hookpolicy

package

v0.0.113 Latest Latest Go to latest Published: Oct 30, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/colony-2/c2j

Links

Open Source Insights

Documentation ¶

Overview ¶

Package hookpolicy implements per-hook tenant defaults and repository overrides. Configuration is administrative data; recipes can request but cannot create grants.

Index ¶

Constants
func CellKey(repository string) string
func Decode(raw []byte, out any) error
func Identity(repository string) (string, error)
func Intersect(a, b permissions.JobDB) permissions.JobDB
func Path(s string) (string, error)
func Reference(s string) (string, error)
type Document
- func Edit(s Snapshot, cell bool, hook, operation string, names []string, submit bool, ...) (Document, error)
- func (d Document) Validate(repository string) error
type Entry
- func Clone(e Entry) Entry
- func Empty() Entry
- func (e Entry) Authority(commit string, parent permissions.State, call *permissions.Spec) (permissions.State, error)
- func (e Entry) Validate() error
type Snapshot
- func Capture(s jobdb.ConfigurationSnapshot, repository string) (Snapshot, error)
- func (s Snapshot) Select(hook string) (Entry, string)
type SourceTrust
type Trust
- func (t Trust) Allows(commit string) bool
- func (t Trust) Validate() error

Constants ¶

View Source

const CellPrefix = "_c2j_hook_policy_cell_"

View Source

const TenantKey = "_c2j_hook_policy_tenant"

Variables ¶

This section is empty.

Functions ¶

func CellKey ¶

func CellKey(repository string) string

func Decode ¶

func Decode(raw []byte, out any) error

Decode rejects unknown, null and duplicate fields, including within perms.

func Identity ¶

func Identity(repository string) (string, error)

func Intersect ¶

func Intersect(a, b permissions.JobDB) permissions.JobDB

func Path ¶

func Path(s string) (string, error)

func Reference ¶

func Reference(s string) (string, error)

Types ¶

type Document ¶

type Document struct {
	Version    int              `json:"version"`
	Repository string           `json:"repository,omitempty"`
	Hooks      map[string]Entry `json:"hooks"`
}

func Edit ¶

func Edit(s Snapshot, cell bool, hook, operation string, names []string, submit bool, trust Trust, replace bool, entry *Entry) (Document, error)

Edit materializes inheritance for cell edits. An empty override remains explicit.

func (Document) Validate ¶

func (d Document) Validate(repository string) error

type Entry ¶

type Entry struct {
	Perms permissions.Spec `json:"perms"`
	Trust SourceTrust      `json:"source_trust,omitempty"`
}

func Clone ¶

func Clone(e Entry) Entry

func Empty ¶

func Empty() Entry

func (Entry) Authority ¶

func (e Entry) Authority(commit string, parent permissions.State, call *permissions.Spec) (permissions.State, error)

Authority bounds both driver input materialization and delegated operation access.

func (Entry) Validate ¶

func (e Entry) Validate() error

type Snapshot ¶

type Snapshot struct {
	Revision   string    `json:"revision"`
	Repository string    `json:"repository"`
	Tenant     *Document `json:"tenant,omitempty"`
	Cell       *Document `json:"cell,omitempty"`
}

Snapshot records absence as well as values; it is safe to persist in history.

func Capture ¶

func Capture(s jobdb.ConfigurationSnapshot, repository string) (Snapshot, error)

func (Snapshot) Select ¶

func (s Snapshot) Select(hook string) (Entry, string)

type SourceTrust ¶

type SourceTrust struct {
	Secrets map[string]Trust `json:"jobdb.secrets.resolve,omitempty"`
	Submit  *Trust           `json:"jobdb.jobs.submit,omitempty"`
}

type Trust ¶

type Trust struct {
	Mode   string `json:"mode"`
	Commit string `json:"commit,omitempty"`
}

func (Trust) Allows ¶

func (t Trust) Allows(commit string) bool

func (Trust) Validate ¶

func (t Trust) Validate() error

Source Files ¶

View all Source files

policy.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL