Documentation
¶
Overview ¶
Package access resolves access profiles (spec.AccessProfile) into what a seat may do from its sandbox, through plugins. A plugin owns one part of a profile: it validates that part and contributes to the seat's resolved SeatAccess, which every enforcement point reads:
- the seat runtime renders the Pod and NetworkPolicy from PodPart;
- the seat runner checks binaries and wires the proxy, credential helpers and browser;
- the platform answers the egress gateway and issues credentials from the live parts.
Parts that need a new Pod (binaries, network rules, browser, credential wiring) are in PodPart and so in the config revision. Egress hosts and repository grants apply live, without restarting the seat.
Index ¶
- Constants
- Variables
- func GitHost(c spec.Connection) string
- func GitHubOperations(perms map[string]string) []string
- func MatchHost(pattern, host string) bool
- func ParseHost(entry string) (host string, ports []int, err error)
- func Register(p Plugin)
- type Browser
- type Context
- type EgressRule
- type FieldError
- type GitHubGrant
- type NetworkRule
- type Plugin
- type SeatAccess
- func (a *SeatAccess) Allows(host string, port int) (EgressRule, bool)
- func (a *SeatAccess) Empty() bool
- func (a *SeatAccess) GitHubFor(connection string) *GitHubGrantdeprecated
- func (a *SeatAccess) GitHubSandboxGrant(connection string) (*GitHubGrant, error)
- func (a *SeatAccess) PodPart() *SeatAccess
- func (a *SeatAccess) UsesGateway() bool
Constants ¶
const ( DeliveryPlatform = "platform" DeliverySandbox = "sandbox" )
Delivery modes of a credential grant.
Variables ¶
var GitHubHosts = []string{"github.com", "api.github.com", "codeload.github.com", "*.githubusercontent.com"}
GitHubHosts are allowed through the egress gateway for sandbox delivery to github.com.
var GitHubPermissions = []string{"contents", "pull_requests", "issues", "metadata"}
GitHubPermissions are the permission names a grant may set.
Functions ¶
func GitHost ¶
func GitHost(c spec.Connection) string
GitHost is the host git uses for a github connection.
func GitHubOperations ¶
GitHubOperations maps permissions to the connection operations a platform-delivered grant allows.
func MatchHost ¶
MatchHost matches host against a pattern: an exact name, or *.suffix for any subdomain of suffix (not suffix itself).
Types ¶
type Browser ¶
type Browser struct {
SessionConnection string `json:"session_connection,omitempty"`
Source string `json:"source"`
}
Browser is the seat's browser tool.
type Context ¶
type Context struct {
Connections map[string]spec.Connection
}
Context is what plugins validate against.
type EgressRule ¶
type EgressRule struct {
Host string `json:"host"`
Ports []int `json:"ports"`
Source string `json:"source"`
}
EgressRule allows a host (or *.suffix) on ports through the gateway.
type FieldError ¶
type FieldError struct {
Path, Message string
}
FieldError is a validation error at a spec path.
func Check ¶
func Check(ctx Context, path string, p spec.AccessProfile) []FieldError
Check validates a profile with every plugin.
type GitHubGrant ¶
type GitHubGrant struct {
Connection string `json:"connection"`
Repos []string `json:"repos,omitempty"`
Permissions map[string]string `json:"permissions,omitempty"`
Delivery string `json:"delivery"`
// Host is the git host of the connection: github.com, or the
// connection's endpoint host (GitHub Enterprise, a test server).
Host string `json:"host"`
Source string `json:"source"`
}
GitHubGrant is one repository/permission/delivery clause on a github connection. Multiple grants are alternatives; their fields must not be independently unioned, which would grant a cross product of privileges.
type NetworkRule ¶
type NetworkRule struct {
CIDR string `json:"cidr"`
Ports []int64 `json:"ports,omitempty"`
Protocol string `json:"protocol"`
Source string `json:"source"`
}
NetworkRule allows direct egress to a CIDR.
type Plugin ¶
type Plugin interface {
// Name is the profile field the plugin owns.
Name() string
// Check validates the plugin's part of profile p at path.
Check(ctx Context, path string, p spec.AccessProfile) []FieldError
// Apply adds the part's contribution to a seat's access.
Apply(ctx Context, p spec.AccessProfile, source string, a *SeatAccess)
}
Plugin is one part of an access profile.
type SeatAccess ¶
type SeatAccess struct {
Profiles []string `json:"profiles,omitempty"`
Binaries []string `json:"binaries,omitempty"`
Network []NetworkRule `json:"network,omitempty"`
Browser *Browser `json:"browser,omitempty"`
GitHub []GitHubGrant `json:"github,omitempty"`
Egress []EgressRule `json:"egress,omitempty"`
}
SeatAccess is a seat's resolved access: the union of its profiles.
func Resolve ¶
func Resolve(ctx Context, profiles map[string]spec.AccessProfile, names []string) *SeatAccess
Resolve combines the named profiles into a seat's access. Names must exist.
func (*SeatAccess) Allows ¶
func (a *SeatAccess) Allows(host string, port int) (EgressRule, bool)
Allows reports the rule that permits host:port, if any.
func (*SeatAccess) Empty ¶
func (a *SeatAccess) Empty() bool
Empty reports whether the seat has no access beyond the platform.
func (*SeatAccess) GitHubFor
deprecated
func (a *SeatAccess) GitHubFor(connection string) *GitHubGrant
GitHubFor returns the grant on connection only when exactly one clause exists. It returns nil for an absent or ambiguous connection.
Deprecated: inspect the individual GitHub clauses for platform access, or use GitHubSandboxGrant for credential delivery.
func (*SeatAccess) GitHubSandboxGrant ¶ added in v0.7.0
func (a *SeatAccess) GitHubSandboxGrant(connection string) (*GitHubGrant, error)
GitHubSandboxGrant returns the exact grant expressible by one sandbox token on connection. Platform-only clauses never contribute. GitHub tokens apply one permission map to every selected repository: if the effective permissions differ between repositories, issuance must fail rather than widen access or silently omit part of the grant. A nil grant means no sandbox delivery.
func (*SeatAccess) PodPart ¶
func (a *SeatAccess) PodPart() *SeatAccess
PodPart is the part of the access that needs a new Pod to change: it is what the config revision covers. Egress hosts and repository grants are left out because they apply live.
func (*SeatAccess) UsesGateway ¶
func (a *SeatAccess) UsesGateway() bool
UsesGateway reports whether the seat's traffic goes through the egress gateway.
Source Files