Documentation
¶
Overview ¶
Package policyscope limits a local access-policy rule to an environment, an instance, or both (backstage spec/features/perimeter, REQ:local-rule-selectors and permission model §4.1).
A rule in a DALgo access document may carry two DataTug keys that DALgo itself does not know:
environment: production # an environment kind instance: factory-e-prod/factory # <environment id>/<catalog id>
Project turns such a document into the plain DALgo document for one read: a rule whose selectors all match the instance the read opens keeps its place with the keys removed; any other selector rule is removed, as if the document did not contain it. DALgo precedence and deny by default are left to DALgo. A document with no selector is returned as the same bytes. When the read's instance (or, for an environment selector, its kind) is not known, Project refuses with ErrTargetUnknown and the caller must deny.
Index ¶
Constants ¶
const ( KeyEnvironment = "environment" KeyInstance = "instance" )
Rule keys this package owns.
Variables ¶
var ErrInvalidSelector = errors.New("policyscope: invalid rule selector")
ErrInvalidSelector marks a document whose selectors cannot be applied. The whole document is refused, never applied without them.
var ErrNoRules = errors.New("policyscope: no rule of the policy applies to this instance, so it denies every read")
ErrNoRules is returned when no rule of the document's top-level scopes applies to the target. DALgo cannot decode a document without a scope, so the caller stands a policy that denies every read in its place.
var ErrTargetUnknown = errors.New("policyscope: the instance this read opens is not known, so a policy that selects instances or environments denies it")
ErrTargetUnknown is returned for a document that uses a selector when the read's instance, or the environment kind a selector needs, is not known. Every such document denies that read.
var ErrUnsupportedCodec = errors.New("policyscope: only YAML and JSON policy documents can be inspected for rule selectors")
ErrUnsupportedCodec is returned for a codec other than DALgo's YAML and JSON codecs: its documents cannot be inspected for selectors.
Functions ¶
func Denies ¶
Denies reports whether err from Project means the document denies every read of the target.
func Project ¶
Project returns the plain DALgo document data stands for when read for t. A document with no selector is returned unchanged, as the same slice. Otherwise every rule whose selectors do not all match t is removed, the selector keys are removed from the rules that stay, and a scope left with no rule or child scope by that removal is removed with it. A document that uses a selector returns ErrTargetUnknown when t's instance is not known, or when a rule names an environment and t's kind is not known, and ErrNoRules when the projection leaves it no top-level scope.
func Scoped ¶
Scoped reports whether any rule of the document names a selector. It refuses a document whose selectors cannot be applied.
Types ¶
type Selector ¶
type Selector struct {
Environment datatug.EnvironmentKind
Instance string
}
Selector is the selectors one rule names. The zero Selector names none.
type Target ¶
type Target struct {
// Environment is the environment id, for example factory-e-prod.
Environment string
// Catalog is the catalog id inside the environment, for example factory.
Catalog string
// Kind is the environment's kind; empty or unknown means not known.
Kind datatug.EnvironmentKind
}
Target is the instance one read opens: one catalog in one environment (decision 0008), and the kind stored on that environment.
Source Files