Documentation
¶
Overview ¶
Package eval is SPEC §8 as a pure function: order-independent evaluation of a compiled policy against one (user, host, account) request. It knows nothing about HTTP, OIDC, or inventories — the caller resolves the request tuple and passes resolvers for flags (`when`) and facts (`require`).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Decision ¶
type Decision struct {
Outcome Outcome
Reason string
TTL time.Duration
DenyRule *il.DenyRule
Allowed []*il.AllowRule
PendingOn []string
}
Decision is the evaluation result. TTL is the minimum across satisfied allows that set one; zero means the deployment default. DenyRule is set when a deny rule fired; Allowed carries the satisfied allows (for notify and audit); PendingOn names the requirements a Pending outcome waits on.
func Decide ¶
func Decide(p *il.Policy, req Request, now time.Time, flags FlagFunc, facts FactFunc) (Decision, error)
Decide evaluates policy p for req at instant now. It implements SPEC §8 steps 1–7; file order never matters. Any resolver error is returned as-is — the caller must fail closed (500), never treat it as a non-match.
type FactFunc ¶
FactFunc resolves a `require` fact through the three-state resolver. An error fails the evaluation closed. Request-scoped caching and fast-before-side-effecting ordering are the resolver's business.
type FactState ¶
type FactState int
FactState is the three-state result of a `require` fact resolver.
type FlagFunc ¶
FlagFunc resolves a `when` flag: synchronous, two-state, never pending. An error fails the evaluation closed.
type Host ¶
Host is a resolved host. Name must already have passed il.HostName. Accounts is the grounding list: nil means no account inventory was reported and account expressions match the requested name directly (ungrounded); non-nil means grounded matching — the requested account must be in the list, and an empty list grounds nothing.
type Request ¶
type Request struct {
User *User
Host *Host
Account string // requested account name, verbatim — never case-folded
}
Request is one evaluation request. A nil User or Host is a structural non-match (the SPEC §8 step 1 gates), not an error.
type User ¶
type User struct {
UserName string
ID string
Active bool
Groups []string
UserType string
Department string
Organization string
}
User is the policy view of the independently authenticated inventory user. UserName is mutable. ID is an optional immutable, non-reassignable inventory ID within the configured provider/tenant. Inventory adapters and OIDC claim mapping normalize provider identifiers to this same ID. Do not synthesize it from UserName. Providers must preserve ID on rename and never reuse it.
Source Files