Documentation
¶
Overview ¶
Package dataprofile is the data protection profile of a subject: residency, retention and locality (kombify workspace public StackKits standards/DATA-ARCHITECTURE.md section 5, D-2026-10-21-12). It is edition-neutral; the SaaS header transport lives in edgeauth (profile.go), the self-hosted Full Local profile comes from the boot environment.
Every unknown, missing or malformed value is an error: a profile that cannot be resolved denies, it never falls back to Standard.
Index ¶
- Constants
- func CapabilityDenial(requestID, capability, providerID string, p Profile) denial.Envelope
- func GuardTransport(t *http.Transport)
- func IsDenied(err error) bool
- func LocalAddr(addr netip.Addr) bool
- func LocalDestinationPolicy() (prefixes []netip.Prefix, excluded []netip.Addr)
- func LocalResolver() *net.Resolver
- func UnresolvableDenial(requestID string) denial.Envelope
- func WithProfile(ctx context.Context, p Profile) context.Context
- type DeniedError
- type DialFunc
- type Locality
- type Profile
- type Residency
- type Retention
- type Scope
Constants ¶
const ( ResidencyGlobal Residency = "global" ResidencyEU Residency = "eu" RetentionStandard Retention = "standard" RetentionZero Retention = "zero" LocalityHosted Locality = "hosted" LocalityLocal Locality = "local" ScopeAccount Scope = "account" ScopeOrganization Scope = "organization" ScopeWorkspace Scope = "workspace" ScopeSession Scope = "session" ScopeEdition Scope = "edition" )
const ( ReasonUnresolvable = "data_profile_unresolvable" ReasonCapabilityDenied = "data_profile_capability_denied" ReasonProcessorIneligible = "data_profile_processor_ineligible" )
Reason codes of the denial envelope.
const BootEnvVar = "KOMBIFY_DATA_PROFILE"
BootEnvVar selects the Full Local profile of the self-hosted edition.
const FullLocal = "full-local"
FullLocal is the only accepted value of BootEnvVar.
const ReasonFullLocal = "data_profile_full_local"
ReasonFullLocal names a Full Local refusal in logs, gates and denial envelopes.
const Version = 1
Version is the wire version of the encoded profile.
Variables ¶
This section is empty.
Functions ¶
func CapabilityDenial ¶
CapabilityDenial is the envelope for a capability the profile does not allow, for example a non-EU model under EU residency.
func GuardTransport ¶
GuardTransport binds t to the homelab: connections go through GuardDial and proxies are dropped. Use it for a transport a client creates for itself.
func IsDenied ¶
IsDenied reports whether err is a Full Local refusal. Besides a *DeniedError it recognizes the refusal of a public nameserver by LocalResolver, which the Go resolver reports as a *net.DNSError with the cause flattened to text: the error counts only if its text is exactly the text of this guard's own denial for the nameserver the error names. That is the machine reason the guard itself produced, not a reading of arbitrary error text, so an ordinary lookup failure (not found, timeout, a public server in a Standard process) is never classified as a refusal, and there is no shared state between lookups.
func LocalAddr ¶
LocalAddr reports whether addr stays inside the homelab: loopback, private (RFC 1918, RFC 4193) or link-local, except the listed provider metadata endpoints. The shared address space 100.64.0.0/10 (RFC 6598) is not included: it is assigned to provider carrier networks, not to a homelab, and no standard admits it. An IPv4-mapped IPv6 address is judged as its IPv4 address and an IPv6 zone is ignored, so fd00:ec2::254%eth0 is the metadata endpoint fd00:ec2::254 and not a distinct, accepted address.
func LocalDestinationPolicy ¶
LocalDestinationPolicy returns the homelab destination policy that LocalAddr enforces: prefixes are the accepted address ranges and excluded are the individual addresses inside them that are refused (the listed provider metadata endpoints). An address is local when a prefix contains it and excluded does not list it; a consumer must compare in the same normal form as LocalAddr, that is IPv4-mapped IPv6 addresses unmapped to IPv4 and the IPv6 zone dropped. The slices are copies, so a caller may modify them freely.
func LocalResolver ¶
LocalResolver returns a resolver that only asks homelab nameservers, so a lookup cannot reach a public DNS server. It forces the Go resolver, whose nameserver dial is the only hook for this check. A refused nameserver makes the lookup fail with a *net.DNSError that IsDenied recognizes.
func UnresolvableDenial ¶
func UnresolvableDenial(requestID string) denial.Envelope
UnresolvableDenial is the envelope for a request whose profile is missing or invalid.
Types ¶
type DeniedError ¶
type DeniedError struct {
Host string
}
DeniedError is the error of a connection Full Local refused.
func (*DeniedError) Error ¶
func (e *DeniedError) Error() string
type DialFunc ¶
DialFunc is the signature of net.Dialer.DialContext. It is an alias so named dial types of other packages (for example pgconn.DialFunc) convert implicitly.
type Profile ¶
type Profile struct {
V int `json:"v"`
Res Residency `json:"res"`
Ret Retention `json:"ret"`
Loc Locality `json:"loc"`
Scope Scope `json:"scope"`
Rev int64 `json:"rev"`
TS int64 `json:"ts"`
}
Profile is one resolved data protection profile. Rev is the revision of the stored record (0 for Standard without a record); TS is the unix second it was resolved.
func Decode ¶
Decode parses an encoded profile strictly: unknown fields, non-canonical encodings and out-of-vocabulary values fail.
func FromBoot ¶
FromBoot returns the edition profile of a self-hosted installation. Unset means hosted Standard; "full-local" is accepted only with selfhost-oss.
func FromBootEnv ¶
FromBootEnv reads BootEnvVar and the resolved edition.
func FromContext ¶
FromContext returns the verified profile. A missing profile is reported, never replaced by Standard.
func Meet ¶
Meet returns the strictest value per axis: eu over global, zero over standard, local over hosted. Scope, revision and timestamp come from the strictest contributor in that order of axes, else from the first profile. Meet of nothing is an error, never Standard.
func Standard ¶
func Standard() Profile
Standard is the profile of a subject without a stored record.
func (Profile) Canonical ¶
Canonical is the canonical JSON of p with a fixed key order; it is the signed form shared with the TypeScript twin.
func (Profile) Encode ¶
Encode returns the base64url (unpadded) canonical JSON carried in headers and job payloads.
func (Profile) EnforceEgress ¶
EnforceEgress binds http.DefaultTransport and net.DefaultResolver to the homelab when p is Full Local, and changes nothing for any other valid profile; an invalid profile is an error, never a no-op. Call it once at boot, before any client or telemetry is created. The shared transport is changed in place, so it stays an *http.Transport that can be cloned and clients that captured it earlier are guarded as well. Clients with a transport, dialer or resolver of their own need GuardTransport or GuardDial.
Source Files