contain "projects/").
func Middleware ¶
Middleware wraps next, answering requests that fail the Gate with the Google JSON error envelope. It returns next unchanged when ctx carries no Gate.
func NewServer ¶
NewServer is grpc.NewServer with the enforcement interceptors added when ctx carries a Gate.
func NewServerFor ¶
NewServerFor is NewServer with per-method project overrides.
func OperationsPath ¶
OperationsPath reports whether an HTTP path addresses long-running operations.
func ServerOptions ¶
func ServerOptions(ctx context.Context, t Target) []grpc.ServerOption
ServerOptions returns the interceptors for a gRPC server serving t, or nil when enforcement is off in ctx.
func ServiceForMethod ¶
ServiceForMethod resolves "/google.pubsub.v1.Publisher/Publish" to "pubsub.googleapis.com" from the service's google.api.default_host option, falling back to fallback for services without one (google.iam.v1.IAMPolicy).
Types ¶
type Enforcer ¶
type Enforcer interface {
CheckProject(project, service string) error
CheckServiceEnabled(project, service string) error
}
Enforcer answers the two checks. project is a project id or number, with or without the "projects/" prefix.
type Gate ¶
Gate pairs an Enforcer with the switches that are on.
type GateProvider ¶
type GateProvider interface {
EnforcementGate() *Gate
}
GateProvider is implemented by the service that owns the Enforcer.
type Settings ¶
type Settings struct {
Projects bool `` //nolint:lll // config struct tags are intentionally verbose
/* 263-byte string literal not displayed */
ServiceEnablement bool `` //nolint:lll // config struct tags are intentionally verbose
/* 283-byte string literal not displayed */
}
Settings are the opt-in switches, embedded in the root CLI command as CLI.GCPEnforce.
type Target ¶
type Target struct {
// ProjectFields maps a gRPC full method to field paths holding the project when the generic scan is wrong.
ProjectFields map[string][]string
// Host is the API host used for services without a default_host option, and for REST.
Host string
// QueryOnly takes the REST project from the query string only.
QueryOnly bool
}
Target describes the API one gRPC server or HTTP listener serves.
Source Files