predicates

package

v0.3.0 Latest Latest Go to latest Published: Jun 11, 2026 License: Apache-2.0 Imports: 4 Imported by: 0

Details

Package predicates provides reference external predicates for use in Datalog policies.

These predicates bridge the gap between Datalog rules and runtime state, enabling rules to consult time, rate limits, and identity claims.

Usage:

engine, _ := engine.New()
predicates.RegisterAll(engine)

Then in your Datalog policy:

rate_limited(Req) :- rate_limit_exceeded(Req, "user-123", 100).
time_blocked(Req) :- within_time_window(Req, "02:00", "04:00").

This section is empty.

This section is empty.

func RegisterAll(reg interface {
	RegisterExternalPredicate(name string, fn func(ctx context.Context, inputs []any) ([][]any, error)) error
})

RegisterAll registers all reference external predicates with the given engine. This is the recommended way to enable predicates for your policies.

Example:

eng, _ := engine.New()
predicates.RegisterAll(eng)

Parameters:

reg: Anything that has RegisterExternalPredicate(name, fn) method. This includes *engine.PolicyEngine and *engine.MangleRuntime.

type RateLimitEntry struct {
	Count     int
	WindowEnd time.Time
}

RateLimitEntry tracks request counts per key within a sliding window.

type RateLimiter struct {
	// contains filtered or unexported fields
}

RateLimiter implements a simple in-memory sliding-window rate limiter.

func NewRateLimiter(limit int, window time.Duration) *RateLimiter

NewRateLimiter creates a new rate limiter. limit is the max requests per window. window is the sliding window duration.

func (r *RateLimiter) IsExceeded(key string) bool

IsExceeded checks if the key has exceeded the rate limit. Returns true if the count exceeds the limit within the window.

func (r *RateLimiter) Reset()

Reset clears all entries (useful for testing).