Documentation
¶
Overview ¶
Package policy decides how a type that cannot carry stash tags is encrypted, from what its schema says about each field.
Tags are the way to declare a type that you write. A policy is for a type that a schema generates, such as a protobuf message whose field options hold the field's data categories. A Source gives the facts about each field; a rule has a Matcher and a Decision; the first rule that matches a field decides it. stashgen.Generate runs the rules and writes the same generated file that it writes from tags. Only the generate program runs a policy.
Every field of the message needs a decision. A field that no rule decides stops the generator with the field's name and its annotations. A policy has an Otherwise rule only when its author writes one.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( Equality = IndexSpec{Name: "equality"} Ore = IndexSpec{Name: "ore"} Ope = IndexSpec{Name: "ope"} )
The indexes that take no options.
Functions ¶
This section is empty.
Types ¶
type Annotation ¶
Annotation is one annotation on a field: a key and its values. For a protobuf field option the key is the option's full name.
type Context ¶
type Context string
Context is the context of every field of a message, as the `context=` tag gives it for a struct.
type Decision ¶
type Decision struct {
// contains filtered or unexported fields
}
Decision is what a rule decides for a field: one of the tag verbs, or a refusal. A decision spells itself in the tag grammar, so the generator reads a policy's decision through the same parser as a tag.
func EncryptIndex ¶
EncryptIndex seals the field and derives each index beside it.
func EncryptInto ¶
EncryptInto seals the field into one EQL value of this type.
type Fact ¶
type Fact struct {
// Message is the full name of the message, for errors.
Message string
// Name is the field's name in the schema, such as the proto field name.
// It is the column name unless a rule gives another with [Name].
Name string
// GoName is the field of the Go struct the schema generated.
GoName string
// Kind is the field's kind in the schema's own words, such as "string" or
// "int64". Rules may match on it.
Kind string
// Annotations are what the schema says about the field, such as its
// data categories.
Annotations []Annotation
}
Fact is what a source knows about one field: its name, its Go name, its kind and its annotations. A policy reads facts and never learns where they came from.
type IndexName ¶
type IndexName string
IndexName is one of the tag words for an index: equality, match, ore, ope or json.
type IndexOption ¶
IndexOption is one option of an index, as the tag writes it in parentheses.
type IndexSpec ¶
type IndexSpec struct {
Name IndexName
Options []IndexOption
}
IndexSpec is one index with its options, as a rule names it: the engine's own word for the data form of an index.
func Match ¶
func Match(options ...IndexOption) IndexSpec
Match is the match index, with its options.
type Key ¶
type Key string
Key is an annotation key, such as the full name of a protobuf field option.
type MatcherFunc ¶
MatcherFunc is a Matcher made from a function.
type Message ¶
type Message struct {
// contains filtered or unexported fields
}
Message is one message with its context and its rules, as ForMessage builds it and stashgen.Generate reads it.
func ForMessage ¶
ForMessage binds a message to its context and the rules that decide its fields. The message is a value of the generated Go type, such as &pb.Individual{}; the source reads its schema and the generator its type.
type Option ¶
type Option func(*Outcome)
Option modifies a rule's outcome.
type Outcome ¶
type Outcome struct {
Decision Decision
// Name is the column name, or "" for the field's schema name.
Name string
// Identity is the field's part of its context, or "" for the column
// name. A field whose column is renamed keeps its identity, so data
// written before the change still decrypts.
Identity string
}
Outcome is a decision applied to one field: the decision, and the name and identity a rule's options set.
type Rule ¶
Rule decides a field, or reports that it does not match.
type Rules ¶
type Rules []Rule
Rules are rules tried in order; the first that matches decides.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package protosource reads the facts about a protobuf message's fields: each field's name, its Go name, its kind, and its options as annotations.
|
Package protosource reads the facts about a protobuf message's fields: each field's name, its Go name, its kind, and its options as annotations. |
|
internal/testpb
Package testpb is protoc-gen-go output for the protosource tests: the two messages of docs/plans/2026-10-04-plan-builder/proto, where classification.data_categories is a repeated string field option.
|
Package testpb is protoc-gen-go output for the protosource tests: the two messages of docs/plans/2026-10-04-plan-builder/proto, where classification.data_categories is a repeated string field option. |