permissions

type Access ¶

type Access struct {
	// contains filtered or unexported fields
}

Access checks every use before consulting a resolver, including cached ones. Callbacks belong to the controller and are never serialized into task input.

func FromContext(ctx context.Context) *Access

func NewAccess(ctx context.Context, grant JobDB, resolve ResolveFunc, submit SubmitFunc) *Access

func (a *Access) CheckSecrets(names []string) error

func (a *Access) Context() context.Context

func (a *Access) Grant() JobDB

func (a *Access) LimitDeadline(deadline time.Time) context.CancelFunc

func (a *Access) Resolve(ctx context.Context, names []string) (jobdb.SecretResolveResult, error)

func (a *Access) Submit(ctx context.Context, job jobdb.SubmitJob) (jobref.Ref, error)

type InputPolicy ¶ added in v0.0.103

type InputPolicy struct {
	RootRepository string   `json:"root_repository,omitempty"`
	Foreign        bool     `json:"foreign,omitempty"`
	Allowed        []string `json:"allowed,omitempty"`
}

InputPolicy authorizes driver materialization, never delegated lease authority. RootRepository is fixed for the entire recipe, including nested includes.

type Issuer ¶

type Issuer interface {
	IssueRestrictedLease(context.Context, TaskDelegator, JobDB, time.Time) (jobdb.ExecutionLease, error)
}

Issuer is the single integration boundary for credential creation. The deadline is an optional operation limit; JobDB supplies execution bounds.

type JobDB ¶

type JobDB struct {
	Secrets SecretPermissions `yaml:"secrets,omitempty" json:"secrets,omitempty"`
	Jobs    JobPermissions    `yaml:"jobs,omitempty" json:"jobs,omitempty"`
}

func (p JobDB) Validate() error

type JobDBIssuer ¶

type JobDBIssuer struct{}

JobDBIssuer uses task-scoped local attenuation. The caller context controls cancellation only; its request timeout must not become a credential deadline.

func (i JobDBIssuer) IssueRestrictedLease(ctx context.Context, task TaskDelegator, grant JobDB, deadline time.Time) (jobdb.ExecutionLease, error)

type JobPermissions ¶

type JobPermissions struct {
	Submit bool `yaml:"submit,omitempty" json:"submit,omitempty"`
}

type Limit ¶

type Limit struct {
	JobDB *JobDB `yaml:"jobdb,omitempty" json:"jobdb,omitempty"`
}

type ResolveFunc ¶

type ResolveFunc func(context.Context, []string) (jobdb.SecretResolveResult, error)

type SecretPermissions ¶

type SecretPermissions struct {
	Resolve []string `yaml:"resolve,omitempty" json:"resolve,omitempty"`
}

type Spec ¶

type Spec struct {
	JobDB *JobDB `yaml:"jobdb,omitempty" json:"jobdb,omitempty"`
	Limit *Limit `yaml:"limit,omitempty" json:"limit,omitempty"`
}

Spec is common node metadata. On ordinary nodes JobDB replaces the delegated grant; on includes it authorizes callee inputs and bounds callee grants.

func (Spec) JSONSchema() *jsonschema.Schema

func (p *Spec) UnmarshalYAML(n *yaml.Node) error

func (p *Spec) Validate() error

type State ¶

type State struct {
	Version int          `json:"version"`
	Grant   *JobDB       `json:"grant,omitempty"`
	Limit   *JobDB       `json:"limit,omitempty"`
	Inputs  *InputPolicy `json:"inputs,omitempty"`
}

State is immutable lexical policy, serialized with each task invocation. Input authorization is independent of grants and automatic Git defaults.

func (s State) CheckInput(name string) error

func (s State) Enter(spec *Spec, boundary bool) (State, error)

func (s State) EnterInclude(spec *Spec, boundary, trusted bool) (State, error)

func (s State) Resolve(gitSecrets []string) (JobDB, error)

func (s *State) UnmarshalJSON(raw []byte) error

type SubmitFunc ¶

type SubmitFunc func(context.Context, jobdb.SubmitJob) (jobref.Ref, error)

type TaskDelegator ¶

type TaskDelegator interface {
	CreateDelegation(context.Context, jobdb.CreateDelegationRequest) (jobdb.RenewableExecutionLease, error)
}

TaskDelegator is the live task's engine-owned delegation capability. A copy of workflow.TaskContext preserves it; a reconstructed context does not.