Documentation
¶
Index ¶
- Constants
- func ActivityNameFromExecute(method string, data []byte) (string, *protos.PropagatedHistory, error)
- func CallerAppID(md map[string]*internalv1pb.ListStringValue) string
- func CallerNamespace(md map[string]*internalv1pb.ListStringValue) string
- func IsInternalActorType(actorType string) bool
- func SetCallerIdentity(req *internalv1pb.InternalInvokeRequest, appID, namespace string)
- func StripUntrustedCallerIdentity(md map[string]*internalv1pb.ListStringValue)
- func WorkflowNameFromCreateRequest(data []byte) (string, *protos.PropagatedHistory, error)
- func WorkflowOperationFromMethod(method string, parsedAddEvent *backend.HistoryEvent) (wfaclapi.WorkflowOperation, error)
- type CompiledPolicies
- type DenialReason
- type Holder
- type OperationType
Constants ¶
const ( DeniedMessageBase = "access denied by workflow access policy" // DeniedInternalActorMessage is returned when a reserved internal actor // type is called from another app, regardless of whether a // WorkflowAccessPolicy is loaded. DeniedInternalActorMessage = "reserved internal actor type '%s' can only be called by a sidecar with the same app ID and namespace" )
Variables ¶
This section is empty.
Functions ¶
func ActivityNameFromExecute ¶
ActivityNameFromExecute returns the activity name and (optionally) the propagated history from an Execute method payload. Activities are dispatched either as a raw HistoryEvent (legacy) or wrapped in an ActivityInvocation envelope that also carries propagated history. An empty name with nil history and nil error means the method is not Execute (no other activity methods are subject to access control).
func CallerAppID ¶
func CallerAppID(md map[string]*internalv1pb.ListStringValue) string
func CallerNamespace ¶
func CallerNamespace(md map[string]*internalv1pb.ListStringValue) string
func IsInternalActorType ¶
IsInternalActorType reports whether actorType is a Dapr-reserved internal actor type (workflow, activity, executor, retentioner, ...). User-facing actor APIs (invoke, state, reminder, timer) must reject these because the workflow runtime owns their lifecycle. Direct access from a user would corrupt state or bypass per-operation policy enforcement.
func SetCallerIdentity ¶
func SetCallerIdentity(req *internalv1pb.InternalInvokeRequest, appID, namespace string)
Callers MUST authenticate the identity before stamping (mTLS/SPIFFE for remote calls, local sidecar trust for local calls); this helper does not.
func StripUntrustedCallerIdentity ¶
func StripUntrustedCallerIdentity(md map[string]*internalv1pb.ListStringValue)
StripUntrustedCallerIdentity removes the caller-identity headers from metadata that arrived from an untrusted source (a user-facing API like InvokeActor or onDirectActorMessage that copies client metadata verbatim). Without this, a local app could spoof another app's identity by setting the caller-app-id / caller-namespace headers in their request. Trusted code paths (the CallActor gRPC handler stamping SPIFFE identity, the router stamping the local sidecar's identity) re-set these headers after stripping. The match is case-insensitive because HTTP-origin metadata retains the request's original header casing.
func WorkflowNameFromCreateRequest ¶
func WorkflowNameFromCreateRequest(data []byte) (string, *protos.PropagatedHistory, error)
WorkflowNameFromCreateRequest returns the workflow name and propagated history from a CreateWorkflowInstanceRequest payload.
func WorkflowOperationFromMethod ¶
func WorkflowOperationFromMethod(method string, parsedAddEvent *backend.HistoryEvent) (wfaclapi.WorkflowOperation, error)
WorkflowOperationFromMethod returns the WorkflowOperation for a workflow actor method. An empty operation with nil error means the method is not subject to access control (an internal/system method). AddWorkflowEvent's operation is encoded in the HistoryEvent payload; parsedAddEvent must be non-nil for that method so we don't unmarshal twice on the hot path.
Types ¶
type CompiledPolicies ¶
type CompiledPolicies struct {
// contains filtered or unexported fields
}
CompiledPolicies holds pre-processed workflow access policies for a single target app, built from one or more WorkflowAccessPolicy resources scoped to the app. The policy is a pure allow-list: presence of a matching rule grants access; absence denies. A nil *CompiledPolicies means no policies are loaded, in which case all calls are allowed.
func Compile ¶
func Compile(policies []wfaclapi.WorkflowAccessPolicy) *CompiledPolicies
func (*CompiledPolicies) Evaluate ¶
func (cp *CompiledPolicies) Evaluate(callerAppID string, opType OperationType, operation wfaclapi.WorkflowOperation, opName string, history *protos.PropagatedHistory, signingEnabled bool) (bool, DenialReason)
Evaluate returns whether any rule grants the caller access to perform the operation on opName. history is the caller's propagated history (nil for operations other than schedule). A `requires` block can never grant access while signingEnabled is false, since the history is then unverifiable. On deny it returns RequiresUnmet when a rule matched on caller+name+operation but its Requires wasn't satisfied, else NotAllowed. A nil *CompiledPolicies allows all calls.
func (*CompiledPolicies) ListsCaller ¶ added in v1.18.4
func (cp *CompiledPolicies) ListsCaller(appID string) bool
ListsCaller reports whether any compiled rule names appID in its Callers list. Per-actor enforcement uses this on the self-call exemption path to detect a misconfigured policy that lists the local appID — that listing has no effect because same-app calls are always exempt.
func (*CompiledPolicies) SelfCallExempt ¶
func (cp *CompiledPolicies) SelfCallExempt(appID, callerAppID string, warned *atomic.Bool) bool
SelfCallExempt reports whether callerAppID is the target app's own ID, in which case the call is exempt from the cross-app policy gate. When the policy misconfigures by listing the local appID in a rule's Callers, a one-time warning is emitted (guarded by warned) — that listing has no effect because same-app calls are always exempt.
type DenialReason ¶ added in v1.18.7
type DenialReason string
DenialReason is for local metrics/logging only; never put on the wire.
const ( DenialReasonNone DenialReason = "" DenialReasonNotAllowed DenialReason = "NotAllowed" DenialReasonRequiresUnmet DenialReason = "RequiresUnmet" )
type Holder ¶
type Holder struct {
// contains filtered or unexported fields
}
Holder is shared between the gRPC API and the workflow actors so both read the same atomic snapshot of the compiled policies.
func (*Holder) Load ¶
func (h *Holder) Load() *CompiledPolicies
func (*Holder) Store ¶
func (h *Holder) Store(p *CompiledPolicies)
type OperationType ¶
type OperationType string
OperationType represents the type of workflow operation being performed.
const ( OperationTypeWorkflow OperationType = "workflow" OperationTypeActivity OperationType = "activity" )
func ParseActorType ¶
func ParseActorType(actorType string) (OperationType, bool)
ParseActorType determines if an actor type represents a workflow or activity actor. Returns the operation type and true if it is a workflow/activity actor, or empty string and false otherwise.
Source Files