enclavegithub

package

v0.5.1 Latest Latest Go to latest Published: Oct 30, 2026 License: MIT Imports: 18 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/github/gh-aw-mcpg

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func NormalizeRepository(repo string) (string, bool)
type Claims
- func (c *Claims) AgentID() string
- func (c *Claims) AllowsOperation(operation string) bool
type Policy
- func ParsePolicy(raw string) (*Policy, error)
type RepositoryPolicy
type Route
- func MatchEnclaveRoute(path string, query url.Values) (*Route, error)
- func (r *Route) FullRepo() string
type Verifier
- func NewVerifier(rootKeyHex string, policy *Policy) (*Verifier, error)
- func (v *Verifier) VerifyAuthorization(header string) (*Claims, error)

Constants ¶

View Source

const (
	ProfileIssuesReadV1 = "issues-read-v1"
	DefaultAudience     = "gh-aw-enclave-github"
	CapabilityPrefix    = "awf-egh1"

	EnvCapabilityKey = "MCP_GATEWAY_ENCLAVE_CAPABILITY_KEY"
	EnvPolicyJSON    = "MCP_GATEWAY_ENCLAVE_POLICY_JSON"

	OperationIssueCommentsList = "issues.comments.list"
	OperationIssuesGet         = "issues.get"
	OperationIssuesList        = "issues.list"
	MaxCapabilityTTLSeconds    = 600
)

Variables ¶

This section is empty.

Functions ¶

func NormalizeRepository ¶

func NormalizeRepository(repo string) (string, bool)

NormalizeRepository returns a canonical lowercase owner/name repository.

Types ¶

type Claims ¶

type Claims struct {
	Version    int      `json:"v"`
	Audience   string   `json:"aud"`
	Run        string   `json:"run"`
	Invocation string   `json:"inv"`
	Repo       string   `json:"repo"`
	Profile    string   `json:"profile"`
	Operations []string `json:"ops"`
	NotBefore  int64    `json:"nbf"`
	Expires    int64    `json:"exp"`
}

Claims is the invocation-bound capability payload minted by AWF.

func (*Claims) AgentID ¶

func (c *Claims) AgentID() string

AgentID returns the stable DIFC registry key for this invocation.

func (*Claims) AllowsOperation ¶

func (c *Claims) AllowsOperation(operation string) bool

AllowsOperation reports whether the invocation capability permits operation.

type Policy ¶

type Policy struct {
	Version                 int                `json:"version"`
	Profile                 string             `json:"profile"`
	Audience                string             `json:"audience"`
	WorkflowRunID           string             `json:"workflow_run_id"`
	Repositories            []RepositoryPolicy `json:"repositories"`
	PublicMinIntegrity      string             `json:"public_min_integrity"`
	AllowedOperations       []string           `json:"allowed_operations"`
	MaxCapabilityTTLSeconds int64              `json:"max_capability_ttl_seconds"`
}

Policy is the compiler-owned authorization contract for one workflow run.

func ParsePolicy ¶

func ParsePolicy(raw string) (*Policy, error)

ParsePolicy parses and validates a compiler-generated enclave policy.

func (*Policy) AllowsOperation ¶

func (p *Policy) AllowsOperation(operation string) bool

AllowsOperation reports whether operation is enabled by the compiler policy.

func (*Policy) GuardPolicyJSON ¶

func (p *Policy) GuardPolicyJSON() (string, error)

GuardPolicyJSON returns the internal allow-only policy for this enclave profile.

func (*Policy) GuardRepos ¶

func (p *Policy) GuardRepos() []string

GuardRepos returns exact assigned repositories followed by the public catch-all.

func (*Policy) HasRepository ¶

func (p *Policy) HasRepository(repo string) bool

HasRepository reports whether repo is an assignable repository in the policy.

func (*Policy) RepositorySensitivity ¶

func (p *Policy) RepositorySensitivity(repo string) (string, bool)

RepositorySensitivity returns the configured sensitivity for repo.

func (*Policy) Validate ¶

func (p *Policy) Validate() error

Validate checks policy invariants and canonicalizes set-like fields.

type RepositoryPolicy ¶

type RepositoryPolicy struct {
	Repo        string `json:"repo"`
	Sensitivity string `json:"sensitivity"`
}

RepositoryPolicy identifies a repository assignable to an enclave invocation.

type Route ¶

type Route struct {
	Operation string
	Owner     string
	Repo      string
	Number    string
}

Route is a validated issues-read-v1 REST request.

func MatchEnclaveRoute ¶ added in v0.4.26

func MatchEnclaveRoute(path string, query url.Values) (*Route, error)

MatchEnclaveRoute matches only the versioned enclave issue-read REST surface.

func (*Route) FullRepo ¶

func (r *Route) FullRepo() string

FullRepo returns the canonical lowercase owner/name target.

type Verifier ¶

type Verifier struct {
	// contains filtered or unexported fields
}

Verifier verifies HMAC-signed invocation capabilities against one workflow policy.

func NewVerifier ¶

func NewVerifier(rootKeyHex string, policy *Policy) (*Verifier, error)

NewVerifier creates a capability verifier from a 32-byte lowercase-hex root key.

func (*Verifier) VerifyAuthorization ¶

func (v *Verifier) VerifyAuthorization(header string) (*Claims, error)

VerifyAuthorization verifies a Bearer capability at the current time.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL