ast

type AllowRule ¶

type AllowRule struct {
	Users    Expr
	Accounts Expr
	Hosts    Expr
	Clauses  []Clause
	Pos      diag.Pos
}

AllowRule carries plain expressions: negation on the allow path is unrepresentable, mirroring the IL's Selector / NegatableSelector split.

type Any ¶

type Any struct{ P diag.Pos }

Any is the universal selector in its rule position.

func (a *Any) Pos() diag.Pos

type Atom ¶

type Atom interface{ Pos() diag.Pos }

type Clause ¶

type Clause interface {
	Keyword() string
	Pos() diag.Pos
}

Clause is one tail clause: *Require, *When, *Until, *TTL, *Notify, or *Label.

type DenyRule ¶

type DenyRule struct {
	Users    NegExpr
	Accounts NegExpr
	Hosts    NegExpr
	Clauses  []Clause
	Pos      diag.Pos
}

DenyRule carries negatable expressions in all three positions.

type Expr ¶

type Expr struct {
	Atom Atom
	Pos  diag.Pos
}

Expr is one selector or macro reference.

type File ¶

type File struct {
	Items []Item
}

File is a parsed policy file: a sequence of macro definitions and rules.

type Filter ¶ added in v0.42.0

type Filter struct {
	Object string
	Pairs  []Pair
	P      diag.Pos
}

Filter is a conjunction on a user, group, or host object.

func (a *Filter) Pos() diag.Pos

type Item ¶

type Item interface {
	// contains filtered or unexported methods
}

Item is one statement: *MacroDef, *AllowRule, or *DenyRule.

type Kind ¶

type Kind int

Kind is one of the three matcher kinds. A macro declares one; every selector position implies one.

const (
	KindUser Kind = iota
	KindAccount
	KindHost
)

func (k Kind) String() string

type Label ¶

type Label struct {
	Value Value
	P     diag.Pos
}

Label is a human-readable alias for the rule; cosmetic only.

func (c *Label) Keyword() string

func (c *Label) Pos() diag.Pos

type MacroDef ¶

type MacroDef struct {
	Kind Kind
	Name string
	Body Expr
	Pos  diag.Pos
}

MacroDef binds a name to a match expression of a declared kind.

type MacroRef ¶

type MacroRef struct {
	Name string
	P    diag.Pos
}

func (a *MacroRef) Pos() diag.Pos

type Name ¶

type Name struct{ Value Value }

Name is an account selector; its established glob semantics are retained.

func (a *Name) Pos() diag.Pos

type NegExpr ¶

type NegExpr struct {
	Not bool
	Expr
}

NegExpr is an expression plus a bit; `!` applies to the whole expression, never to a predicate within a filter.

type Notify ¶

type Notify struct {
	Targets []Value
	P       diag.Pos
}

Notify names fire-and-forget notification targets.

func (c *Notify) Keyword() string

func (c *Notify) Pos() diag.Pos

type Pair ¶ added in v0.42.0

type Pair struct {
	Key   Value
	Value Value
}

type Require ¶

type Require struct {
	Names []Value
	P     diag.Pos
}

Require names async facts that must all be satisfied (allow-only).

func (c *Require) Keyword() string

func (c *Require) Pos() diag.Pos

type TTL ¶

type TTL struct {
	Seconds uint64
	P       diag.Pos
}

TTL overrides the deployment-default cert TTL (allow-only).

func (c *TTL) Keyword() string

func (c *TTL) Pos() diag.Pos

type Until ¶

type Until struct {
	TS Value
	P  diag.Pos
}

Until stops the rule matching at the given instant (allow-only).

func (c *Until) Keyword() string

func (c *Until) Pos() diag.Pos

type Value ¶

type Value struct {
	Text   string
	Quoted bool
	Pos    diag.Pos
}

Value is a scalar. Quoted matters for well-formedness: a quoted attribute value is always a literal, while a bare `*`/`?` in an attribute-value position is an error (SPEC §7 error 11).

type When ¶

type When struct {
	Names []Value
	P     diag.Pos
}

When names sync flags that must all currently hold.

func (c *When) Keyword() string

func (c *When) Pos() diag.Pos