Documentation
¶
Overview ¶
Package actorcheck is the structural guard rail for the actor design: the actor is audit information, and a service must never make an authorization decision from it.
Directories named testdata, vendor and node_modules are skipped, and so are _test.go files: a test may legitimately assert header handling.
A service repository wires it into one test:
func TestBDR002R1_ActorIsNeverAnAuthorizationInput(t *testing.T) {
violations, err := actorcheck.Check(".")
require.NoError(t, err)
require.Empty(t, violations, "%v", violations)
}
DEV-NOTE: see BauerMediaGroup-Stardust/platform-gitops docs/plans/keycloak-service-auth.md section 8 and BDR-002. The moment a handler branches on Actor-Id, any service holding a write role can impersonate any human, and four-eyes approval becomes a formality. Four-eyes in particular must read the token subject (jwt.Identity.Subject).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Violation ¶
Violation is one place where an actor header value reaches a decision.
func Check ¶
Check parses every non-test Go file under root and reports the places where a value read from an Actor-* header (HTTP or Kafka) is used in a condition.
Reading the headers is fine, and so is comparing a header KEY to "Actor-Id" or testing a value for emptiness: recording provenance requires both. What is forbidden is branching on the value itself.
ponytail: taint tracking is one level deep inside a single function, which covers the realistic mistake (read, then branch). Laundering the value through another function is not detected; the BDR carries that limitation in writing.
Source Files