policy

package
v0.3.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 2, 2026 License: MIT Imports: 7 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Validate 

func Validate(expression string) error

Validate checks that expression is a boolean CEL program.

func ValidateString 

func ValidateString(expression string) error

ValidateString checks that expression is a string CEL program (for dynamic action values).

Types

type Credential 

type Credential struct {
	ID           string
	Name         string
	StorageKind  string
	IsBYOK       bool
	ProviderType string
}

Credential is optional BYOK metadata for CEL (resolved before Open).

func CredentialFromSnapshot 

func CredentialFromSnapshot(snap *snapshot.Snapshot, providerType string, key snapshot.APIKey, overrideName string) Credential

CredentialFromSnapshot builds CEL credential metadata without opening the secret.

type Decision 

type Decision struct {
	Allowed          bool
	DeniedBy         string
	CredentialName   string
	RequestHeaders   map[string]string // outbound headers to merge onto provider request
	MatchedAllowName string            // short-circuit allow policy name, if any
}

Decision is the result of applying when/then policies in priority order.

type Evaluator 

type Evaluator struct {
	// contains filtered or unexported fields
}

Evaluator compiles and runs when/then CEL policies.

func NewEvaluator 

func NewEvaluator() (*Evaluator, error)

NewEvaluator builds a shared CEL environment.

func (*Evaluator) Apply 

func (e *Evaluator) Apply(policies []snapshot.Policy, key snapshot.APIKey, req Request, cred Credential) (Decision, error)

Apply walks enabled policies by priority (desc). When Expression is true, runs each Then action in order:

  • deny → stop, deny
  • allow → stop, allow (short-circuit)
  • set_header → set outbound header (later writes overwrite), continue
  • use_credential → set credential name (later writes overwrite), continue

Default (no deny / no short-circuit allow): allow.

type Request 

type Request struct {
	Model   string
	Path    string
	Stream  bool
	Tags    map[string]string
	Headers map[string]string // lowercased inbound HTTP headers (sanitized)
}

Request is the CEL evaluation context for a gateway call.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.