il

package

v0.26.0 Latest Latest Go to latest Published: Sep 4, 2026 License: Apache-2.0, Apache-2.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/epithet-ssh/epithet

Links

Open Source Insights

Documentation ¶

Overview ¶

Package il is writ's intermediate language: the compiled rule format per SPEC §10–11. The IL is writ's real policy interface; the surface language is one frontend over it. Macros are fully expanded here — nothing downstream of the compiler knows they existed.

IL equality is canonical, not structural: two rules are the same rule iff their content ids match. Nothing may compare rules with deep equality.

Constants ¶

View Source

const Schema = 1

Schema is the IL schema version carried by every policy.

Variables ¶

This section is empty.

Functions ¶

func HostName ¶

func HostName(s string) string

HostName is the single chokepoint for host-name normalization (SPEC §12 q9): ASCII A-Z→a-z only, never Unicode folding. Apply it at every ingress boundary — inventory load, request resolution, and policy compilation — so matching stays a byte compare.

func ShortID ¶

func ShortID(id string) string

ShortID is the display form of a content id: its first 12 characters.

Types ¶

type AllowRule ¶

type AllowRule struct {
	Label    string
	Users    MatchSet
	Accounts MatchSet
	Hosts    MatchSet
	Require  []string
	When     []string
	Until    *time.Time
	TTL      time.Duration
	Notify   []string
}

AllowRule grants access when all three positions match and every clause holds. Label is cosmetic and excluded from the content id. Until nil means no expiry; TTL zero means the deployment default.

func (*AllowRule) ContentID ¶

func (r *AllowRule) ContentID() string

ContentID returns the rule's full content id: 64 lowercase hex chars.

type DenyRule ¶

type DenyRule struct {
	Label    string
	Users    NegatableMatchSet
	Accounts NegatableMatchSet
	Hosts    NegatableMatchSet
	When     []string
	Notify   []string
}

DenyRule withdraws access when all three positions match and its `when` flags (if any) hold. Deny always wins.

func (*DenyRule) ContentID ¶

func (r *DenyRule) ContentID() string

ContentID returns the rule's full content id: 64 lowercase hex chars.

type MatchSet ¶

type MatchSet struct {
	Or []Matcher
}

MatchSet is a disjunction of matchers (an allow-rule position).

type Matcher ¶

type Matcher struct {
	Kind   MatcherKind
	Value  string
	Labels map[string]string
}

Matcher is one matcher. Value carries the scalar for every kind but MatchLabels and MatchAny; host name/glob values are stored ASCII-lowercased. Labels is set only for MatchLabels; entries AND.

type MatcherKind ¶

type MatcherKind string

MatcherKind discriminates Matcher values.

const (
	// User position.
	MatchID    MatcherKind = "id"
	MatchGroup MatcherKind = "group"
	MatchType  MatcherKind = "type"
	MatchDept  MatcherKind = "dept"
	MatchOrg   MatcherKind = "org"
	// Account and host positions.
	MatchName MatcherKind = "name"
	MatchGlob MatcherKind = "glob"
	// Host position only.
	MatchLabels MatcherKind = "labels"
	// Every position. A surface `*` compiles to MatchAny, never to a
	// glob — it is semantically distinct and skips the glob engine.
	MatchAny MatcherKind = "any"
)

type NegatableMatchSet ¶

type NegatableMatchSet struct {
	Not bool
	MatchSet
}

NegatableMatchSet is a match set plus a negation bit (a deny-rule position). Not applies to the whole set: the position matches iff the inner set does not.

type Policy ¶

type Policy struct {
	Schema int
	Allows []AllowRule
	Denies []DenyRule
}

Policy is a compiled rule set. Rule order is preserved from the source for reporting, but evaluation is order-independent.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL