security

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 15, 2026 License: MIT Imports: 10 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	PolicyDenyReasonMethodDenied         = "method_denied"
	PolicyDenyReasonPermissionNotAllowed = "permission_not_allowed"
)
View Source 
const DefaultMaxPendingConfirmationIntentsPerPlugin = 64

Variables

View Source 
var (
	ErrInvalidConfirmationIntent       = errors.New("plugin confirmation intent is invalid")
	ErrConfirmationIntentNotFound      = errors.New("plugin confirmation intent not found")
	ErrConfirmationIntentExpired       = errors.New("plugin confirmation intent expired")
	ErrConfirmationIntentScopeMismatch = errors.New("plugin confirmation intent scope mismatch")
)
View Source 
var (
	ErrInvalidPolicy  = errors.New("plugin security policy is invalid")
	ErrPolicyNotFound = errors.New("plugin security policy not found")
	ErrPolicyDenied   = errors.New("plugin security policy denied request")
)

Functions

This section is empty.

Types

type ConfirmationIntentRecord 

type ConfirmationIntentRecord struct {
	ConfirmationID      string            `json:"confirmation_id"`
	ConfirmationTokenID string            `json:"confirmation_token_id"`
	PluginID            string            `json:"plugin_id"`
	PluginInstanceID    string            `json:"plugin_instance_id"`
	SurfaceInstanceID   string            `json:"surface_instance_id"`
	BridgeChannelID     string            `json:"bridge_channel_id"`
	Method              string            `json:"method"`
	RequestHash         string            `json:"request_hash"`
	PlanHash            string            `json:"plan_hash"`
	Scope               ConfirmationScope `json:"scope"`
	IssuedAt            time.Time         `json:"issued_at"`
	ExpiresAt           time.Time         `json:"expires_at"`
}

type ConfirmationIntentStore 

type ConfirmationIntentStore interface {
	PutConfirmationIntent(ctx context.Context, req PutConfirmationIntentRequest) (ConfirmationIntentRecord, error)
	ConsumeConfirmationIntent(ctx context.Context, req ConsumeConfirmationIntentRequest) (ConfirmationIntentRecord, error)
	RejectConfirmationIntent(ctx context.Context, req RejectConfirmationIntentRequest) (ConfirmationIntentRecord, error)
	ListConfirmationIntents(ctx context.Context, req ListConfirmationIntentsRequest) ([]ConfirmationIntentRecord, error)
	RevokePluginConfirmationIntents(ctx context.Context, req RevokePluginConfirmationIntentsRequest) (int, error)
}

type ConfirmationScope added in v0.3.0 

type ConfirmationScope struct {
	ActiveFingerprint      string `json:"active_fingerprint"`
	OwnerSessionHash       string `json:"owner_session_hash"`
	OwnerUserHash          string `json:"owner_user_hash"`
	SessionChannelIDHash   string `json:"session_channel_id_hash"`
	PolicyRevision         uint64 `json:"policy_revision"`
	ManagementRevision     uint64 `json:"management_revision"`
	RevokeEpoch            uint64 `json:"revoke_epoch"`
	TargetDescriptorSHA256 string `json:"target_descriptor_sha256"`
}

type ConsumeConfirmationIntentRequest 

type ConsumeConfirmationIntentRequest struct {
	ConfirmationID string    `json:"confirmation_id"`
	Now            time.Time `json:"now,omitempty"`
}

type ErrorCode 

type ErrorCode string
const (
	ErrInvalidRequest               ErrorCode = "PLUGIN_INVALID_REQUEST"
	ErrManifestInvalid              ErrorCode = "PLUGIN_MANIFEST_INVALID"
	ErrPackageInvalid               ErrorCode = "PLUGIN_PACKAGE_INVALID"
	ErrPackageTooLarge              ErrorCode = "PLUGIN_PACKAGE_TOO_LARGE"
	ErrPackagePathForbidden         ErrorCode = "PLUGIN_PACKAGE_PATH_FORBIDDEN"
	ErrSignatureInvalid             ErrorCode = "PLUGIN_SIGNATURE_INVALID"
	ErrTrustStateDenied             ErrorCode = "PLUGIN_TRUST_STATE_DENIED"
	ErrTrustVerificationRequired    ErrorCode = "PLUGIN_TRUST_VERIFICATION_REQUIRED"
	ErrTrustVerificationInvalid     ErrorCode = "PLUGIN_TRUST_VERIFICATION_INVALID"
	ErrReleaseRefVerificationFailed ErrorCode = "PLUGIN_RELEASE_REF_VERIFICATION_FAILED"
	ErrReleaseRefPolicyDenied       ErrorCode = "PLUGIN_RELEASE_REF_POLICY_DENIED"
	ErrDisabled                     ErrorCode = "PLUGIN_DISABLED"
	ErrDisabledByPolicy             ErrorCode = "PLUGIN_DISABLED_BY_POLICY"
	ErrPermissionDenied             ErrorCode = "PLUGIN_PERMISSION_DENIED"
	ErrConfirmationRequired         ErrorCode = "PLUGIN_CONFIRMATION_REQUIRED"
	ErrConfirmationInvalid          ErrorCode = "PLUGIN_CONFIRMATION_INVALID"
	ErrConfirmationRejected         ErrorCode = "PLUGIN_CONFIRMATION_REJECTED"
	ErrTokenExpired                 ErrorCode = "PLUGIN_TOKEN_EXPIRED"
	ErrTokenReplay                  ErrorCode = "PLUGIN_TOKEN_REPLAY"
	ErrGatewayTokenInvalid          ErrorCode = "PLUGIN_GATEWAY_TOKEN_INVALID"
	ErrGatewayTokenReplayed         ErrorCode = "PLUGIN_GATEWAY_TOKEN_REPLAYED"
	ErrGatewayTokenChannelMismatch  ErrorCode = "PLUGIN_GATEWAY_TOKEN_CHANNEL_MISMATCH"
	ErrAssetTicketInvalid           ErrorCode = "PLUGIN_ASSET_TICKET_INVALID"
	ErrAssetSessionInvalid          ErrorCode = "PLUGIN_ASSET_SESSION_INVALID"
	ErrStreamTicketInvalid          ErrorCode = "PLUGIN_STREAM_TICKET_INVALID"
	ErrStreamCancelled              ErrorCode = "PLUGIN_STREAM_CANCELLED"
	ErrLeaseInvalid                 ErrorCode = "PLUGIN_LEASE_INVALID"
	ErrLeaseReplayed                ErrorCode = "PLUGIN_LEASE_REPLAYED"
	ErrGrantInvalid                 ErrorCode = "PLUGIN_GRANT_INVALID"
	ErrStorageQuotaExceeded         ErrorCode = "PLUGIN_STORAGE_QUOTA_EXCEEDED"
	ErrOperationBlocked             ErrorCode = "PLUGIN_OPERATION_BLOCKED"
	ErrOperationNotFound            ErrorCode = "PLUGIN_OPERATION_NOT_FOUND"
	ErrOperationNotCancelable       ErrorCode = "PLUGIN_OPERATION_NOT_CANCELABLE"
	ErrNetworkTargetDenied          ErrorCode = "PLUGIN_NETWORK_TARGET_DENIED"
	ErrNetworkRateLimited           ErrorCode = "PLUGIN_NETWORK_RATE_LIMITED"
	ErrRuntimeUnavailable           ErrorCode = "PLUGIN_RUNTIME_UNAVAILABLE"
	ErrRuntimeVersionMismatch       ErrorCode = "PLUGIN_RUNTIME_VERSION_MISMATCH"
	ErrJSONLimitExceeded            ErrorCode = "PLUGIN_JSON_LIMIT_EXCEEDED"
	ErrCapabilityError              ErrorCode = "PLUGIN_CAPABILITY_ERROR"
	ErrWorkerError                  ErrorCode = "PLUGIN_WORKER_ERROR"
	ErrContractMismatch             ErrorCode = "PLUGIN_CONTRACT_MISMATCH"
	ErrStateVersionMismatch         ErrorCode = "PLUGIN_STATE_VERSION_MISMATCH"
	ErrCSRFRequired                 ErrorCode = "PLUGIN_CSRF_REQUIRED"
	ErrRetainedDataCleanupFailed    ErrorCode = "PLUGIN_RETAINED_DATA_CLEANUP_FAILED"
	ErrRetainedDataBindFailed       ErrorCode = "PLUGIN_RETAINED_DATA_BIND_FAILED"

	ErrBridgeTimeout           ErrorCode = "PLUGIN_BRIDGE_TIMEOUT"
	ErrBridgeDisposed          ErrorCode = "PLUGIN_BRIDGE_DISPOSED"
	ErrBridgeHandshakeFailed   ErrorCode = "PLUGIN_BRIDGE_HANDSHAKE_FAILED"
	ErrBridgeHandshakeRequired ErrorCode = "PLUGIN_BRIDGE_HANDSHAKE_REQUIRED"
	ErrPlatformRequestFailed   ErrorCode = "PLUGIN_PLATFORM_REQUEST_FAILED"
	ErrStreamFailed            ErrorCode = "PLUGIN_STREAM_FAILED"
)

func BridgeErrorCodes 

func BridgeErrorCodes() []ErrorCode

func PlatformErrorCodes 

func PlatformErrorCodes() []ErrorCode

func TypeScriptClientErrorCodes 

func TypeScriptClientErrorCodes() []ErrorCode

type EvaluatePolicyRequest 

type EvaluatePolicyRequest struct {
	PluginInstanceID    string   `json:"plugin_instance_id"`
	Method              string   `json:"method"`
	RequiredPermissions []string `json:"required_permissions,omitempty"`
}

type ListConfirmationIntentsRequest 

type ListConfirmationIntentsRequest struct {
	PluginInstanceID string `json:"plugin_instance_id,omitempty"`
}

type MemoryConfirmationIntentStore 

type MemoryConfirmationIntentStore struct {
	// contains filtered or unexported fields
}

func NewMemoryConfirmationIntentStore 

func NewMemoryConfirmationIntentStore() *MemoryConfirmationIntentStore

func (*MemoryConfirmationIntentStore) ConsumeConfirmationIntent 

func (s *MemoryConfirmationIntentStore) ConsumeConfirmationIntent(_ context.Context, req ConsumeConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) ListConfirmationIntents 

func (s *MemoryConfirmationIntentStore) ListConfirmationIntents(_ context.Context, req ListConfirmationIntentsRequest) ([]ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) PutConfirmationIntent 

func (s *MemoryConfirmationIntentStore) PutConfirmationIntent(_ context.Context, req PutConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) RejectConfirmationIntent added in v0.3.0 

func (s *MemoryConfirmationIntentStore) RejectConfirmationIntent(_ context.Context, req RejectConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) RevokePluginConfirmationIntents 

func (s *MemoryConfirmationIntentStore) RevokePluginConfirmationIntents(_ context.Context, req RevokePluginConfirmationIntentsRequest) (int, error)

type MemoryPolicyStore 

type MemoryPolicyStore struct {
	// contains filtered or unexported fields
}

func NewMemoryPolicyStore 

func NewMemoryPolicyStore() *MemoryPolicyStore

func (*MemoryPolicyStore) DeletePolicy 

func (s *MemoryPolicyStore) DeletePolicy(_ context.Context, pluginInstanceID string) error

func (*MemoryPolicyStore) EvaluatePolicy 

func (s *MemoryPolicyStore) EvaluatePolicy(_ context.Context, req EvaluatePolicyRequest) (PolicyEvaluation, error)

func (*MemoryPolicyStore) GetPolicy 

func (s *MemoryPolicyStore) GetPolicy(_ context.Context, pluginInstanceID string) (PolicyRecord, error)

func (*MemoryPolicyStore) ListPolicies 

func (s *MemoryPolicyStore) ListPolicies(_ context.Context) ([]PolicyRecord, error)

func (*MemoryPolicyStore) PutPolicy 

func (s *MemoryPolicyStore) PutPolicy(_ context.Context, req PutPolicyRequest) (PolicyRecord, error)

type PolicyEvaluation 

type PolicyEvaluation struct {
	Allowed            bool     `json:"allowed"`
	Reason             string   `json:"reason,omitempty"`
	DeniedMethod       string   `json:"denied_method,omitempty"`
	MissingPermissions []string `json:"missing_permissions,omitempty"`
}

type PolicyRecord 

type PolicyRecord struct {
	PluginInstanceID   string    `json:"plugin_instance_id"`
	AllowedPermissions []string  `json:"allowed_permissions,omitempty"`
	DeniedMethods      []string  `json:"denied_methods,omitempty"`
	UpdatedAt          time.Time `json:"updated_at"`
}

type PolicyStore 

type PolicyStore interface {
	PutPolicy(ctx context.Context, req PutPolicyRequest) (PolicyRecord, error)
	GetPolicy(ctx context.Context, pluginInstanceID string) (PolicyRecord, error)
	ListPolicies(ctx context.Context) ([]PolicyRecord, error)
	DeletePolicy(ctx context.Context, pluginInstanceID string) error
	EvaluatePolicy(ctx context.Context, req EvaluatePolicyRequest) (PolicyEvaluation, error)
}

type PutConfirmationIntentRequest 

type PutConfirmationIntentRequest struct {
	ConfirmationID      string            `json:"confirmation_id"`
	ConfirmationTokenID string            `json:"confirmation_token_id"`
	PluginID            string            `json:"plugin_id"`
	PluginInstanceID    string            `json:"plugin_instance_id"`
	SurfaceInstanceID   string            `json:"surface_instance_id"`
	BridgeChannelID     string            `json:"bridge_channel_id"`
	Method              string            `json:"method"`
	RequestHash         string            `json:"request_hash"`
	PlanHash            string            `json:"plan_hash"`
	Scope               ConfirmationScope `json:"scope"`
	IssuedAt            time.Time         `json:"issued_at,omitempty"`
	ExpiresAt           time.Time         `json:"expires_at"`
	Now                 time.Time         `json:"now,omitempty"`
	MaxPendingPerPlugin int               `json:"max_pending_per_plugin,omitempty"`
}

type PutPolicyRequest 

type PutPolicyRequest struct {
	PluginInstanceID   string    `json:"plugin_instance_id"`
	AllowedPermissions []string  `json:"allowed_permissions,omitempty"`
	DeniedMethods      []string  `json:"denied_methods,omitempty"`
	Now                time.Time `json:"now,omitempty"`
}

type RejectConfirmationIntentRequest added in v0.3.0 

type RejectConfirmationIntentRequest struct {
	ConfirmationID       string    `json:"confirmation_id"`
	PluginInstanceID     string    `json:"plugin_instance_id"`
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	BridgeChannelID      string    `json:"bridge_channel_id"`
	ActiveFingerprint    string    `json:"active_fingerprint"`
	OwnerSessionHash     string    `json:"owner_session_hash"`
	OwnerUserHash        string    `json:"owner_user_hash"`
	SessionChannelIDHash string    `json:"session_channel_id_hash"`
	PolicyRevision       uint64    `json:"policy_revision"`
	ManagementRevision   uint64    `json:"management_revision"`
	RevokeEpoch          uint64    `json:"revoke_epoch"`
	Now                  time.Time `json:"now,omitempty"`
}

type RevokePluginConfirmationIntentsRequest 

type RevokePluginConfirmationIntentsRequest struct {
	PluginInstanceID string    `json:"plugin_instance_id"`
	Now              time.Time `json:"now,omitempty"`
}

type SQLiteConfirmationIntentStore 

type SQLiteConfirmationIntentStore struct {
	// contains filtered or unexported fields
}

func NewSQLiteConfirmationIntentStore 

func NewSQLiteConfirmationIntentStore(ctx context.Context, path string) (*SQLiteConfirmationIntentStore, error)

func (*SQLiteConfirmationIntentStore) Close 

func (s *SQLiteConfirmationIntentStore) Close() error

func (*SQLiteConfirmationIntentStore) ConsumeConfirmationIntent 

func (s *SQLiteConfirmationIntentStore) ConsumeConfirmationIntent(ctx context.Context, req ConsumeConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) ListConfirmationIntents 

func (s *SQLiteConfirmationIntentStore) ListConfirmationIntents(ctx context.Context, req ListConfirmationIntentsRequest) ([]ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) PutConfirmationIntent 

func (s *SQLiteConfirmationIntentStore) PutConfirmationIntent(ctx context.Context, req PutConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) RejectConfirmationIntent added in v0.3.0 

func (s *SQLiteConfirmationIntentStore) RejectConfirmationIntent(ctx context.Context, req RejectConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) RevokePluginConfirmationIntents 

func (s *SQLiteConfirmationIntentStore) RevokePluginConfirmationIntents(ctx context.Context, req RevokePluginConfirmationIntentsRequest) (int, error)

type SQLitePolicyStore 

type SQLitePolicyStore struct {
	// contains filtered or unexported fields
}

func NewSQLitePolicyStore 

func NewSQLitePolicyStore(ctx context.Context, path string) (*SQLitePolicyStore, error)

func (*SQLitePolicyStore) Close 

func (s *SQLitePolicyStore) Close() error

func (*SQLitePolicyStore) DeletePolicy 

func (s *SQLitePolicyStore) DeletePolicy(ctx context.Context, pluginInstanceID string) error

func (*SQLitePolicyStore) EvaluatePolicy 

func (s *SQLitePolicyStore) EvaluatePolicy(ctx context.Context, req EvaluatePolicyRequest) (PolicyEvaluation, error)

func (*SQLitePolicyStore) GetPolicy 

func (s *SQLitePolicyStore) GetPolicy(ctx context.Context, pluginInstanceID string) (PolicyRecord, error)

func (*SQLitePolicyStore) ListPolicies 

func (s *SQLitePolicyStore) ListPolicies(ctx context.Context) ([]PolicyRecord, error)

func (*SQLitePolicyStore) PutPolicy 

func (s *SQLitePolicyStore) PutPolicy(ctx context.Context, req PutPolicyRequest) (PolicyRecord, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.