Documentation
¶
Overview ¶
Package eval is SPEC §8 as a pure function: order-independent evaluation of a compiled policy against one (user, host, account) request. It knows nothing about HTTP, OIDC, or inventories — the caller resolves the request tuple and passes resolvers for flags (`when`) and facts (`require`).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Decision ¶
type Decision struct {
Outcome Outcome
Reason string
TTL time.Duration
DenyRule *il.DenyRule
Allowed []*il.AllowRule
PendingOn []string
}
Decision is the evaluation result. TTL is the minimum across satisfied allows that set one; zero means the deployment default. DenyRule is set when a deny rule fired; Allowed carries the satisfied allows (for notify and audit); PendingOn names the requirements a Pending outcome waits on.
func Decide ¶
func Decide(p *il.Policy, req Request, now time.Time, flags FlagFunc, facts FactFunc) (Decision, error)
Decide evaluates policy p for req at instant now. It implements SPEC §8 steps 1–7; file order never matters. Any resolver error is returned as-is — the caller must fail closed (500), never treat it as a non-match.
type FactFunc ¶
FactFunc resolves a `require` fact through the three-state resolver. An error fails the evaluation closed. Request-scoped caching and fast-before-side-effecting ordering are the resolver's business.
type FactState ¶
type FactState int
FactState is the three-state result of a `require` fact resolver.
type FlagFunc ¶
FlagFunc resolves a `when` flag: synchronous, two-state, never pending. An error fails the evaluation closed.
type Host ¶
type Host struct {
ID string
Names []string
Attributes object.Attributes
Accounts []string
}
Host is one resolved host. Nil Accounts imposes no restriction; a non-nil slice restricts requests to its members, and an empty slice permits none.
Source Files