investigation

package
v0.32.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 13, 2026 License: MIT Imports: 8 Imported by: 0

Documentation

Overview

Package investigation owns the shared Investigation Context value model. Transport and incident packages depend on these types rather than defining competing representations of the same facts.

Index

Constants

View Source 
const (
	FactOriginSelection = "selection"
	FactOriginContext   = "context"
	FactOriginManual    = "manual"

	FactRoleAffected       = "affected"
	FactRoleHealthyControl = "healthy_control"
	FactRoleSuspected      = "suspected"
	FactRoleExcluded       = "excluded"
	FactRoleRecovered      = "recovered"

	FactMappingDeclared = "declared"
	FactMappingInferred = "inferred"

	// An omitted condition has the canonical equality meaning. Non-default
	// predicates must survive transport and persistence explicitly so a caller
	// can never silently turn `Customer.ID > 5` into equality.
	FactConditionEqual              = "=="
	FactConditionNotEqual           = "!="
	FactConditionGreaterThan        = ">"
	FactConditionGreaterThanOrEqual = ">="
	FactConditionLessThan           = "<"
	FactConditionLessThanOrEqual    = "<="
)

Variables

This section is empty.

Functions

This section is empty.

Types

type Context 

type Context struct {
	Facts []Fact `json:"facts"`
}

Context is the single canonical Investigation Context storage and transport model shared by plain investigations and incidents.

func (Context) Validate 

func (c Context) Validate() error

func (Context) ValidateAllowedScopes 

func (c Context) ValidateAllowedScopes(primary ProjectScope, declared []ProjectScope) error

ValidateAllowedScopes binds new facts to the request's primary project or one explicitly declared secondary. Authorization is still performed by the serving adapter; this helper only prevents invented provenance.

func (Context) ValidateScoped 

func (c Context) ValidateScoped() error

ValidateScoped is the creation boundary for new persisted contexts. Legacy contexts without scope remain readable through Validate, but new facts must name an explicit server store, project, and environment.

type ContextView 

type ContextView struct {
	Facts []FactView `json:"facts"`
}

func VisibleContext 

func VisibleContext(context Context) ContextView

func (ContextView) Validate 

func (c ContextView) Validate() error

type Fact 

type Fact struct {
	ID        string        `json:"id"`
	Entity    string        `json:"entity"`
	Field     string        `json:"field"`
	Value     TypedValue    `json:"value"`
	Condition string        `json:"condition,omitempty"`
	Origin    string        `json:"origin"`
	Physical  *PhysicalRef  `json:"physical,omitempty"`
	Mapping   string        `json:"mapping,omitempty"`
	Enabled   bool          `json:"enabled"`
	Role      string        `json:"role,omitempty"`
	Layer     string        `json:"layer,omitempty"`
	Scope     *ProjectScope `json:"scope,omitempty"`
}

func (Fact) Key 

func (f Fact) Key() FactKey

func (Fact) Validate 

func (f Fact) Validate() error

type FactKey 

type FactKey struct {
	Scope  ProjectScope
	FactID string
}

FactKey is the comparable, server-qualified identity policy adapters use. Fact IDs are unique only within their persisted project scope.

type FactView 

type FactView struct {
	ID        string        `json:"id"`
	Entity    string        `json:"entity"`
	Field     string        `json:"field,omitempty"`
	Value     ValueView     `json:"value"`
	Condition string        `json:"condition,omitempty"`
	Origin    string        `json:"origin"`
	Physical  *PhysicalRef  `json:"physical,omitempty"`
	Mapping   string        `json:"mapping,omitempty"`
	Enabled   bool          `json:"enabled"`
	Role      string        `json:"role,omitempty"`
	Layer     string        `json:"layer,omitempty"`
	Scope     *ProjectScope `json:"scope,omitempty"`
}

FactView is a read-only projection of the canonical Fact. It keeps the existing fact JSON shape when visible and substitutes only value when the serving adapter's current policy says it must be redacted.

func RedactedFact 

func RedactedFact(fact Fact, includeField bool) FactView

func VisibleFact 

func VisibleFact(fact Fact) FactView

func (FactView) Redacted 

func (f FactView) Redacted() bool

func (FactView) Validate 

func (f FactView) Validate() error

type PhysicalRef 

type PhysicalRef struct {
	Source     string `json:"source"`
	Collection string `json:"collection"`
	Column     string `json:"column"`
}

func (PhysicalRef) Validate 

func (r PhysicalRef) Validate() error

type ProjectScope 

type ProjectScope struct {
	StoreID     string `json:"storeId"`
	ProjectID   string `json:"projectId"`
	Environment string `json:"environment,omitempty"`
}

ProjectScope is persisted provenance for a fact or cross-project reference. It deliberately excludes the request-only securityContextId.

func (ProjectScope) Validate 

func (s ProjectScope) Validate() error

func (ProjectScope) ValidateFactScope 

func (s ProjectScope) ValidateFactScope() error

ValidateFactScope strengthens the legacy ProjectRef-compatible validation with the explicit canonical environment required for newly attached facts.

type RedactionMarker 

type RedactionMarker struct {
	Redacted bool `json:"redacted"`
}

RedactionMarker replaces a fact's TypedValue only in a current-policy read view. It is never valid in Context, Fact, or stored incident events.

type TypedValue 

type TypedValue struct {
	Type ValueType
	Str  string
	Num  float64
	Bool bool
}

TypedValue is the canonical transport tagged union. Its JSON implementation intentionally preserves apicontract's existing strict wire semantics.

func NewBooleanValue 

func NewBooleanValue(v bool) TypedValue

func NewDateValue 

func NewDateValue(v string) TypedValue

func NewDatetimeValue 

func NewDatetimeValue(v string) TypedValue

func NewDecimalValue 

func NewDecimalValue(v string) TypedValue

func NewIntegerValue 

func NewIntegerValue(v string) TypedValue

func NewNullValue 

func NewNullValue() TypedValue

func NewNumberValue 

func NewNumberValue(v float64) TypedValue

func NewStringValue 

func NewStringValue(v string) TypedValue

func (TypedValue) MarshalJSON 

func (v TypedValue) MarshalJSON() ([]byte, error)

func (*TypedValue) UnmarshalJSON 

func (v *TypedValue) UnmarshalJSON(data []byte) error

func (TypedValue) Validate 

func (v TypedValue) Validate() error

type ValidationError 

type ValidationError struct {
	Field   string
	Message string
}

ValidationError reports a single contract rule a value violated.

func (*ValidationError) Error 

func (e *ValidationError) Error() string

type ValueType 

type ValueType string
const (
	ValueTypeString   ValueType = "string"
	ValueTypeNumber   ValueType = "number"
	ValueTypeInteger  ValueType = "integer"
	ValueTypeDecimal  ValueType = "decimal"
	ValueTypeBoolean  ValueType = "boolean"
	ValueTypeDate     ValueType = "date"
	ValueTypeDatetime ValueType = "datetime"
	ValueTypeNull     ValueType = "null"
)

type ValueView 

type ValueView struct {
	Value    *TypedValue
	Redacted bool
}

ValueView is exactly one canonical TypedValue or one redaction marker.

func RedactedValue 

func RedactedValue() ValueView

func VisibleValue 

func VisibleValue(value TypedValue) ValueView

func (ValueView) MarshalJSON 

func (v ValueView) MarshalJSON() ([]byte, error)

func (*ValueView) UnmarshalJSON 

func (v *ValueView) UnmarshalJSON(data []byte) error

func (ValueView) Validate 

func (v ValueView) Validate() error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.