wingpolicy

func CanAccessSessionPath ¶

func CanAccessSessionPath(req ws.TunnelRequest, sessionPath string, userPaths []string) bool

func CanAttachSession ¶

func CanAttachSession(userID, orgRole, sessionUserID string) bool

func CanSeeSession ¶

func CanSeeSession(req ws.TunnelRequest, sessionUserID string) bool

CanSeeSession returns true if the request sender can view a session with the given owner.

func CanonicalPaths ¶

func CanonicalPaths(paths []string) []string

func CanonicalPolicyPath ¶

func CanonicalPolicyPath(path string) string

func CanonicalSessionPath ¶

func CanonicalSessionPath(path string) string

func ClonePathList ¶

func ClonePathList(paths config.PathList) config.PathList

ClonePathList deep-copies a PathList so a failed save can roll the live ACL back to exactly its prior state.

func DiscoverProjects ¶

func DiscoverProjects(dir string, maxDepth int) []ws.WingProject

DiscoverProjects scans dir for git repositories up to maxDepth levels deep. Returns group directories (sorted by project count) followed by individual repos (sorted by mtime).

func DiscoverWingProjects ¶

func DiscoverWingProjects(resolvedPaths []string, cwd string) []ws.WingProject

DiscoverWingProjects returns the project metadata a wing may advertise. Explicit path configuration is a disclosure boundary: never supplement it with projects found beneath the process cwd.

func FilterProjectsByPaths ¶

func FilterProjectsByPaths(projects []ws.WingProject, resolvedPaths []string) []ws.WingProject

FilterProjectsByPaths returns only projects whose paths are under one of the resolved paths.

func FilterProjectsExact ¶

func FilterProjectsExact(projects []ws.WingProject, resolvedPaths []string) []ws.WingProject

FilterProjectsExact returns only projects whose paths exactly match one of the resolved paths.

func GetDirEntries ¶

func GetDirEntries(path string, resolvedPaths []string) []ws.DirEntry

GetDirEntries returns directory entries for the given path, suitable for cwd selection. When resolvedPaths is set, acts as a strict whitelist: only the configured paths are returned, no filesystem browsing. This prevents users from navigating into subdirectories and writing their own egg.yaml (sandbox escape).

func IsExactPath ¶

func IsExactPath(path string, paths []string) bool

IsExactPath returns true if path exactly matches one of the configured paths.

func IsMemberFiltered ¶

func IsMemberFiltered(req ws.TunnelRequest) bool

IsMemberFiltered returns true if the tunnel request is from an org member (not owner/admin). Empty/unknown roles are treated as "member" (least privilege) when a user ID is present.

func IsMemberRole ¶

func IsMemberRole(orgRole string) bool

IsMemberRole grants elevated behavior only to the two coordinator roles the wing understands. Empty, legacy, and unexpected values stay least-privilege.

func IsUnderPaths ¶

func IsUnderPaths(path string, resolvedPaths []string) bool

IsUnderPaths returns true if path is equal to or under one of the resolved paths.

func NormalizeRelayHTTPURL ¶

func NormalizeRelayHTTPURL(relayURL string) string

NormalizeRelayHTTPURL converts a wing/coordinator URL to an HTTP base URL.

func PasskeyPolicyForRoost ¶

func PasskeyPolicyForRoost(roostURL string) auth.PasskeyPolicy

PasskeyPolicyForRoost mirrors the relying-party configuration used by the relay's registration endpoint. A custom/self-hosted roost uses its own host; the managed websocket and app hosts share the wingthing.ai RP ID.

func PasskeyPolicyFromRegistration ¶

func PasskeyPolicyFromRegistration(msg ws.RegisteredMsg) (auth.PasskeyPolicy, bool)

PasskeyPolicyFromRegistration accepts only a coherent RP policy delivered by the authenticated coordinator. Additive acknowledgement fields let new wings support custom AppHost and localhost HTTPS while retaining their URL-derived fallback when connected to an older relay.

func PasskeyRPURL ¶

func PasskeyRPURL(roostURL, baseURL string) string

PasskeyRPURL picks the URL whose host anchors the WebAuthn relying party. The embedded roost wing connects over loopback while browsers reach the roost at its public base URL (WT_BASE_URL) — the same source the relay's passkey registration endpoint derives its RP ID from. RP ID and origin must match the browser-facing host or every WebAuthn ceremony fails closed.

func PasskeySubject ¶

func PasskeySubject(userID, clientPublicKey string) string

func PasskeysForSubject ¶

func PasskeysForSubject(allowedKeys []config.AllowKey, userID string) []config.AllowKey

func PathsForRequest ¶

func PathsForRequest(pathList config.PathList, email, orgRole, home string) []string

PathsForRequest returns resolved paths filtered by the request sender's ACLs.

func RelayMetadataURL ¶

func RelayMetadataURL(relayURL string) string

RelayMetadataURL removes URL components that must not be persisted or copied into support bundles. Coordinator API routing can retain a path prefix, but userinfo, queries, and fragments are never part of the coordinator identity.

func RequestAgainstWingConfig ¶

func RequestAgainstWingConfig(req ws.TunnelRequest, authenticatedOrgRole string, wingCfg *config.WingConfig) ws.TunnelRequest

RequestAgainstWingConfig recomputes only the wing-local admin override from the relay-authenticated role. Mutation paths call this while holding wingCfgMu so a removed local admin cannot commit one last stale-snapshot edit after SIGHUP has revoked that override.

func RequestDirEntries ¶

func RequestDirEntries(req ws.TunnelRequest, path string, userPaths []string) []ws.DirEntry

func RequestProjects ¶

func RequestProjects(req ws.TunnelRequest, projects []ws.WingProject, userPaths []string) []ws.WingProject

func ResolvePathStrings ¶

func ResolvePathStrings(paths []string, home string) []string

ResolvePathStrings resolves ~/ prefixes and makes paths absolute. Returns empty if input is empty (no path restrictions).

func ResolveRelayHTTPURL ¶

func ResolveRelayHTTPURL(cfg *config.Config) string

ResolveRelayHTTPURL returns the relay's HTTP base URL from config.

func ResolveWingRelayHTTPURL ¶

func ResolveWingRelayHTTPURL(cfg *config.Config, explicit string, local bool) string

ResolveWingRelayHTTPURL mirrors the daemon's precedence: explicit flag, wing.yaml, local default, config.yaml, then the hosted coordinator.

func RoostBrowserURL ¶

func RoostBrowserURL(roostURL string) string

RoostBrowserURL returns the UI served by the selected coordinator. The public service has split ws/app hosts; a self-hosted roost serves its app at /app/ on the same origin.

func SessionPolicyContains ¶

func SessionPolicyContains(root, path string) bool

func VerifySubjectPasskey ¶

func VerifySubjectPasskey(allowedKeys []config.AllowKey, userID string, challenge, authData, clientData, signature []byte, policy auth.PasskeyPolicy) ([]byte, error)

func VisibleAllowKeys ¶

func VisibleAllowKeys(req ws.TunnelRequest, allowedKeys []config.AllowKey) []config.AllowKey

func WritablePolicyRoot ¶ added in v0.148.5

func WritablePolicyRoot(path string, writableRoots, readOnlyRoots, deny, denyWrite []string) (string, bool)

WritablePolicyRoot returns the most specific writable root covering path, after applying the compiled session filesystem policy's read-only and deny rules. The rule paths must already be resolved and canonicalized.