Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MatchLabels ¶ added in v0.13.0
MatchLabels evaluates a filter Scope against a normalized label map. A nil scope matches everything (empty filter = match all). Semantics mirror the SQL evaluator in evidence.go (case-insensitive via pre-normalized map). Returns an error if an unknown query operator is encountered.
func NormalizeLabels ¶ added in v0.13.0
NormalizeLabels converts a slice of name/value label pairs into a map keyed by lowercased label name, with each value being a slice of lowercased values. This supports labels where a single name can have multiple values (e.g. multiple "_policy" labels on the same evidence).
Types ¶
type Condition ¶
type Condition struct {
Label string `json:"label,omitempty"` // Label name (e.g., "type", "group", "app").
Operator string `json:"operator,omitempty"` // Operator (e.g., "=", "!=", etc.).
Value string `json:"value,omitempty"` // Value for the condition (e.g., "ssh", "prod").
}
Condition represents a strict evaluation on a specific label. The Operator is a simple representation of the type of evaluation being made. Equals `=` and Not Equals `!=` are supported. In future Bigger Than `>`, Smaller Than `<` and potentially `LIKE` type searches can be supported.
type Filter ¶
type Filter struct {
Scope *Scope `json:"scope"`
}
Filter represents the overarching filter for this particular set of conditions. It can have a condition, which is simple, or a query, which in turn can have many subqueries. This object is the wrapper for an entire set of queries and conditions that make up a single filter.
type Query ¶
type Query struct {
Operator string `json:"operator"` // Logical operator (e.g., "AND", "OR").
Scopes []Scope `json:"scopes"` // Scopes can be either `Condition` or nested `Query`.
}
Query brings N Conditions or Queries together with a logical operator A Query can have SubQueries for searches such as:
<-condition-> <-------subquery-------> "label:value AND (label:foo OR label:bar)"
type Scope ¶
Scope represents a Sub Condition or Query which can be logically represented separately or within another Scope