Documentation
¶
Index ¶
- func AllowAllScope() capkit.ScopeChecker
- func AutoApprove() capkit.Approver
- func DenyAll() capkit.Approver
- func DenyAllScope() capkit.ScopeChecker
- func GateTraceFrom(ctx context.Context) []string
- func StaticScope(hosts ...string) capkit.ScopeChecker
- type ApproverFunc
- type Chain
- type JSONRedactor
- type Limiter
- type Redactor
- type ScopeFunc
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AllowAllScope ¶
func AllowAllScope() capkit.ScopeChecker
AllowAllScope is an explicit test/dev opt-in. Never use it in production.
func AutoApprove ¶
AutoApprove is an explicit test/dev opt-in. Never use it in production.
func GateTraceFrom ¶
GateTraceFrom returns the per-stage gate timings recorded by Before, e.g. ["scope:1ms", "approval:0ms", "ratelimit:0ms", "audit:2ms"]. It answers "why was this call slow" for agent and operator alike.
func StaticScope ¶
func StaticScope(hosts ...string) capkit.ScopeChecker
StaticScope allows exact hosts and their subdomains. IP/CIDR targets must match exactly. It is intentionally simple; real hosts should use their project-scope implementation.
Types ¶
type ApproverFunc ¶
type ApproverFunc func(ctx context.Context, req capkit.ApprovalRequest) error
ApproverFunc adapts a function to capkit.Approver.
func (ApproverFunc) Require ¶
func (f ApproverFunc) Require(ctx context.Context, req capkit.ApprovalRequest) error
type Chain ¶
type Chain struct {
Scope capkit.ScopeChecker
Approval capkit.Approver
Limiter capkit.Limiter
Audit capkit.AuditSink
Redactor Redactor
RequireApprovalAt capkit.Risk
Clock capkit.Clock
IDs capkit.IDGenerator
}
Chain is the mandatory gate sequence around every capability call: scope -> approval -> rate limit -> audit. It is not optional; the runtime always routes calls through it.
func (*Chain) Before ¶
func (c *Chain) Before(ctx context.Context, capName string, spec capkit.ToolSpec, call capkit.Call) (context.Context, func(capkit.Result, error), error)
Before validates targets, obtains approval and rate slots, and writes the start audit event. The returned finish function is idempotent and must be called by the runtime (typically deferred).
type JSONRedactor ¶
type JSONRedactor struct{}
JSONRedactor redacts well-known secret keys recursively. Unknown shapes are replaced with a marker rather than hashed raw.
func (JSONRedactor) Redact ¶
func (JSONRedactor) Redact(input json.RawMessage) json.RawMessage
type Limiter ¶
type Limiter struct {
// contains filtered or unexported fields
}
Limiter is a per-key token bucket plus a per-key concurrency semaphore. Keys are typically hostnames. The host injects it; kits cannot bypass it because the only HTTP/process entry points call Acquire.
func NewLimiter ¶
func NewLimiter() *Limiter
func NewLimiterWithClock ¶
type Redactor ¶
type Redactor interface {
Redact(input json.RawMessage) json.RawMessage
}
Redactor removes secret-looking fields before input hashing/audit.
Source Files