Documentation
¶
Overview ¶
content.go — text-analysis helpers for Keep rule expressions.
Package cel provides Keep's custom CEL environment for rule expressions.
Index ¶
- func ContainsAnyFunc(field string, terms []string) bool
- func DayOfWeek(timestamp time.Time) string
- func DayOfWeekTZ(tz string, timestamp time.Time) string
- func EstimateTokensFunc(field string) int
- func InTimeWindow(start, end, tz string, timestamp time.Time) bool
- func InjectOriginalParams(expr string) string
- func LowerFunc(s string) string
- func MatchesDomainFunc(email string, domains []string) bool
- func ParseGraphQLRequest(body any) map[string]any
- func PrepareWhen(expr string, aliases, defs map[string]string) string
- func ResolveAliases(expr string, aliases map[string]string) string
- func UpperFunc(s string) string
- type Env
- type EnvOption
- type Program
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ContainsAnyFunc ¶
ContainsAnyFunc returns true if field contains any of the terms (case-insensitive).
func DayOfWeek ¶
DayOfWeek returns the lowercase name of the weekday (e.g., "monday") for timestamp interpreted in UTC.
func DayOfWeekTZ ¶
DayOfWeekTZ returns the lowercase name of the weekday for timestamp interpreted in the given IANA timezone. Returns empty string on invalid tz.
func EstimateTokensFunc ¶
EstimateTokensFunc returns a rough token count (chars/4).
func InTimeWindow ¶
InTimeWindow reports whether timestamp falls within the [start, end) time-of-day window in the given IANA timezone. start and end are "HH:MM" strings (24-hour). If end <= start, midnight-wrapping is NOT supported and false is always returned.
func InjectOriginalParams ¶ added in v0.2.0
InjectOriginalParams rewrites CEL expressions so that single-argument calls to any function in originalParamsFunctions get _originalParams injected as a second argument.
Only single-argument calls are rewritten; calls that already have multiple arguments are left as-is. String literals inside the call are handled correctly (parentheses inside strings do not confuse the rewriter).
func MatchesDomainFunc ¶
func ParseGraphQLRequest ¶ added in v0.7.0
ParseGraphQLRequest parses a GraphQL-over-HTTP request body (the decoded JSON object {"query": ..., "variables": ..., "operationName": ...}) and returns a structured, JSON-shaped view of it for policy evaluation:
{
"valid": bool, // false on any input or parse problem
"error": string, // "" when valid
"operations": [{"type": "query"|"mutation"|"subscription", "name": string, "fields": [field]}],
"queries": [field], // root fields of every query operation
"mutations": [field], // root fields of every mutation operation
"subscriptions": [field], // root fields of every subscription operation
}
field = {"name": string, "alias": string, "args": map}
Every operation in the document is reported regardless of operationName, so a policy sees a mutation even when the client asks the server to run a different operation from the same document. Fragment spreads and inline fragments in an operation's root selection set are expanded; type conditions and directives (@skip/@include) are ignored, so a conditionally skipped field is still reported. Arguments have variables substituted from "variables", falling back to the variable's default value; a variable with neither is omitted from an object (or null inside a list).
It never returns an error: malformed input yields valid=false with empty operation and field lists, so `.exists()` over them is always safe.
func PrepareWhen ¶ added in v0.7.0
PrepareWhen turns a rule's `when` expression into the source that is compiled: profile aliases and defs are substituted, then original-case params are injected for the functions that need them. The engine and rule-file validation both use it, so an expression validates exactly when it compiles at load time.
func ResolveAliases ¶
ResolveAliases rewrites a CEL expression string, replacing unqualified identifiers that match alias names with their params.* paths. Returns the expression unchanged if aliases is nil or empty.
An identifier is considered unqualified when it is NOT immediately preceded by a dot (field-access operator). String literals (single- or double-quoted) are left untouched.
Types ¶
type Env ¶
type Env struct {
// contains filtered or unexported fields
}
Env is Keep's configured CEL environment with custom functions.
type EnvOption ¶
type EnvOption func(*envConfig)
EnvOption configures the CEL environment.
func WithRateStore ¶
WithRateStore configures the CEL environment with a rate counter store, enabling the rateCount(key, window) function.
func WithSecretDetector ¶
WithSecretDetector configures the CEL environment with a secret detector, enabling the hasSecrets(field) function.
type Program ¶
type Program struct {
// contains filtered or unexported fields
}
Program is a compiled CEL expression ready for evaluation.
func (*Program) Eval ¶
func (p *Program) Eval(params map[string]any, ctx map[string]any, originalParams ...map[string]any) (bool, error)
Eval evaluates a compiled program against the given params and context. Returns the boolean result. Returns an error if evaluation fails or the expression does not return a bool. Missing field accesses return false rather than an error.
originalParams is optional: when provided, it is passed as _originalParams for functions like hasSecrets that need pre-normalization values.
func (*Program) ReferencesParam ¶ added in v0.5.0
ReferencesParam reports whether the compiled expression may read the given field off the params input variable. It returns true for idiomatic dot- or index-access (params.body, params["body"], including nested forms like params.body.foo), and — failing safe — for every field when the expression touches the params map opaquely (see collectParamRefs). The result is computed at compile time, so this is a cheap lookup.
Source Files