Documentation
¶
Overview ¶
content.go — text-analysis helpers for Keep rule expressions.
Package cel provides Keep's custom CEL environment for rule expressions.
Index ¶
- func ContainsAnyFunc(field string, terms []string) bool
- func DayOfWeek(timestamp time.Time) string
- func DayOfWeekTZ(tz string, timestamp time.Time) string
- func EstimateTokensFunc(field string) int
- func InTimeWindow(start, end, tz string, timestamp time.Time) bool
- func InjectOriginalParams(expr string) string
- func LowerFunc(s string) string
- func MatchesDomainFunc(email string, domains []string) bool
- func ResolveAliases(expr string, aliases map[string]string) string
- func UpperFunc(s string) string
- type Env
- type EnvOption
- type Program
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ContainsAnyFunc ¶
ContainsAnyFunc returns true if field contains any of the terms (case-insensitive).
func DayOfWeek ¶
DayOfWeek returns the lowercase name of the weekday (e.g., "monday") for timestamp interpreted in UTC.
func DayOfWeekTZ ¶
DayOfWeekTZ returns the lowercase name of the weekday for timestamp interpreted in the given IANA timezone. Returns empty string on invalid tz.
func EstimateTokensFunc ¶
EstimateTokensFunc returns a rough token count (chars/4).
func InTimeWindow ¶
InTimeWindow reports whether timestamp falls within the [start, end) time-of-day window in the given IANA timezone. start and end are "HH:MM" strings (24-hour). If end <= start, midnight-wrapping is NOT supported and false is always returned.
func InjectOriginalParams ¶ added in v0.2.0
InjectOriginalParams rewrites CEL expressions so that single-argument calls to any function in originalParamsFunctions get _originalParams injected as a second argument.
Only single-argument calls are rewritten; calls that already have multiple arguments are left as-is. String literals inside the call are handled correctly (parentheses inside strings do not confuse the rewriter).
func MatchesDomainFunc ¶
func ResolveAliases ¶
ResolveAliases rewrites a CEL expression string, replacing unqualified identifiers that match alias names with their params.* paths. Returns the expression unchanged if aliases is nil or empty.
An identifier is considered unqualified when it is NOT immediately preceded by a dot (field-access operator). String literals (single- or double-quoted) are left untouched.
Types ¶
type Env ¶
type Env struct {
// contains filtered or unexported fields
}
Env is Keep's configured CEL environment with custom functions.
type EnvOption ¶
type EnvOption func(*envConfig)
EnvOption configures the CEL environment.
func WithRateStore ¶
WithRateStore configures the CEL environment with a rate counter store, enabling the rateCount(key, window) function.
func WithSecretDetector ¶
WithSecretDetector configures the CEL environment with a secret detector, enabling the hasSecrets(field) function.
type Program ¶
type Program struct {
// contains filtered or unexported fields
}
Program is a compiled CEL expression ready for evaluation.
func (*Program) Eval ¶
func (p *Program) Eval(params map[string]any, ctx map[string]any, originalParams ...map[string]any) (bool, error)
Eval evaluates a compiled program against the given params and context. Returns the boolean result. Returns an error if evaluation fails or the expression does not return a bool. Missing field accesses return false rather than an error.
originalParams is optional: when provided, it is passed as _originalParams for functions like hasSecrets that need pre-normalization values.
Source Files