accesscontrol

type AccessControl interface {
	CheckAccess(ctx context.Context, req CheckAccessRequest) (bool, error)
	Authorize(ctx context.Context, req AuthorizeRequest) (secrets.AuthorizeResponse, error)
}

type Anchor uint8

type AuthorizeRequest struct {
	Patterns []secrets.Pattern
	ProcessInfo
	SigningInfo
}

type CheckAccessRequest struct {
	secrets.Pattern
	ProcessInfo
	SigningInfo
}

type CodeStatus uint32

type ProcessInfo struct {
	PID                int
	Name               string
	AbsoluteBinaryPath string
}

type ProcessNode struct {
	PID int
	// Start is the process start token in µs since epoch
	// (p_starttime sec*1e6 + µs). Together with PID it forms an instance
	// identity that survives PID reuse.
	Start int64
	// UID is the target process's effective uid.
	UID int

	// Comm is the kernel's process name (p_comm, 16 characters max, no root permissions required).
	Comm string

	// Exe is the executable path exactly as the kernel reports it (proc_pidpath).
	Exe string
	// RealExe is Exe with symlinks resolved, falling back to Exe.
	RealExe string
	// Mtime is the modification time of RealExe, UTC.
	Mtime time.Time

	// Args is the process argv via sysctl(KERN_PROCARGS2). Same-uid only
	// and best-effort: nil when unreadable. Self-reported by the process.
	Args []string
}

type SigningIdentity struct {
	SigningInfoBase

	// TeamID is the Apple-assigned Team Identifier (kSecCodeInfoTeamIdentifier),
	// Apple guarantees this is unique per developer account.
	TeamID string

	// Identifier is the code signing identifier (kSecCodeInfoIdentifier),
	// typically the bundle ID, e.g. "com.docker.docker". Use to pin a specific
	// application within a team.
	Identifier string

	// Organization is the company name from the leaf certificate subject.O,
	// e.g. "Docker Inc". Human-readable but NOT guaranteed unique or immutable,
	// so suitable for display/logging rather than as a sole trust key.
	Organization string

	// BundleName is the app name from the signed Info.plist
	// (CFBundleDisplayName, falling back to CFBundleName), e.g.
	// "Docker Desktop". Empty when the binary embeds no Info.plist.
	// Display-only: not unique, chosen by the signer.
	BundleName string

	// CommonName is the leaf certificate subject.CN, e.g.
	// "Developer ID Application: Docker Inc (<team-id>)". Contains the company
	// name and TeamID as embedded display text.
	CommonName string

	// CDHash is the code directory hash (kSecCodeInfoUnique), the exact identity
	// of this specific binary build, hex-encoded. Use to pin an exact build.
	CDHash string

	// Status is the dynamic code signing status word (kSecCodeInfoStatus) — the
	// kernel's live view of the signature, as opposed to the static on-disk
	// signature. See CodeStatus for the individual flags. Validity is already
	// enforced by SecCodeCheckValidityWithErrors, so this is primarily
	// corroborating/diagnostic (notably the Debugged flag).
	Status CodeStatus

	// Anchor classifies the root the certificate chain reaches.
	Anchor Anchor
}

type SigningInfo struct {
	// Root is the code-signing identity of the outermost recorded ancestor.
	Root *SigningIdentity
	// Leaf is the code-signing identity of the process that connected to
	// the socket (last chain element).
	Leaf *SigningIdentity
	// Chain is the leaf's process ancestry ordered root to leaf. For a single-node
	// chain Root and Leaf describe the same process.
	Chain []ProcessNode
}

type SigningInfoBase struct {
	SignedByDocker bool
}