Documentation
¶
Overview ¶
Package accesspolicies discovers and decodes the DALgo access policies a DataTug user keeps on disk, runs a query through them as a secured application would, and explains what the policies did to that query.
Index ¶
- Constants
- Variables
- func BaseResource(query dal.Query) access.Resource
- func ParseVariables(pairs []string) (map[string]any, error)
- func Policies(loaded []Loaded) []access.Policy
- func ResolveDir(flagValue string) (dir string, explicit bool, err error)
- type Line
- type LoadOptions
- type Loaded
- type Options
- type Result
Constants ¶
const DefaultDir = ".datatug/policies"
DefaultDir is the per-user policies directory relative to the home directory.
const DirEnv = "DATATUG_POLICIES_DIR"
DirEnv names the environment variable that overrides the default policies directory.
Variables ¶
var ErrInvalidQuery = errors.New("invalid query")
ErrInvalidQuery marks a query the command refuses before execution: an unresolved or misplaced parameter, or an alias under a field allow-list.
var ErrNoPolicies = errors.New("no access policies loaded; pass --no-policies to run unrestricted")
ErrNoPolicies is returned by Load when nothing was loaded and the caller did not ask to run unrestricted.
Functions ¶
func BaseResource ¶
BaseResource names the collection a query reads.
func ParseVariables ¶
ParseVariables turns name=value pairs into policy variables. Names follow DALgo's parameter grammar; currentUser, principal.* and path.* are reserved for --as, --role, --group and path captures. Values are YAML scalars or flow sequences so numbers, booleans and lists keep their type; quote a value to force a string; a value that is not valid YAML is kept as the literal string.
Types ¶
type Line ¶
type Line struct {
Policy string
Source string
Resource string
Rule string
Allowed bool
Condition string // as access.Decision.Condition renders it; parameter names, never values
Bindings []string // "name=value" for the caller-supplied variables the condition references
FieldLists [][]string
Via string // binding attribution from a principal-bound policy ("role:editor")
Explanation string
}
Line is what one policy decided for a query's base collection.
type LoadOptions ¶
type LoadOptions struct {
// Dir is the --policies-dir value; empty means environment or default.
Dir string
// Files are additional --policy documents, appended after the directory.
Files []string
// None skips discovery (--no-policies); it conflicts with Files.
None bool
}
LoadOptions says where policies come from.
type Loaded ¶
Loaded is one decoded access document and the file it came from.
func Load ¶
func Load(o LoadOptions) ([]Loaded, error)
Load discovers and decodes the caller's policies. A missing default directory is empty; a missing explicit one is an error. Nothing loaded is ErrNoPolicies unless None is set.
type Options ¶
type Options struct {
// Principal is the caller; nil runs anonymously.
Principal *access.Principal
// Variables are the caller's --var values.
Variables map[string]any
// Policies are the loaded documents.
Policies []Loaded
// Unrestricted must be set explicitly to run with no policies at all.
Unrestricted bool
}
Options configure one secured run.
type Result ¶
type Result struct {
// Reader yields the rows the secured session admits.
Reader dal.RecordsReader
// Lines explains, per policy, what applied to the query; nil when
// unrestricted.
Lines []Line
// Query is the query as executed, with parameters substituted.
Query dal.Query
}
Result is what Run returns before any row is read.
func Run ¶
Run executes query over session as a policy-secured application would for the principal: it puts the principal and variables on the context, substitutes the query's own parameters, refuses aliases and references to fields the caller may not see, explains the policies' decisions and opens the reader through access.SecureReadSession. Denials wrap access.ErrAccessDenied; refused queries wrap ErrInvalidQuery.
Source Files