Documentation
¶
Overview ¶
Package labelguard holds the sensitivity-label decisions every read of a project source shares, whoever reads it: `query run`, `chat`, `datatug://` reads and `datatug serve`'s exec/run_query. The callers own the I/O (loading the labels, describing a table); the rule is here, once:
- a stored protected label (owner or proposed, on the column or on its whole table) refuses for every principal;
- a column protected only by a read-time suggestion refuses a strict principal (an agent, or a policy-governed session);
- anyone else reads it, and is warned once per column.
Index ¶
- func CheckColumns(doc meaninglabels.Document, source, table string, view bool, columns []string, ...) (refused *meaninglabels.ColumnLabel, suggested []string)
- func Columns(names []string) []meaninglabels.Column
- func SourceHasProtectedLabel(doc meaninglabels.Document, source string) bool
- func StoredLabelCovers(doc meaninglabels.Document, source, table, column string) bool
- func StoredTableLabel(doc meaninglabels.Document, source, table string) (meaninglabels.ColumnLabel, bool)
- func SuggestedColumns(doc meaninglabels.Document, source string, ...) []string
- type Warner
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CheckColumns ¶
func CheckColumns(doc meaninglabels.Document, source, table string, view bool, columns []string, strict bool) (refused *meaninglabels.ColumnLabel, suggested []string)
CheckColumns judges the columns a read names on one table (view reports whether it is a view). refused is the label that refuses the read, if any; otherwise suggested lists, sorted as table.column, the columns that only read-time suggestions protect, which a non-strict principal reads.
func Columns ¶
func Columns(names []string) []meaninglabels.Column
Columns converts column names to label columns.
func SourceHasProtectedLabel ¶
func SourceHasProtectedLabel(doc meaninglabels.Document, source string) bool
SourceHasProtectedLabel reports whether any protected label (owner or proposed) is stored for source.
func StoredLabelCovers ¶
func StoredLabelCovers(doc meaninglabels.Document, source, table, column string) bool
StoredLabelCovers reports whether a stored protected label (owner or proposed, on the column or its whole table) covers column. A column's effective origin can read "suggested" when a tied suggestion replaced such a label, so whether a label is stored is decided here, from the document.
func StoredTableLabel ¶
func StoredTableLabel(doc meaninglabels.Document, source, table string) (meaninglabels.ColumnLabel, bool)
StoredTableLabel is the first protected label stored for table (on one of its columns or on the whole table): a read of every column of table reads it.
func SuggestedColumns ¶
func SuggestedColumns(doc meaninglabels.Document, source string, tables map[string][]meaninglabels.Column) []string
SuggestedColumns lists, sorted, the table.column names whose effective label is protected.
Source Files