actions

package
v0.28.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 12, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Overview

Package actions runs named verbs: each goes through policy, runs as a job and, unless it only reads, lands in the audit log.

Index

Constants

This section is empty.

Variables

View Source
var ErrDeclined = errors.New("declined")

ErrDeclined is a confirm or reauth no one was asked about.

Functions

func WithAsk

func WithAsk(ctx context.Context, f AskFunc) context.Context

WithAsk settles confirm and reauth for calls run with ctx instead of the runner's Ask: a server request answers for its own caller.

Types

type Action

type Action struct {
	Name   string
	Effect string
	Help   string
	Args   protocol.Schema
	Run    Func
	// Plan, when set, says what Run would do without doing it.
	Plan Func
}

type AskFunc

type AskFunc func(ctx context.Context, d policy.Decision, why string) error

type Call

type Call struct {
	Subject identity.Subject
	Env     string
	Action  string
	Args    protocol.Args
	DryRun  bool
}

type Func

type Func func(ctx context.Context, args protocol.Args) (*protocol.RunResult, error)

type Registry

type Registry struct {
	// contains filtered or unexported fields
}

func NewRegistry

func NewRegistry() *Registry

func (*Registry) Add

func (r *Registry) Add(a Action) error

func (*Registry) Get

func (r *Registry) Get(name string) (Action, bool)

func (*Registry) Names

func (r *Registry) Names() []string

type Runner

type Runner struct {
	Actions *Registry
	Policy  *policy.Config
	Envs    map[string]policy.Env
	Jobs    *jobs.Manager
	// Audit, when set, logs every action that is not a read.
	Audit *audit.Log
	// Ask settles a confirm or reauth decision: nil to go ahead, else why not.
	Ask AskFunc
	// Inbox, when set, keeps writes that need approval until another person decides.
	Inbox *inbox.Inbox
}

func (*Runner) Decide

func (r *Runner) Decide(ctx context.Context, id string, approve bool, by identity.Subject) (_ *protocol.RunResult, err error)

Decide approves or rejects a pending item as by, who must be a person other than whoever asked. An approved item runs as its subject, audited with the approver.

func (*Runner) Run

func (r *Runner) Run(ctx context.Context, c Call) (_ *jobs.Job, _ *protocol.RunResult, err error)

Run runs c as a job and waits for it.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL