security

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 19, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	PolicyDenyReasonMethodDenied         = "method_denied"
	PolicyDenyReasonPermissionNotAllowed = "permission_not_allowed"
)
View Source 
const DefaultMaxPendingConfirmationIntentsPerPlugin = 64

Variables

View Source 
var (
	ErrInvalidConfirmationIntent       = errors.New("plugin confirmation intent is invalid")
	ErrConfirmationIntentNotFound      = errors.New("plugin confirmation intent not found")
	ErrConfirmationIntentExpired       = errors.New("plugin confirmation intent expired")
	ErrConfirmationIntentScopeMismatch = errors.New("plugin confirmation intent scope mismatch")
)
View Source 
var (
	ErrInvalidPolicy  = errors.New("plugin security policy is invalid")
	ErrPolicyNotFound = errors.New("plugin security policy not found")
	ErrPolicyDenied   = errors.New("plugin security policy denied request")
)

Functions

func ValidatePolicy added in v0.5.0 

func ValidatePolicy(record PolicyRecord) error

func ValidatePolicyEvaluationRequest added in v0.5.0 

func ValidatePolicyEvaluationRequest(req EvaluatePolicyRequest) error

func ValidatePolicyID added in v0.5.0 

func ValidatePolicyID(pluginInstanceID string) error

Types

type ConfirmationIntentRecord 

type ConfirmationIntentRecord struct {
	ConfirmationID      string            `json:"confirmation_id"`
	ConfirmationTokenID string            `json:"confirmation_token_id"`
	PluginID            string            `json:"plugin_id"`
	PluginInstanceID    string            `json:"plugin_instance_id"`
	SurfaceInstanceID   string            `json:"surface_instance_id"`
	BridgeChannelID     string            `json:"bridge_channel_id"`
	Method              string            `json:"method"`
	RequestHash         string            `json:"request_hash"`
	PlanHash            string            `json:"plan_hash"`
	Scope               ConfirmationScope `json:"scope"`
	IssuedAt            time.Time         `json:"issued_at"`
	ExpiresAt           time.Time         `json:"expires_at"`
}

type ConfirmationIntentStore 

type ConfirmationIntentStore interface {
	PutConfirmationIntent(ctx context.Context, req PutConfirmationIntentRequest) (ConfirmationIntentRecord, error)
	ConsumeConfirmationIntent(ctx context.Context, req ConsumeConfirmationIntentRequest) (ConfirmationIntentRecord, error)
	RejectConfirmationIntent(ctx context.Context, req RejectConfirmationIntentRequest) (ConfirmationIntentRecord, error)
	ListConfirmationIntents(ctx context.Context, req ListConfirmationIntentsRequest) ([]ConfirmationIntentRecord, error)
	RevokePluginConfirmationIntents(ctx context.Context, req RevokePluginConfirmationIntentsRequest) (int, error)
}

type ConfirmationScope added in v0.3.0 

type ConfirmationScope struct {
	ActiveFingerprint      string `json:"active_fingerprint"`
	OwnerSessionHash       string `json:"owner_session_hash"`
	OwnerUserHash          string `json:"owner_user_hash"`
	OwnerEnvHash           string `json:"owner_env_hash"`
	SessionChannelIDHash   string `json:"session_channel_id_hash"`
	PolicyRevision         uint64 `json:"policy_revision"`
	ManagementRevision     uint64 `json:"management_revision"`
	RevokeEpoch            uint64 `json:"revoke_epoch"`
	TargetDescriptorSHA256 string `json:"target_descriptor_sha256"`
}

type ConsumeConfirmationIntentRequest 

type ConsumeConfirmationIntentRequest struct {
	ConfirmationID string    `json:"confirmation_id"`
	Now            time.Time `json:"-"`
}

type ErrorCode 

type ErrorCode string
const (
	ErrInvalidRequest                ErrorCode = "PLUGIN_INVALID_REQUEST"
	ErrManifestInvalid               ErrorCode = "PLUGIN_MANIFEST_INVALID"
	ErrPackageInvalid                ErrorCode = "PLUGIN_PACKAGE_INVALID"
	ErrPackageTooLarge               ErrorCode = "PLUGIN_PACKAGE_TOO_LARGE"
	ErrPackagePathForbidden          ErrorCode = "PLUGIN_PACKAGE_PATH_FORBIDDEN"
	ErrSignatureInvalid              ErrorCode = "PLUGIN_SIGNATURE_INVALID"
	ErrTrustStateDenied              ErrorCode = "PLUGIN_TRUST_STATE_DENIED"
	ErrTrustVerificationRequired     ErrorCode = "PLUGIN_TRUST_VERIFICATION_REQUIRED"
	ErrTrustVerificationInvalid      ErrorCode = "PLUGIN_TRUST_VERIFICATION_INVALID"
	ErrReleaseRefVerificationFailed  ErrorCode = "PLUGIN_RELEASE_REF_VERIFICATION_FAILED"
	ErrReleaseRefPolicyDenied        ErrorCode = "PLUGIN_RELEASE_REF_POLICY_DENIED"
	ErrDisabled                      ErrorCode = "PLUGIN_DISABLED"
	ErrDisabledByPolicy              ErrorCode = "PLUGIN_DISABLED_BY_POLICY"
	ErrPermissionDenied              ErrorCode = "PLUGIN_PERMISSION_DENIED"
	ErrOriginDenied                  ErrorCode = "PLUGIN_ORIGIN_DENIED"
	ErrActionDenied                  ErrorCode = "PLUGIN_ACTION_DENIED"
	ErrOwnerScopeMismatch            ErrorCode = "PLUGIN_OWNER_SCOPE_MISMATCH"
	ErrSecretScopeMismatch           ErrorCode = "PLUGIN_SECRET_SCOPE_MISMATCH"
	ErrStorageScopeMismatch          ErrorCode = "PLUGIN_STORAGE_SCOPE_MISMATCH"
	ErrAdapterFailure                ErrorCode = "PLUGIN_ADAPTER_FAILURE"
	ErrConfirmationRequired          ErrorCode = "PLUGIN_CONFIRMATION_REQUIRED"
	ErrConfirmationInvalid           ErrorCode = "PLUGIN_CONFIRMATION_INVALID"
	ErrConfirmationRejected          ErrorCode = "PLUGIN_CONFIRMATION_REJECTED"
	ErrTokenExpired                  ErrorCode = "PLUGIN_TOKEN_EXPIRED"
	ErrTokenReplay                   ErrorCode = "PLUGIN_TOKEN_REPLAY"
	ErrGatewayTokenInvalid           ErrorCode = "PLUGIN_GATEWAY_TOKEN_INVALID"
	ErrGatewayTokenReplayed          ErrorCode = "PLUGIN_GATEWAY_TOKEN_REPLAYED"
	ErrGatewayTokenChannelMismatch   ErrorCode = "PLUGIN_GATEWAY_TOKEN_CHANNEL_MISMATCH"
	ErrAssetTicketInvalid            ErrorCode = "PLUGIN_ASSET_TICKET_INVALID"
	ErrAssetSessionInvalid           ErrorCode = "PLUGIN_ASSET_SESSION_INVALID"
	ErrStreamTicketInvalid           ErrorCode = "PLUGIN_STREAM_TICKET_INVALID"
	ErrStreamDeliveryInvalid         ErrorCode = "PLUGIN_STREAM_DELIVERY_INVALID"
	ErrStreamCancelled               ErrorCode = "PLUGIN_STREAM_CANCELLED"
	ErrLeaseInvalid                  ErrorCode = "PLUGIN_LEASE_INVALID"
	ErrLeaseReplayed                 ErrorCode = "PLUGIN_LEASE_REPLAYED"
	ErrGrantInvalid                  ErrorCode = "PLUGIN_GRANT_INVALID"
	ErrStorageQuotaExceeded          ErrorCode = "PLUGIN_STORAGE_QUOTA_EXCEEDED"
	ErrOperationBlocked              ErrorCode = "PLUGIN_OPERATION_BLOCKED"
	ErrOperationNotFound             ErrorCode = "PLUGIN_OPERATION_NOT_FOUND"
	ErrOperationNotCancelable        ErrorCode = "PLUGIN_OPERATION_NOT_CANCELABLE"
	ErrNetworkTargetDenied           ErrorCode = "PLUGIN_NETWORK_TARGET_DENIED"
	ErrNetworkRateLimited            ErrorCode = "PLUGIN_NETWORK_RATE_LIMITED"
	ErrRuntimeUnavailable            ErrorCode = "PLUGIN_RUNTIME_UNAVAILABLE"
	ErrRuntimeVersionMismatch        ErrorCode = "PLUGIN_RUNTIME_VERSION_MISMATCH"
	ErrUIProtocolUnsupported         ErrorCode = "PLUGIN_UI_PROTOCOL_UNSUPPORTED"
	ErrUIProtocolViolation           ErrorCode = "PLUGIN_UI_PROTOCOL_VIOLATION"
	ErrSurfaceQuiesceTimeout         ErrorCode = "PLUGIN_SURFACE_QUIESCE_TIMEOUT"
	ErrJSONLimitExceeded             ErrorCode = "PLUGIN_JSON_LIMIT_EXCEEDED"
	ErrCapabilityError               ErrorCode = "PLUGIN_CAPABILITY_ERROR"
	ErrWorkerError                   ErrorCode = "PLUGIN_WORKER_ERROR"
	ErrContractMismatch              ErrorCode = "PLUGIN_CONTRACT_MISMATCH"
	ErrManagementRevisionMismatch    ErrorCode = "PLUGIN_MANAGEMENT_REVISION_MISMATCH"
	ErrAuthorizationRevisionMismatch ErrorCode = "PLUGIN_AUTHORIZATION_REVISION_MISMATCH"
	ErrBindingRevisionMismatch       ErrorCode = "PLUGIN_BINDING_REVISION_MISMATCH"
	ErrValuesRevisionMismatch        ErrorCode = "PLUGIN_VALUES_REVISION_MISMATCH"
	ErrCSRFRequired                  ErrorCode = "PLUGIN_CSRF_REQUIRED"
	ErrCSRFInvalid                   ErrorCode = "PLUGIN_CSRF_INVALID"

	ErrBridgeCancelled         ErrorCode = "PLUGIN_BRIDGE_CANCELLED"
	ErrBridgeTimeout           ErrorCode = "PLUGIN_BRIDGE_TIMEOUT"
	ErrBridgeDisposed          ErrorCode = "PLUGIN_BRIDGE_DISPOSED"
	ErrBridgeHandshakeFailed   ErrorCode = "PLUGIN_BRIDGE_HANDSHAKE_FAILED"
	ErrBridgeHandshakeRequired ErrorCode = "PLUGIN_BRIDGE_HANDSHAKE_REQUIRED"
	ErrPlatformRequestFailed   ErrorCode = "PLUGIN_PLATFORM_REQUEST_FAILED"
	ErrStreamFailed            ErrorCode = "PLUGIN_STREAM_FAILED"
	ErrFeatureNotConfigured    ErrorCode = "PLUGIN_FEATURE_NOT_CONFIGURED"
)

func BridgeErrorCodes 

func BridgeErrorCodes() []ErrorCode

func PlatformErrorCodes 

func PlatformErrorCodes() []ErrorCode

func TypeScriptClientErrorCodes 

func TypeScriptClientErrorCodes() []ErrorCode

type EvaluatePolicyRequest 

type EvaluatePolicyRequest struct {
	PluginInstanceID    string   `json:"plugin_instance_id"`
	Method              string   `json:"method"`
	RequiredPermissions []string `json:"required_permissions,omitempty"`
}

type ListConfirmationIntentsRequest 

type ListConfirmationIntentsRequest struct {
	PluginInstanceID string `json:"plugin_instance_id,omitempty"`
}

type MemoryConfirmationIntentStore 

type MemoryConfirmationIntentStore struct {
	// contains filtered or unexported fields
}

func NewMemoryConfirmationIntentStore 

func NewMemoryConfirmationIntentStore() *MemoryConfirmationIntentStore

func (*MemoryConfirmationIntentStore) ConsumeConfirmationIntent 

func (s *MemoryConfirmationIntentStore) ConsumeConfirmationIntent(_ context.Context, req ConsumeConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) ListConfirmationIntents 

func (s *MemoryConfirmationIntentStore) ListConfirmationIntents(_ context.Context, req ListConfirmationIntentsRequest) ([]ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) PutConfirmationIntent 

func (s *MemoryConfirmationIntentStore) PutConfirmationIntent(_ context.Context, req PutConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) RejectConfirmationIntent added in v0.3.0 

func (s *MemoryConfirmationIntentStore) RejectConfirmationIntent(_ context.Context, req RejectConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*MemoryConfirmationIntentStore) RevokePluginConfirmationIntents 

func (s *MemoryConfirmationIntentStore) RevokePluginConfirmationIntents(_ context.Context, req RevokePluginConfirmationIntentsRequest) (int, error)

type PolicyEvaluation 

type PolicyEvaluation struct {
	Allowed            bool     `json:"allowed"`
	Reason             string   `json:"reason,omitempty"`
	DeniedMethod       string   `json:"denied_method,omitempty"`
	MissingPermissions []string `json:"missing_permissions,omitempty"`
}

func Evaluate added in v0.5.0 

func Evaluate(policy *PolicyRecord, req EvaluatePolicyRequest) (PolicyEvaluation, error)

type PolicyRecord 

type PolicyRecord struct {
	PluginInstanceID   string    `json:"plugin_instance_id"`
	AllowedPermissions []string  `json:"allowed_permissions,omitempty"`
	DeniedMethods      []string  `json:"denied_methods,omitempty"`
	UpdatedAt          time.Time `json:"updated_at"`
}

func ClonePolicy added in v0.5.0 

func ClonePolicy(record PolicyRecord) PolicyRecord

func NewPolicy added in v0.5.0 

func NewPolicy(req PutPolicyRequest) (PolicyRecord, error)

func NormalizePolicy added in v0.5.0 

func NormalizePolicy(record PolicyRecord) PolicyRecord

type PutConfirmationIntentRequest 

type PutConfirmationIntentRequest struct {
	ConfirmationID      string            `json:"confirmation_id"`
	ConfirmationTokenID string            `json:"confirmation_token_id"`
	PluginID            string            `json:"plugin_id"`
	PluginInstanceID    string            `json:"plugin_instance_id"`
	SurfaceInstanceID   string            `json:"surface_instance_id"`
	BridgeChannelID     string            `json:"bridge_channel_id"`
	Method              string            `json:"method"`
	RequestHash         string            `json:"request_hash"`
	PlanHash            string            `json:"plan_hash"`
	Scope               ConfirmationScope `json:"scope"`
	IssuedAt            time.Time         `json:"issued_at,omitempty"`
	ExpiresAt           time.Time         `json:"expires_at"`
	Now                 time.Time         `json:"-"`
	MaxPendingPerPlugin int               `json:"max_pending_per_plugin,omitempty"`
}

type PutPolicyRequest 

type PutPolicyRequest struct {
	PluginInstanceID   string    `json:"plugin_instance_id"`
	AllowedPermissions []string  `json:"allowed_permissions,omitempty"`
	DeniedMethods      []string  `json:"denied_methods,omitempty"`
	Now                time.Time `json:"-"`
}

type RejectConfirmationIntentRequest added in v0.3.0 

type RejectConfirmationIntentRequest struct {
	ConfirmationID       string    `json:"confirmation_id"`
	PluginInstanceID     string    `json:"plugin_instance_id"`
	SurfaceInstanceID    string    `json:"surface_instance_id"`
	BridgeChannelID      string    `json:"bridge_channel_id"`
	ActiveFingerprint    string    `json:"active_fingerprint"`
	OwnerSessionHash     string    `json:"owner_session_hash"`
	OwnerUserHash        string    `json:"owner_user_hash"`
	OwnerEnvHash         string    `json:"owner_env_hash"`
	SessionChannelIDHash string    `json:"session_channel_id_hash"`
	PolicyRevision       uint64    `json:"policy_revision"`
	ManagementRevision   uint64    `json:"management_revision"`
	RevokeEpoch          uint64    `json:"revoke_epoch"`
	Now                  time.Time `json:"-"`
}

type RevokePluginConfirmationIntentsRequest 

type RevokePluginConfirmationIntentsRequest struct {
	PluginInstanceID string    `json:"plugin_instance_id"`
	Now              time.Time `json:"-"`
}

type SQLiteConfirmationIntentStore 

type SQLiteConfirmationIntentStore struct {
	// contains filtered or unexported fields
}

func NewSQLiteConfirmationIntentStore 

func NewSQLiteConfirmationIntentStore(ctx context.Context, path string) (*SQLiteConfirmationIntentStore, error)

func (*SQLiteConfirmationIntentStore) Close 

func (s *SQLiteConfirmationIntentStore) Close() error

func (*SQLiteConfirmationIntentStore) ConsumeConfirmationIntent 

func (s *SQLiteConfirmationIntentStore) ConsumeConfirmationIntent(ctx context.Context, req ConsumeConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) ListConfirmationIntents 

func (s *SQLiteConfirmationIntentStore) ListConfirmationIntents(ctx context.Context, req ListConfirmationIntentsRequest) ([]ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) PutConfirmationIntent 

func (s *SQLiteConfirmationIntentStore) PutConfirmationIntent(ctx context.Context, req PutConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) RejectConfirmationIntent added in v0.3.0 

func (s *SQLiteConfirmationIntentStore) RejectConfirmationIntent(ctx context.Context, req RejectConfirmationIntentRequest) (ConfirmationIntentRecord, error)

func (*SQLiteConfirmationIntentStore) RevokePluginConfirmationIntents 

func (s *SQLiteConfirmationIntentStore) RevokePluginConfirmationIntents(ctx context.Context, req RevokePluginConfirmationIntentsRequest) (int, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.