keep

package

v0.7.0 Latest Latest Go to latest Published: Aug 1, 2026 License: MIT Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/majorcontext/moat

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func GetStarterPack(name string) ([]byte, error)
func ListStarterPacks() []string
func ResolvePolicyYAML(pc *PolicyConfig, scope, baseDir string) ([]byte, error)
type PolicyConfig

Constants ¶

This section is empty.

Variables ¶

View Source

var ValidModes = map[string]bool{
	"":        true,
	"enforce": true,
	"audit":   true,
}

ValidModes lists the accepted values for PolicyConfig.Mode.

Functions ¶

func GetStarterPack ¶

func GetStarterPack(name string) ([]byte, error)

GetStarterPack returns the YAML bytes for a named starter pack.

func ListStarterPacks ¶

func ListStarterPacks() []string

ListStarterPacks returns the names of all available starter packs.

func ResolvePolicyYAML ¶

func ResolvePolicyYAML(pc *PolicyConfig, scope, baseDir string) ([]byte, error)

ResolvePolicyYAML resolves a PolicyConfig into raw YAML bytes suitable for keep.LoadFromBytes(). baseDir is used to resolve relative file paths; if empty, paths are used as-is.

Types ¶

type PolicyConfig ¶

type PolicyConfig struct {
	Pack string   `yaml:"-"`
	File string   `yaml:"-"`
	Deny []string `yaml:"deny,omitempty"`
	Mode string   `yaml:"mode,omitempty"`
}

PolicyConfig represents a Keep policy parsed from moat.yaml. It accepts three shapes:

Starter pack name: plain string without "/" or ".yaml" suffix
File path: string containing "/" or ending in ".yaml"
Inline rules: YAML mapping with deny/mode fields

func (*PolicyConfig) IsFile ¶

func (p *PolicyConfig) IsFile() bool

func (*PolicyConfig) IsInline ¶

func (p *PolicyConfig) IsInline() bool

func (*PolicyConfig) IsPack ¶

func (p *PolicyConfig) IsPack() bool

func (*PolicyConfig) ToKeepYAML ¶

func (p *PolicyConfig) ToKeepYAML(scope string) ([]byte, error)

ToKeepYAML converts inline rules to Keep's native YAML rule format. Listed deny operations get deny rules; everything else is implicitly allowed (Keep's default behavior for unmatched calls).

func (*PolicyConfig) UnmarshalYAML ¶

func (p *PolicyConfig) UnmarshalYAML(node *yaml.Node) error

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL