Documentation
¶
Overview ¶
Package engine deterministically evaluates and aggregates SQL security rules.
Index ¶
Constants ¶
const ( // DialectAll makes a rule applicable to every supported SQL dialect. DialectAll model.DBDialect = "all" )
Variables ¶
var ( // ErrInvalidInput indicates that an evaluation input is incomplete or invalid. ErrInvalidInput = errors.New("invalid engine input") // ErrInvalidRule indicates that a rule contract is incomplete or inconsistent. ErrInvalidRule = errors.New("invalid rule") // ErrInvalidRuleConfig indicates that layered rule configuration is invalid. ErrInvalidRuleConfig = errors.New("invalid rule configuration") // ErrRuleEvaluation indicates that a rule could not produce a trustworthy result. ErrRuleEvaluation = errors.New("rule evaluation failed") )
Functions ¶
This section is empty.
Types ¶
type Engine ¶
type Engine struct{}
Engine evaluates rules without retaining state or performing external I/O.
func (Engine) Evaluate ¶
func (Engine) Evaluate( ast *model.AST, evalContext EvalContext, rules []Rule, layers RuleLayers, ) (model.Assessment, error)
Evaluate applies ordered rules and aggregates deny > approve > warn > allow.
type EvalContext ¶
type EvalContext struct {
AST *model.AST
AgentLevel string
Agent *model.Agent
Datasource *model.Datasource
Policy *model.PolicyDecision
MetadataProvider any
Thresholds map[string]float64
// RuntimeResult is present only after a bounded query result has been validated.
RuntimeResult *model.QueryResult
}
EvalContext contains the immutable inputs available to a rule evaluation. MetadataProvider intentionally remains an unconstrained slot until T06 defines its domain methods; the engine never invokes or mutates it.
type Rule ¶
type Rule interface {
ID() string
Dialect() model.DBDialect
Level() model.RiskLevel
Enabled() bool
Eval(EvalContext) (RuleResult, error)
}
Rule evaluates one AST and returns an explainable four-state conclusion. Implementations must be deterministic and safe for concurrent calls.
type RuleConfig ¶
RuleConfig overrides one rule at a single configuration layer. ExplicitDeny is sticky across all later layers.
type RuleLayer ¶
type RuleLayer map[string]RuleConfig
RuleLayer maps rule IDs to their settings at one ownership level.
type RuleLayers ¶
RuleLayers are merged from Global to Datasource to Agent. Callers must not mutate the maps while an evaluation is in progress.
Source Files