Documentation
¶
Index ¶
- func AllowAllScope() core.ScopeChecker
- func AutoApprove() core.Approver
- func DenyAll() core.Approver
- func DenyAllScope() core.ScopeChecker
- func GateTraceFrom(ctx context.Context) []string
- func StaticScope(hosts ...string) core.ScopeChecker
- type ApproverFunc
- type Chain
- type JSONRedactor
- type Limiter
- type Redactor
- type ScopeFunc
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AllowAllScope ¶
func AllowAllScope() core.ScopeChecker
AllowAllScope is an explicit test/dev opt-in. Never use it in production.
func AutoApprove ¶
AutoApprove is an explicit test/dev opt-in. Never use it in production.
func GateTraceFrom ¶
GateTraceFrom returns the per-stage gate timings recorded by Before, e.g. ["scope:1ms", "approval:0ms", "ratelimit:0ms", "audit:2ms"]. It answers "why was this call slow" for agent and operator alike.
func StaticScope ¶
func StaticScope(hosts ...string) core.ScopeChecker
StaticScope allows exact hosts and their subdomains. IP/CIDR targets must match exactly. It is intentionally simple; real hosts should use their project-scope implementation.
Types ¶
type ApproverFunc ¶
type ApproverFunc func(ctx context.Context, req core.ApprovalRequest) error
ApproverFunc adapts a function to core.Approver.
func (ApproverFunc) Require ¶
func (f ApproverFunc) Require(ctx context.Context, req core.ApprovalRequest) error
type Chain ¶
type Chain struct {
Scope core.ScopeChecker
Approval core.Approver
Limiter core.Limiter
Audit core.AuditSink
Redactor Redactor
RequireApprovalAt core.Risk
Clock core.Clock
IDs core.IDGenerator
}
Chain is the mandatory gate sequence around every capability call: scope -> approval -> rate limit -> audit. It is not optional; the runtime always routes calls through it.
func (*Chain) Before ¶
func (c *Chain) Before(ctx context.Context, capName string, spec core.ToolSpec, call core.Call) (context.Context, func(core.Result, error), error)
Before validates targets, obtains approval and rate slots, and writes the start audit event. The returned finish function is idempotent and must be called by the runtime (typically deferred).
type JSONRedactor ¶
type JSONRedactor struct{}
JSONRedactor redacts well-known secret keys recursively. Unknown shapes are replaced with a marker rather than hashed raw.
func (JSONRedactor) Redact ¶
func (JSONRedactor) Redact(input json.RawMessage) json.RawMessage
type Limiter ¶
type Limiter struct {
// contains filtered or unexported fields
}
Limiter is a per-key token bucket plus a per-key concurrency semaphore. Keys are typically hostnames. The host injects it; kits cannot bypass it because the only HTTP/process entry points call Acquire.
func NewLimiter ¶
func NewLimiter() *Limiter
func NewLimiterWithClock ¶
type Redactor ¶
type Redactor interface {
Redact(input json.RawMessage) json.RawMessage
}
Redactor removes secret-looking fields before input hashing/audit.
Source Files