Documentation
¶
Overview ¶
Package responsepolicy filters untrusted vendor responses into safe, schema-declared bytes. It owns Accept-Encoding decoding, bounds every dimension of the response, rejects ambiguous JSON, and applies manifest selectors so that FORWARD_SAFE fields are the only values that leave the host, secret-bearing fields are captured to a pre-authorized sink or reported only by presence, and everything undeclared is dropped. Any drift — a missing required field, a value of the wrong shape, or a sink failure — fails closed and forwards nothing.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Capture ¶
type Capture struct {
Selector string
Reference *providerv0.OpaqueReference
Outcome CaptureOutcome
}
Capture is the durable result of one capture selector.
type CaptureOutcome ¶
type CaptureOutcome string
CaptureOutcome is the explicit result vocabulary for a capture selector.
const ( OutcomeCaptured CaptureOutcome = "CAPTURED" OutcomeAbsent CaptureOutcome = "ABSENT" OutcomeSinkFailed CaptureOutcome = "SINK_FAILED" )
type Field ¶
type Field struct {
Selector manifest.Selector
Disposition manifest.ResponseDisposition
Purpose providerv0.CredentialPurpose
Required bool
SinkKey string
}
Field is one host-derived response disposition. It mirrors the manifest response field but adds host-decided required-ness and the pre-authorized sink key for captures.
type Forwarded ¶
type Forwarded struct {
Selector string
Value *providerv0.PublicValue
}
Forwarded is one safe field cleared for return to the provider.
type Limits ¶
type Limits struct {
MaxCompressedBytes int64
MaxDecompressedBytes int64
MaxDepth int
MaxKeys int
MaxArrayLen int
MaxStringBytes int
}
Limits bounds every dimension an untrusted vendor response can grow along. Zero fields are rejected by Validate so a caller cannot accidentally admit an unbounded response.
func DefaultLimits ¶
func DefaultLimits() Limits
DefaultLimits are conservative bounds for JSON management APIs.
type Policy ¶
Policy is the host-derived response policy for one admitted method/path/ status/content type.
func (Policy) Filter ¶
func (p Policy) Filter(ctx context.Context, raw []byte, contentEncoding, contentType string, sink Sink) (*Result, error)
Filter decodes, bounds, and filters a response body against the policy. It returns an error — and no partial result — whenever any declared behavior cannot be honored, so the caller can fail closed without ever forwarding original bytes.
func (Policy) RequiresBody ¶
RequiresBody reports whether any field must be present. A successful response with no body but a policy that requires a field is drift and must fail closed rather than silently report success — a vendor cannot skip a required capture by returning an empty body.
type Result ¶
Result is the fully filtered response. SafeJSON is a canonical projection containing only forwarded values and presence markers — never raw bytes.
type Sink ¶
type Sink interface {
Put(ctx context.Context, target SinkTarget, secret string) (*providerv0.OpaqueReference, error)
}
Sink durably stores a captured secret and returns only an opaque reference. The production backend is out of scope; the host injects a concrete Sink.
type SinkTarget ¶
type SinkTarget struct {
Purpose providerv0.CredentialPurpose
Key string
}
SinkTarget is the exact pre-authorized capture destination. It is derived by the host from the plan, never from provider input.
Source Files