accesssettings

package
v0.0.0-...-63ae334 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 2, 2026 License: MIT Imports: 7 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Allows 

func Allows(settings Settings, req Request) error

func IsPattern 

func IsPattern(path string) bool

IsPattern reports whether a grant path is a glob such as /dev/video*.

func IsZero 

func IsZero(settings Settings) bool

func MapPath 

func MapPath(settings Settings, req Request) (string, error)

MapPath translates an absolute path from the sandbox namespace to the path used by the Koder process. Explicit project, home, and mount mappings take precedence over the sandbox's /tmp mapping, matching bubblewrap mount order.

func PermissionModeStrings 

func PermissionModeStrings() []string

PermissionModeStrings returns a slice of all String values of the enum

func Validate 

func Validate(settings Settings) error

func ValidateMounts 

func ValidateMounts(mounts []Mount) error

ValidateMounts verifies a standalone list of host folder grants.

Types

type AccessKind 

type AccessKind string
const (
	AccessRead    AccessKind = "read"
	AccessWrite   AccessKind = "write"
	AccessNetwork AccessKind = "network"
)

type Grant 

type Grant struct {
	Path string
	Mode Mode
	// contains filtered or unexported fields
}

Grant is a path exposed to sessions with its own access mode.

func Grants 

func Grants(settings Settings, projectRoot string) []Grant

Grants lists the home, project, and mount grants in override order: each grant overrides the ones before it for paths it contains. Folders shared with every session come first, so the session's own grants (home, project, and session folders) override them: a read-only shared /storage leaves a session's /storage/project writable, and a session's read-write /storage overrides a shared read-only /storage/models. Within each layer, deeper paths override shallower ones, and for the same path a mount overrides the project, which overrides home. The sandbox binds grants in this order, and modeForPath resolves a path to the last grant containing it.

func (Grant) Covers 

func (grant Grant) Covers(abs string) bool

Covers reports whether abs is the grant's path or inside it. For a glob, abs or one of its parents must match the pattern.

func (Grant) Paths 

func (grant Grant) Paths() []string

Paths lists the host paths the grant exposes right now. A glob is matched against the filesystem each time, so a device plugged in later is picked up by the next command; a glob that matches nothing exposes nothing.

type Mode 

type Mode string
const (
	ModeNone      Mode = "none"
	ModeReadOnly  Mode = "readonly"
	ModeReadWrite Mode = "readwrite"
	// ModeDevice grants read-write access to paths containing device nodes.
	ModeDevice Mode = "device"
)

type Mount 

type Mount struct {
	Path string `toml:"path" json:"path"`
	Mode Mode   `toml:"mode" json:"mode"`
	// Inherited marks a folder shared with every session rather than granted
	// by this session. Session grants override inherited ones.
	Inherited bool `toml:"-" json:"-"`
}

func NormalizeMounts 

func NormalizeMounts(mounts []Mount) []Mount

NormalizeMounts canonicalizes explicit host folder grants. A leading ~/ is expanded for configuration and UI convenience, and a path may be a glob (see Grant.Paths); other shell expansions are deliberately unsupported.

type PermissionMode 

type PermissionMode uint8
const (
	PermissionModeAllow PermissionMode = iota
	PermissionModeAsk
	PermissionModeDeny
)

func PermissionModeString 

func PermissionModeString(s string) (PermissionMode, error)

PermissionModeString retrieves an enum value from the enum constants string name. Throws an error if the param is not part of the enum.

func PermissionModeValues 

func PermissionModeValues() []PermissionMode

PermissionModeValues returns all values of the enum

func (PermissionMode) IsAPermissionMode 

func (i PermissionMode) IsAPermissionMode() bool

IsAPermissionMode returns "true" if the value is listed in the enum definition. "false" otherwise

func (PermissionMode) MarshalJSON 

func (i PermissionMode) MarshalJSON() ([]byte, error)

MarshalJSON implements the json.Marshaler interface for PermissionMode

func (PermissionMode) MarshalText 

func (i PermissionMode) MarshalText() ([]byte, error)

MarshalText implements the encoding.TextMarshaler interface for PermissionMode

func (PermissionMode) String 

func (i PermissionMode) String() string

func (*PermissionMode) UnmarshalJSON 

func (i *PermissionMode) UnmarshalJSON(data []byte) error

UnmarshalJSON implements the json.Unmarshaler interface for PermissionMode

func (*PermissionMode) UnmarshalText 

func (i *PermissionMode) UnmarshalText(text []byte) error

UnmarshalText implements the encoding.TextUnmarshaler interface for PermissionMode

func (PermissionMode) Values 

func (PermissionMode) Values() []string

type PermissionOverride 

type PermissionOverride struct {
	Tool    string
	Pattern string
	Action  PermissionMode
}

type Preset 

type Preset struct {
	ID          string   `json:"id"`
	Label       string   `json:"label"`
	Description string   `json:"description"`
	Settings    Settings `json:"settings"`
}

func Presets 

func Presets() []Preset

type Request 

type Request struct {
	Kind        AccessKind
	Path        string
	ProjectRoot string
}

type Settings 

type Settings struct {
	Network bool    `toml:"network" json:"network"`
	Project Mode    `toml:"project" json:"project"`
	Home    Mode    `toml:"home" json:"home"`
	Root    Mode    `toml:"root" json:"root"`
	Tmp     TmpMode `toml:"tmp" json:"tmp"`
	Mounts  []Mount `toml:"mounts" json:"mounts"`
	TmpDir  string  `toml:"-" json:"-"`
}

func AllowAll 

func AllowAll() Settings

func Default 

func Default() Settings

func LockedDown 

func LockedDown() Settings

func Normalize 

func Normalize(settings Settings) Settings

func WithInheritedMounts 

func WithInheritedMounts(settings Settings, inherited []Mount) Settings

WithInheritedMounts returns the effective settings for a session. Global grants are applied first, then session-specific grants. More specific paths are mounted later so they can safely narrow or widen a parent folder.

type TmpMode 

type TmpMode string
const (
	TmpEphemeral TmpMode = "ephemeral"
	TmpSession   TmpMode = "session"
	TmpHost      TmpMode = "host"
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.