Documentation
¶
Overview ¶
Package actions runs named verbs: each goes through policy, runs as a job and, unless it only reads, lands in the audit log.
Index ¶
Constants ¶
This section is empty.
Variables ¶
View Source
var ErrDeclined = errors.New("declined")
ErrDeclined is a confirm or reauth no one was asked about.
Functions ¶
Types ¶
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
func NewRegistry ¶
func NewRegistry() *Registry
type Runner ¶
type Runner struct {
Actions *Registry
Policy *policy.Config
Envs map[string]policy.Env
Jobs *jobs.Manager
// Audit, when set, logs every action that is not a read.
Audit *audit.Log
// Ask settles a confirm or reauth decision: nil to go ahead, else why not.
Ask AskFunc
// Inbox, when set, keeps writes that need approval until another person decides.
Inbox *inbox.Inbox
}
func (*Runner) Decide ¶
func (r *Runner) Decide(ctx context.Context, id string, approve bool, by identity.Subject) (_ *protocol.RunResult, err error)
Decide approves or rejects a pending item as by, who must be a person other than whoever asked. An approved item runs as its subject, audited with the approver.
Click to show internal directories.
Click to hide internal directories.