accesscontrol

type AccessControl interface {
	CheckAccess(ctx context.Context, req CheckAccessRequest) (bool, error)
	Authorize(ctx context.Context, req AuthorizeRequest) (secrets.AuthorizeResponse, error)
}

type AuthorizeRequest struct {
	Patterns []secrets.Pattern
	ProcessInfo
	SigningInfo
}

type CheckAccessRequest struct {
	secrets.Pattern
	ProcessInfo
	SigningInfo
}

type IntegrityLevel uint32

type ProcessInfo struct {
	PID                int
	Name               string
	AbsoluteBinaryPath string
}

type SigningInfo struct {
	SigningInfoBase

	// TrustedChain reports whether WinVerifyTrust confirmed the Authenticode
	// signature chains to a trusted root and is not revoked.
	// The remaining signature fields are only meaningful when it is true.
	TrustedChain bool

	// SubjectOrg is the signing certificate Subject Organization (O), e.g. "Docker Inc".
	SubjectOrg string

	// SubjectCommonName is the signing certificate Subject Common Name (CN).
	SubjectCommonName string

	// Issuer is the Common Name of the issuing CA, e.g. the DigiCert / Sectigo
	// code-signing intermediate.
	Issuer string

	// ThumbprintSHA256 is the hex-encoded SHA-256 hash of the leaf signing
	// certificate. Strongest identity pin, but brittle across cert rotation.
	ThumbprintSHA256 string

	// IsEV reports whether the signature uses an Extended Validation
	// code-signing certificate (hardware-backed key, stricter vetting), detected
	// from the leaf certificate's CA/Browser Forum EV policy OID.
	IsEV bool

	// Integrity is the peer process's mandatory integrity level (Low/Medium/
	// High/System) from its access token — an OS-enforced runtime property.
	Integrity IntegrityLevel

	// CompanyName, ProductName, and FileVersion come from the PE VERSIONINFO
	// resource. This metadata is unsigned and attacker-controllable, so it is
	// for display/logging only and must never gate trust.
	CompanyName string
	ProductName string
	FileVersion string
}

type SigningInfoBase struct {
	SignedByDocker bool
}