il

package

v0.45.0 Latest Latest Go to latest Published: Oct 30, 2026 License: Apache-2.0, Apache-2.0 Imports: 9 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/epithet-ssh/epithet

Links

Open Source Insights

Documentation ¶

Overview ¶

Package il is writ's intermediate language: the compiled rule format per SPEC §10–11. The IL is writ's real policy interface; the surface language is one frontend over it. Macros are fully expanded here — nothing downstream of the compiler knows they existed.

IL equality is canonical, not structural: two rules are the same rule iff their content ids match. Nothing may compare rules with deep equality.

Constants ¶

View Source

const Schema = 3

Schema is the IL schema version carried by every policy.

Variables ¶

This section is empty.

Functions ¶

func HostName ¶

func HostName(s string) string

HostName is the single chokepoint for host-name normalization (SPEC §12 q9): ASCII A-Z→a-z only, never Unicode folding. Apply it at every ingress boundary — inventory load, request resolution, and policy compilation — so matching stays a byte compare.

func ShortID ¶

func ShortID(id string) string

ShortID is the display form of a content id: its first 12 characters.

Types ¶

type AllowRule ¶

type AllowRule struct {
	Label    string
	Users    Selector
	Accounts Selector
	Hosts    Selector
	Require  []string
	When     []string
	Until    *time.Time
	TTL      time.Duration
	Notify   []string
}

AllowRule grants access when all three positions match and every clause holds. Label is cosmetic and excluded from the content id. Until nil means no expiry; TTL zero means the deployment default.

func (*AllowRule) ContentID ¶

func (r *AllowRule) ContentID() string

ContentID returns the rule's full content id: 64 lowercase hex chars.

type DenyRule ¶

type DenyRule struct {
	Label    string
	Users    NegatableSelector
	Accounts NegatableSelector
	Hosts    NegatableSelector
	When     []string
	Notify   []string
}

DenyRule withdraws access when all three positions match and its `when` flags (if any) hold. Deny always wins.

func (*DenyRule) ContentID ¶

func (r *DenyRule) ContentID() string

ContentID returns the rule's full content id: 64 lowercase hex chars.

type Kind ¶ added in v0.42.0

type Kind string

Kind identifies the object selected at one rule position.

const (
	User    Kind = "user"
	Group   Kind = "group"
	Host    Kind = "host"
	Account Kind = "account"
)

type NegatableSelector ¶ added in v0.42.0

type NegatableSelector struct {
	Not bool
	Selector
}

NegatableSelector is available only in deny rules. Not complements the whole selector, after matching all candidate names or memberships.

type Policy ¶

type Policy struct {
	Schema int
	Allows []AllowRule
	Denies []DenyRule
}

Policy is a compiled rule set. Rule order is preserved from the source for reporting, but evaluation is order-independent.

func (*Policy) Validate ¶ added in v0.42.0

func (p *Policy) Validate() error

Validate rejects unsupported schemas, kinds, positions, and malformed selectors before any rule (including a deny) can be evaluated.

type Predicate ¶ added in v0.42.0

type Predicate struct {
	Attribute string
	Value     string
}

Predicate requires one string value. Repeated attributes remain separate conjuncts, so a map cannot represent a filter. Host/account name predicates use their established name-pattern languages; all other comparisons are exact.

type Selector ¶ added in v0.42.0

type Selector struct {
	Kind       Kind
	Predicates []Predicate
}

Selector matches one object satisfying every predicate. An empty predicate list accepts every candidate; a group selector still requires a membership. There is no representation for selector alternatives.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL