Documentation
¶
Index ¶
- Constants
- Variables
- type CompiledPolicy
- func (cp *CompiledPolicy) Evaluate(claims map[string]any, tokenType string) error
- func (cp *CompiledPolicy) EvaluateWithLimits(claims map[string]any, tokenType string, timeout time.Duration, ...) (retErr error)
- func (cp *CompiledPolicy) EvaluateWithTimeout(claims map[string]any, tokenType string, timeout time.Duration) error
Constants ¶
const DefaultMaxInstructions = 1_000_000
DefaultMaxInstructions is the default maximum number of Lua VM instructions allowed per evaluation. gopher-lua checks context cancellation on every VM cycle, so this limit is enforced by converting it to a tight time budget (instructionBudgetPerUnit × maxInstructions) that acts as a secondary safeguard against CPU exhaustion in addition to the caller-specified timeout.
const DefaultTimeout = 5 * time.Second
DefaultTimeout is the default execution time limit per Lua evaluation.
Variables ¶
var ErrLuaInstructionLimit = errors.New("lua script exceeded instruction limit")
ErrLuaInstructionLimit is returned when Lua script exceeds the instruction counter limit.
var ErrLuaPanic = errors.New("lua script caused panic")
ErrLuaPanic is returned when a Lua script causes an unrecoverable panic.
var ErrLuaTimeout = errors.New("lua script exceeded execution time limit")
ErrLuaTimeout is returned when Lua script exceeds execution time limit.
Functions ¶
This section is empty.
Types ¶
type CompiledPolicy ¶
type CompiledPolicy struct {
// contains filtered or unexported fields
}
CompiledPolicy holds a pre-compiled Lua script for reuse across calls.
func Compile ¶
func Compile(script string) (*CompiledPolicy, error)
Compile parses and compiles a Lua script. The result can be reused for many Evaluate calls.
func (*CompiledPolicy) Evaluate ¶
func (cp *CompiledPolicy) Evaluate(claims map[string]any, tokenType string) error
Evaluate runs the compiled Lua policy against the given claims and token type. It returns nil if the script passes, or an error describing the policy violation.
SECURITY NOTE: Lua policies must be treated as trusted configuration. Only load scripts from trusted sources (e.g., config files under your control). Do not allow untrusted user input to define Lua policy scripts.
func (*CompiledPolicy) EvaluateWithLimits ¶ added in v0.0.2
func (cp *CompiledPolicy) EvaluateWithLimits(claims map[string]any, tokenType string, timeout time.Duration, maxInstructions int) (retErr error)
EvaluateWithLimits runs with a custom execution timeout and instruction limit. If maxInstructions is 0, no instruction limit is enforced (timeout still applies).
SECURITY NOTE: Lua policies must be treated as trusted configuration. Only load scripts from trusted sources (e.g., config files under your control). Do not allow untrusted user input to define Lua policy scripts.
func (*CompiledPolicy) EvaluateWithTimeout ¶
func (cp *CompiledPolicy) EvaluateWithTimeout(claims map[string]any, tokenType string, timeout time.Duration) error
EvaluateWithTimeout runs with a custom execution timeout. No instruction limit is applied; use EvaluateWithLimits to set one explicitly.
Source Files