Documentation
¶
Overview ¶
Package il is writ's intermediate language: the compiled rule format per SPEC §10–11. The IL is writ's real policy interface; the surface language is one frontend over it. Macros are fully expanded here — nothing downstream of the compiler knows they existed.
IL equality is canonical, not structural: two rules are the same rule iff their content ids match. Nothing may compare rules with deep equality.
Index ¶
Constants ¶
const Schema = 2
Schema is the IL schema version carried by every policy.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type AllowRule ¶
type AllowRule struct {
Label string
Users MatchSet
Accounts MatchSet
Hosts MatchSet
Require []string
When []string
Until *time.Time
TTL time.Duration
Notify []string
}
AllowRule grants access when all three positions match and every clause holds. Label is cosmetic and excluded from the content id. Until nil means no expiry; TTL zero means the deployment default.
type DenyRule ¶
type DenyRule struct {
Label string
Users NegatableMatchSet
Accounts NegatableMatchSet
Hosts NegatableMatchSet
When []string
Notify []string
}
DenyRule withdraws access when all three positions match and its `when` flags (if any) hold. Deny always wins.
type MatchSet ¶
type MatchSet struct {
Or []Matcher
}
MatchSet is a disjunction of matchers (an allow-rule position).
type Matcher ¶
type Matcher struct {
Kind MatcherKind
Value string
Labels map[string]string
}
Matcher is one matcher. Value carries the scalar for every kind but MatchLabels and MatchAny; host name/glob values are stored ASCII-lowercased. Labels is set only for MatchLabels; entries AND.
type MatcherKind ¶
type MatcherKind string
MatcherKind discriminates Matcher values.
const ( // User position. MatchUserName MatcherKind = "userName" MatchID MatcherKind = "id" MatchGroup MatcherKind = "group" MatchUserType MatcherKind = "userType" MatchDepartment MatcherKind = "department" MatchOrganization MatcherKind = "organization" // Account and host positions. MatchName MatcherKind = "name" MatchGlob MatcherKind = "glob" // Host position only. MatchLabels MatcherKind = "labels" // Every position. A surface `*` compiles to MatchAny, never to a // glob — it is semantically distinct and skips the glob engine. MatchAny MatcherKind = "any" )
type NegatableMatchSet ¶
NegatableMatchSet is a match set plus a negation bit (a deny-rule position). Not applies to the whole set: the position matches iff the inner set does not.
type Policy ¶
Policy is a compiled rule set. Rule order is preserved from the source for reporting, but evaluation is order-independent.
func (*Policy) ValidateUserSelectors ¶ added in v0.27.0
ValidateUserSelectors rejects incompatible IL before any rule can grant access. In particular, ignoring a legacy matcher in a deny would fail open.
Source Files