Documentation
¶
Overview ¶
Package inventory resolves the entities a writ policy matches against: users (SCIM-shaped, RFC 7643) and hosts (name + labels + optional account list). The interface is the pluggability seam — today's implementation is a static file, later ones may be databases or live SCIM stores, and implementations are free to synthesize hosts (e.g. pattern-derived labels for short-lived VMs).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Inventory ¶
type Inventory interface {
// LookupUser resolves an OIDC-bound identity to a user by comparing
// it byte-for-byte against the configured SCIM identity attribute
// (default userName).
LookupUser(ctx context.Context, identity string) (*eval.User, error)
// LookupHost resolves a requested host name. Callers must pass the
// name through il.HostName first; implementations may synthesize a
// host for names they can derive attributes for.
LookupHost(ctx context.Context, name string) (*eval.Host, error)
}
Inventory looks up users and hosts at evaluation time.
A (nil, nil) return means "no such entity" — a structural non-match that the evaluator turns into a 403, not an error. A non-nil error means the lookup itself failed and the evaluation must fail closed (500).
type Static ¶
type Static struct {
// contains filtered or unexported fields
}
Static is a file-backed inventory: SCIM-shaped users and hosts loaded once at startup. Reload is a process restart, like the policy itself.
Host entries come in two forms. An exact entry (`name:`) is one registered host. A pattern entry (`pattern:`, writ glob — `*`/`?` only) synthesizes a host for any requested name it matches, adopting the requested name and carrying the entry's labels: the escape hatch for fleets of short-lived hosts (VM pools, CI runners) that follow a naming pattern but cannot be enumerated in a file.
func NewStatic ¶
NewStatic loads an inventory from one or more YAML files. Files concatenate; a duplicate userName or exact host name across the set is a load error. Decoding is strict — an unknown field is an error, not a silently ignored typo.
func (*Static) LookupHost ¶
LookupHost implements Inventory: exact entries first, then pattern entries in file order, first match wins.
Source Files