Documentation
¶
Overview ¶
Package rules provides a CEL-based security rules engine for MongoRPC.
Package rules provides middleware for rules enforcement.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RulesInterceptor ¶
func RulesInterceptor(engine *Engine) grpc.UnaryServerInterceptor
RulesInterceptor creates a gRPC interceptor that enforces security rules.
func StreamRulesInterceptor ¶
func StreamRulesInterceptor(engine *Engine) grpc.StreamServerInterceptor
StreamRulesInterceptor creates a streaming interceptor for rules enforcement.
Types ¶
type Config ¶
type Config struct {
Rules []RuleConfig `json:"rules" yaml:"rules"`
}
Config represents rules configuration.
type Engine ¶
type Engine struct {
// contains filtered or unexported fields
}
Engine is the rules evaluation engine.
func LoadFromFile ¶
LoadFromFile loads rules from a YAML file.
func (*Engine) LoadConfig ¶
LoadConfig loads rules from a configuration.
func (*Engine) SetDefaultAllow ¶
SetDefaultAllow sets the default allow/deny for an operation.
type Request ¶
type Request struct {
// Auth information
UserID string
UserEmail string
IsAdmin bool
Claims map[string]interface{}
// Resource information
Database string
Collection string
DocumentID string
// Operation
Operation Operation
// Document data (for write operations)
IncomingData map[string]interface{}
ExistingData map[string]interface{}
}
Request represents a request context for rule evaluation.
type Rule ¶
type Rule struct {
// Path pattern (e.g., "databases/{database}/collections/{collection}")
Path string
// CEL expression for the rule
Allow string
}
Rule represents a security rule.
type RuleConfig ¶
type RuleConfig struct {
Path string `json:"path" yaml:"path"`
Operation string `json:"operation" yaml:"operation"`
Allow string `json:"allow" yaml:"allow"`
}
RuleConfig represents a single rule configuration.
Source Files
Click to show internal directories.
Click to hide internal directories.