Help us shape the future of Go! Take the 2026 Go Developer Survey

security

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 15, 2026 License: MIT Imports: 10 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	PolicyDenyReasonMethodDenied         = "method_denied"
	PolicyDenyReasonPermissionNotAllowed = "permission_not_allowed"
)
View Source 
const DefaultMaxPendingConfirmationIntentsPerPlugin = 64

Variables

View Source 
var (
	ErrInvalidConfirmationIntent       = errors.New("plugin confirmation intent is invalid")
	ErrConfirmationIntentNotFound      = errors.New("plugin confirmation intent not found")
	ErrConfirmationIntentExpired       = errors.New("plugin confirmation intent expired")
	ErrConfirmationIntentScopeMismatch = errors.New("plugin confirmation intent scope mismatch")
)
View Source 
var (
	ErrInvalidPolicy  = errors.New("plugin security policy is invalid")
	ErrPolicyNotFound = errors.New("plugin security policy not found")
	ErrPolicyDenied   = errors.New("plugin security policy denied request")
)

Functions

This section is empty.

Types

type ConfirmationIntentRecord 

type ConfirmationIntentRecord struct {
	ConfirmationID      string            `json:"confirmation_id"`
	ConfirmationTokenID string            `json:"confirmation_token_id"`
	PluginID            string            `json:"plugin_id"`
	PluginInstanceID    string            `json:"plugin_instance_id"`
	SurfaceInstanceID   string            `json:"surface_instance_id"`
	BridgeChannelID     string            `json:"bridge_channel_id"`
	Method              string            `json:"method"`
	RequestHash         string            `json:"request_hash"`
	PlanHash            string            `json:"plan_hash"`
	Scope               ConfirmationScope `json:"scope"`
	IssuedAt            time.Time         `json:"issued_at"`
	ExpiresAt           time.Time         `json:"expires_at"`
}

type ConfirmationIntentStore 

type ConfirmationIntentStore interface {
	PutConfirmationIntent(ctx context.Context, req PutConfirmationIntentRequest) (ConfirmationIntentRecord, error)
	ConsumeConfirmationIntent(ctx context.Context, req ConsumeConfirmationIntentRequest) (ConfirmationIntentRecord, error)
	RejectConfirmationIntent(ctx context.Context, req RejectConfirmationIntentRequest) (ConfirmationIntentRecord, error)
	ListConfirmationIntents(ctx context.Context, req ListConfirmationIntentsRequest) ([]ConfirmationIntentRecord, error)
	RevokePluginConfirmationIntents(ctx context.Context, req RevokePluginConfirmationIntentsRequest) (int, error)
}

type ConfirmationScope added in v0.3.0 

type ConfirmationScope struct {
	ActiveFingerprint      string `json:"active_fingerprint"`
	OwnerSessionHash       string `json:"owner_session_hash"`
	OwnerUserHash          string `json:"owner_user_hash"`
	SessionChannelIDHash   string `json:"session_channel_id_hash"`
	PolicyRevision         uint64 `json:"policy_revision"`
	ManagementRevision     uint64 `json:"management_revision"`
	RevokeEpoch            uint64 `json:"revoke_epoch"`
	TargetDescriptorSHA256 string `json:"target_descriptor_sha256"`
}

type ConsumeConfirmationIntentRequest 

type ConsumeConfirmationIntentRequest struct {
	ConfirmationID string    `json:"confirmation_id"`
	Now            time.Time `json:"now,omitempty"`
}

type ErrorCode 

type ErrorCode string
const (
	ErrInvalidRequest               ErrorCode = "PLUGIN_INVALID_REQUEST"
	ErrManifestInvalid              ErrorCode = "PLUGIN_MANIFEST_INVALID"
	ErrPackageInvalid               ErrorCode = "PLUGIN_PACKAGE_INVALID"
	ErrPackageTooLarge              ErrorCode = "PLUGIN_PACKAGE_TOO_LARGE"
	ErrPackagePathForbidden         ErrorCode = "PLUGIN_PACKAGE_PATH_FORBIDDEN"
	ErrSignatureInvalid             ErrorCode = "PLUGIN_SIGNATURE_INVALID"
	ErrTrustStateDenied             ErrorCode = "PLUGIN_TRUST_STATE_DENIED"
	ErrTrustVerificationRequired    ErrorCode = "PLUGIN_TRUST_VERIFICATION_REQUIRED"
	ErrTrustVerificationInvalid     ErrorCode = "PLUGIN_TRUST_VERIFICATION_INVALID"
	ErrReleaseRefVerificationFailed ErrorCode = "PLUGIN_RELEASE_REF_VERIFICATION_FAILED"
	ErrReleaseRefPolicyDenied       ErrorCode = "PLUGIN_RELEASE_REF_POLICY_DENIED"
	ErrDisabled                     ErrorCode = "PLUGIN_DISABLED"
	ErrDisabledByPolicy             ErrorCode = "PLUGIN_DISABLED_BY_POLICY"
	ErrPermissionDenied             ErrorCode = "PLUGIN_PERMISSION_DENIED"
	ErrConfirmationRequired         ErrorCode = "PLUGIN_CONFIRMATION_REQUIRED"
	ErrConfirmationInvalid          ErrorCode = "PLUGIN_CONFIRMATION_INVALID"
	ErrConfirmationRejected         ErrorCode = "PLUGIN_CONFIRMATION_REJECTED"
	ErrTokenExpired                 ErrorCode = "PLUGIN_TOKEN_EXPIRED"
	ErrTokenReplay                  ErrorCode = "PLUGIN_TOKEN_REPLAY"
	ErrGatewayTokenInvalid          ErrorCode = "PLUGIN_GATEWAY_TOKEN_INVALID"
	ErrGatewayTokenReplayed         ErrorCode = "PLUGIN_GATEWAY_TOKEN_REPLAYED"
	ErrGatewayTokenChannelMismatch  ErrorCode = "PLUGIN_GATEWAY_TOKEN_CHANNEL_MISMATCH"
	ErrAssetTicketInvalid           ErrorCode = "PLUGIN_ASSET_TICKET_INVALID"
	ErrAssetSessionInvalid          ErrorCode = "PLUGIN_ASSET_SESSION_INVALID"
	ErrStreamTicketInvalid          ErrorCode = "PLUGIN_STREAM_TICKET_INVALID"
	ErrStreamCancelled              ErrorCode = "PLUGIN_STREAM_CANCELLED"
	ErrLeaseInvalid                 ErrorCode = "PLUGIN_LEASE_INVALID"
	ErrLeaseReplayed                ErrorCode = "PLUGIN_LEASE_REPLAYED"
	ErrGrantInvalid                 ErrorCode = "PLUGIN_GRANT_INVALID"
	ErrStorageQuotaExceeded         ErrorCode = "PLUGIN_STORAGE_QUOTA_EXCEEDED"
	ErrOperationBlocked             ErrorCode = "PLUGIN_OPERATION_BLOCKED"
	ErrOperationNotFound            ErrorCode = "PLUGIN_OPERATION_NOT_FOUND"
	ErrOperationNotCancelable       ErrorCode = "PLUGIN_OPERATION_NOT_CANCELABLE"
	ErrNetworkTargetDenied          ErrorCode = "PLUGIN_NETWORK_TARGET_DENIED"
	ErrNetworkRateLimited           ErrorCode = "PLUGIN_NETWORK_RATE_LIMITED"
	ErrRuntimeUnavailable           ErrorCode = "PLUGIN_RUNTIME_UNAVAILABLE"
	ErrRuntimeVersionMismatch       ErrorCode = "PLUGIN_RUNTIME_VERSION_MISMATCH"
	ErrJSONLimitExceeded            ErrorCode = "PLUGIN_JSON_LIMIT_EXCEEDED"
	ErrCapabilityError              ErrorCode = "PLUGIN_CAPABILITY_ERROR"
	ErrWorkerError                  ErrorCode = "PLUGIN_WORKER_ERROR"
	ErrContractMismatch             ErrorCode = "PLUGIN_CONTRACT_MISMATCH"
	ErrStateVersionMismatch         ErrorCode = "PLUGIN_STATE_VERSION_MISMATCH"
	ErrCSRFRequired                 ErrorCode = "PLUGIN_CSRF_REQUIRED"
	ErrRetainedDataCleanupFailed    ErrorCode = "PLUGIN_RETAINED_DATA_CLEANUP_FAILED"
	ErrRetainedDataBindFailed       ErrorCode = "PLUGIN_RETAINED_DATA_BIND_FAILED"

	ErrBridgeTimeout           ErrorCode = "PLUGIN_BRIDGE_TIMEOUT"
	ErrBridgeDisposed          ErrorCode = "PLUGIN_BRIDGE_DISPOSED"
	ErrBridgeHandshakeFailed   ErrorCode = "PLUGIN_BRIDGE_HANDSHAKE_FAILED"
	ErrBridgeHandshakeRequired ErrorCode = "PLUGIN_BRIDGE_HANDSHAKE_REQUIRED"
	ErrPlatformRequestFailed   ErrorCode = "PLUGIN_PLATFORM_REQUEST_FAILED"
	ErrStreamFailed            ErrorCode = "PLUGIN_STREAM_FAILED"
)

func BridgeErrorCodes 

func BridgeErrorCodes() []ErrorCode

func PlatformErrorCodes 

func PlatformErrorCodes() []ErrorCode

func TypeScriptClientErrorCodes 

func TypeScriptClientErrorCodes() []ErrorCode

type EvaluatePolicyRequest 

type EvaluatePolicyRequest struct {
	PluginInstanceID    string   `json:"plugin_instance_id"`
	Method              string   `json:"method"`
	RequiredPermissions []string `json:"required_permissions,omitempty"`
}

type ListConfirmationIntentsRequest 

type ListConfirmationIntentsRequest struct {
	PluginInstanceID string `json:"plugin_instance_id,omitempty"`
}

type MemoryConfirmationIntentStore 

type MemoryConfirmationIntentStore struct {
	// contains filtered or unexported fields
}

func NewMemoryConfirmationIntentStore 

func NewMemoryConfirmationIntentStore() *MemoryConfirmationIntentStore

func (*MemoryConfirmationIntentStore) ConsumeConfirmationIntent 

func (s *MemoryConfirmationIntentStore) ConsumeConfirmationIntent(_ context.Context, req ConsumeConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) ListConfirmationIntents 

func (s *MemoryConfirmationIntentStore) ListConfirmationIntents(_ context.Context, req ListConfirmationIntentsRequest) ([]ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) PutConfirmationIntent 

func (s *MemoryConfirmationIntentStore) PutConfirmationIntent(_ context.Context, req PutConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) RejectConfirmationIntent added in v0.3.0 

func (s *MemoryConfirmationIntentStore) RejectConfirmationIntent(_ context.Context, req RejectConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) RevokePluginConfirmationIntents 

func (s *MemoryConfirmationIntentStore) RevokePluginConfirmationIntents(_ context.Context, req RevokePluginConfirmationIntentsRequest) (int, error)

type MemoryPolicyStore 

type MemoryPolicyStore struct {
	// contains filtered or unexported fields
}

func NewMemoryPolicyStore 

func NewMemoryPolicyStore() *MemoryPolicyStore

func (*MemoryPolicyStore) DeletePolicy 

func (s *MemoryPolicyStore) DeletePolicy(_ context.Context, pluginInstanceID string) error

func (*MemoryPolicyStore) EvaluatePolicy 

func (s *MemoryPolicyStore) EvaluatePolicy(_ context.Context, req EvaluatePolicyRequest) (PolicyEvaluation, error)

func (*MemoryPolicyStore) GetPolicy 

func (s *MemoryPolicyStore) GetPolicy(_ context.Context, pluginInstanceID string) (PolicyRecord, error)

func (*MemoryPolicyStore) ListPolicies 

func (s *MemoryPolicyStore) ListPolicies(_ context.Context) ([]PolicyRecord, error)

func (*MemoryPolicyStore) PutPolicy 

func (s *MemoryPolicyStore) PutPolicy(_ context.Context, req PutPolicyRequest) (PolicyRecord, error)

type PolicyEvaluation 

type PolicyEvaluation struct {
	Allowed            bool     `json:"allowed"`
	Reason             string   `json:"reason,omitempty"`
	DeniedMethod       string   `json:"denied_method,omitempty"`
	MissingPermissions []string `json:"missing_permissions,omitempty"`
}

type PolicyRecord 

type PolicyRecord struct {
	PluginInstanceID   string    `json:"plugin_instance_id"`
	AllowedPermissions []string  `json:"allowed_permissions,omitempty"`
	DeniedMethods      []string  `json:"denied_methods,omitempty"`
	UpdatedAt          time.Time `json:"updated_at"`
}

type PolicyStore 

type PolicyStore interface {
	PutPolicy(ctx context.Context, req PutPolicyRequest) (PolicyRecord, error)
	GetPolicy(ctx context.Context, pluginInstanceID string) (PolicyRecord, error)
	ListPolicies(ctx context.Context) ([]PolicyRecord, error)
	DeletePolicy(ctx context.Context, pluginInstanceID string) error
	EvaluatePolicy(ctx context.Context, req EvaluatePolicyRequest) (PolicyEvaluation, error)
}

type PutConfirmationIntentRequest 

type PutConfirmationIntentRequest struct {
	ConfirmationID      string            `json:"confirmation_id"`
	ConfirmationTokenID string            `json:"confirmation_token_id"`
	PluginID            string            `json:"plugin_id"`
	PluginInstanceID    string            `json:"plugin_instance_id"`
	SurfaceInstanceID   string            `json:"surface_instance_id"`
	BridgeChannelID     string            `json:"bridge_channel_id"`
	Method              string            `json:"method"`
	RequestHash         string            `json:"request_hash"`
	PlanHash            string            `json:"plan_hash"`
	Scope               ConfirmationScope `json:"scope"`
	IssuedAt            time.Time         `json:"issued_at,omitempty"`
	ExpiresAt           time.Time         `json:"expires_at"`
	Now                 time.Time         `json:"now,omitempty"`
	MaxPendingPerPlugin int               `json:"max_pending_per_plugin,omitempty"`
}

type PutPolicyRequest 

type PutPolicyRequest struct {
	PluginInstanceID   string    `json:"plugin_instance_id"`
	AllowedPermissions []string  `json:"allowed_permissions,omitempty"`
	DeniedMethods      []string  `json:"denied_methods,omitempty"`
	Now                time.Time `json:"now,omitempty"`
}

type RejectConfirmationIntentRequest added in v0.3.0 

type RejectConfirmationIntentRequest struct {
	ConfirmationID       string    `json:"confirmation_id"`
	PluginInstanceID     string    `json:"plugin_instance_id"`
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	BridgeChannelID      string    `json:"bridge_channel_id"`
	ActiveFingerprint    string    `json:"active_fingerprint"`
	OwnerSessionHash     string    `json:"owner_session_hash"`
	OwnerUserHash        string    `json:"owner_user_hash"`
	SessionChannelIDHash string    `json:"session_channel_id_hash"`
	PolicyRevision       uint64    `json:"policy_revision"`
	ManagementRevision   uint64    `json:"management_revision"`
	RevokeEpoch          uint64    `json:"revoke_epoch"`
	Now                  time.Time `json:"now,omitempty"`
}

type RevokePluginConfirmationIntentsRequest 

type RevokePluginConfirmationIntentsRequest struct {
	PluginInstanceID string    `json:"plugin_instance_id"`
	Now              time.Time `json:"now,omitempty"`
}

type SQLiteConfirmationIntentStore 

type SQLiteConfirmationIntentStore struct {
	// contains filtered or unexported fields
}

func NewSQLiteConfirmationIntentStore 

func NewSQLiteConfirmationIntentStore(ctx context.Context, path string) (*SQLiteConfirmationIntentStore, error)

func (*SQLiteConfirmationIntentStore) Close 

func (s *SQLiteConfirmationIntentStore) Close() error

func (*SQLiteConfirmationIntentStore) ConsumeConfirmationIntent 

func (s *SQLiteConfirmationIntentStore) ConsumeConfirmationIntent(ctx context.Context, req ConsumeConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) ListConfirmationIntents 

func (s *SQLiteConfirmationIntentStore) ListConfirmationIntents(ctx context.Context, req ListConfirmationIntentsRequest) ([]ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) PutConfirmationIntent 

func (s *SQLiteConfirmationIntentStore) PutConfirmationIntent(ctx context.Context, req PutConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) RejectConfirmationIntent added in v0.3.0 

func (s *SQLiteConfirmationIntentStore) RejectConfirmationIntent(ctx context.Context, req RejectConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) RevokePluginConfirmationIntents 

func (s *SQLiteConfirmationIntentStore) RevokePluginConfirmationIntents(ctx context.Context, req RevokePluginConfirmationIntentsRequest) (int, error)

type SQLitePolicyStore 

type SQLitePolicyStore struct {
	// contains filtered or unexported fields
}

func NewSQLitePolicyStore 

func NewSQLitePolicyStore(ctx context.Context, path string) (*SQLitePolicyStore, error)

func (*SQLitePolicyStore) Close 

func (s *SQLitePolicyStore) Close() error

func (*SQLitePolicyStore) DeletePolicy 

func (s *SQLitePolicyStore) DeletePolicy(ctx context.Context, pluginInstanceID string) error

func (*SQLitePolicyStore) EvaluatePolicy 

func (s *SQLitePolicyStore) EvaluatePolicy(ctx context.Context, req EvaluatePolicyRequest) (PolicyEvaluation, error)

func (*SQLitePolicyStore) GetPolicy 

func (s *SQLitePolicyStore) GetPolicy(ctx context.Context, pluginInstanceID string) (PolicyRecord, error)

func (*SQLitePolicyStore) ListPolicies 

func (s *SQLitePolicyStore) ListPolicies(ctx context.Context) ([]PolicyRecord, error)

func (*SQLitePolicyStore) PutPolicy 

func (s *SQLitePolicyStore) PutPolicy(ctx context.Context, req PutPolicyRequest) (PolicyRecord, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.