il

package
v0.43.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: Apache-2.0, Apache-2.0 Imports: 9 Imported by: 0

Documentation

Overview

Package il is writ's intermediate language: the compiled rule format per SPEC §10–11. The IL is writ's real policy interface; the surface language is one frontend over it. Macros are fully expanded here — nothing downstream of the compiler knows they existed.

IL equality is canonical, not structural: two rules are the same rule iff their content ids match. Nothing may compare rules with deep equality.

Index

Constants

View Source 
const Schema = 3

Schema is the IL schema version carried by every policy.

Variables

This section is empty.

Functions

func HostName 

func HostName(s string) string

HostName is the single chokepoint for host-name normalization (SPEC §12 q9): ASCII A-Z→a-z only, never Unicode folding. Apply it at every ingress boundary — inventory load, request resolution, and policy compilation — so matching stays a byte compare.

func ShortID 

func ShortID(id string) string

ShortID is the display form of a content id: its first 12 characters.

Types

type AllowRule 

type AllowRule struct {
	Label    string
	Users    Selector
	Accounts Selector
	Hosts    Selector
	Require  []string
	When     []string
	Until    *time.Time
	TTL      time.Duration
	Notify   []string
}

AllowRule grants access when all three positions match and every clause holds. Label is cosmetic and excluded from the content id. Until nil means no expiry; TTL zero means the deployment default.

func (*AllowRule) ContentID 

func (r *AllowRule) ContentID() string

ContentID returns the rule's full content id: 64 lowercase hex chars.

type DenyRule 

type DenyRule struct {
	Label    string
	Users    NegatableSelector
	Accounts NegatableSelector
	Hosts    NegatableSelector
	When     []string
	Notify   []string
}

DenyRule withdraws access when all three positions match and its `when` flags (if any) hold. Deny always wins.

func (*DenyRule) ContentID 

func (r *DenyRule) ContentID() string

ContentID returns the rule's full content id: 64 lowercase hex chars.

type Kind added in v0.42.0 

type Kind string

Kind identifies the object selected at one rule position. 

const (
	User    Kind = "user"
	Group   Kind = "group"
	Host    Kind = "host"
	Account Kind = "account"
)

type NegatableSelector added in v0.42.0 

type NegatableSelector struct {
	Not bool
	Selector
}

NegatableSelector is available only in deny rules. Not complements the whole selector, after matching all candidate names or memberships.

type Policy 

type Policy struct {
	Schema int
	Allows []AllowRule
	Denies []DenyRule
}

Policy is a compiled rule set. Rule order is preserved from the source for reporting, but evaluation is order-independent.

func (*Policy) Validate added in v0.42.0 

func (p *Policy) Validate() error

Validate rejects unsupported schemas, kinds, positions, and malformed selectors before any rule (including a deny) can be evaluated.

type Predicate added in v0.42.0 

type Predicate struct {
	Attribute string
	Value     string
}

Predicate requires one string value. Repeated attributes remain separate conjuncts, so a map cannot represent a filter. Host/account name predicates use their established name-pattern languages; all other comparisons are exact.

type Selector added in v0.42.0 

type Selector struct {
	Kind       Kind
	Predicates []Predicate
}

Selector matches one object satisfying every predicate. An empty predicate list accepts every candidate; a group selector still requires a membership. There is no representation for selector alternatives.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.