Documentation
¶
Overview ¶
Package eval is SPEC §8 as a pure function: order-independent evaluation of a compiled policy against one (user, host, account) request. It knows nothing about HTTP, OIDC, or inventories — the caller resolves the request tuple and passes resolvers for flags (`when`) and facts (`require`).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Decision ¶
type Decision struct {
Outcome Outcome
Reason string
TTL time.Duration
DenyRule *il.DenyRule
Allowed []*il.AllowRule
PendingOn []string
}
Decision is the evaluation result. TTL is the minimum across satisfied allows that set one; zero means the deployment default. DenyRule is set when a deny rule fired; Allowed carries the satisfied allows (for notify and audit); PendingOn names the requirements a Pending outcome waits on.
func Decide ¶
func Decide(p *il.Policy, req Request, now time.Time, flags FlagFunc, facts FactFunc) (Decision, error)
Decide evaluates policy p for req at instant now. It implements SPEC §8 steps 1–7; file order never matters. Any resolver error is returned as-is — the caller must fail closed (500), never treat it as a non-match.
type FactFunc ¶
FactFunc resolves a `require` fact through the three-state resolver. An error fails the evaluation closed. Request-scoped caching and fast-before-side-effecting ordering are the resolver's business.
type FactState ¶
type FactState int
FactState is the three-state result of a `require` fact resolver.
type FlagFunc ¶
FlagFunc resolves a `when` flag: synchronous, two-state, never pending. An error fails the evaluation closed.
type Host ¶
Host is a resolved host. Name must already have passed il.HostName. Accounts is the grounding list: nil means no account inventory was reported and account expressions match the requested name directly (ungrounded); non-nil means grounded matching — the requested account must be in the list, and an empty list grounds nothing.
Source Files