policy

type AllowAll ¶

type AllowAll struct{}

AllowAll is the default no-op implementation that permits everything.

func (AllowAll) EvalCommand(_ context.Context, _ uuid.UUID, _ string, _ []string) Decision

func (AllowAll) EvalFileAccess(_ context.Context, _ uuid.UUID, _ string, _ bool) Decision

type Decision ¶

type Decision struct {
	Allowed bool
	Reason  string
}

Decision is the outcome of a policy evaluation.

type DenyAll ¶

type DenyAll struct{ Reason string }

DenyAll rejects every request with the given reason. Useful for tests.

func (d DenyAll) EvalCommand(_ context.Context, _ uuid.UUID, _ string, _ []string) Decision

func (d DenyAll) EvalFileAccess(_ context.Context, _ uuid.UUID, _ string, _ bool) Decision

type Hook ¶

type Hook interface {
	// EvalCommand determines whether a command may execute in the given session.
	EvalCommand(ctx context.Context, sessionID uuid.UUID, command string, args []string) Decision
	// EvalFileAccess determines whether a file path may be accessed.
	EvalFileAccess(ctx context.Context, sessionID uuid.UUID, path string, write bool) Decision
}

Hook is the extension point for policy enforcement.

type OPAHook ¶

type OPAHook struct {
	// contains filtered or unexported fields
}

OPAHook evaluates commands and file access against an embedded Rego policy. The module must live in package vaultrun and define:

allow_command (boolean) — whether the command may run
allow_file    (boolean) — whether the file path may be accessed
deny_reason   (string, optional) — human-readable denial message

func NewOPAHook(ctx context.Context, module string) (*OPAHook, error)

func NewOPAHookFromFile(ctx context.Context, path string) (*OPAHook, error)

func (h *OPAHook) EvalCommand(ctx context.Context, sessionID uuid.UUID, command string, args []string) Decision

func (h *OPAHook) EvalFileAccess(ctx context.Context, sessionID uuid.UUID, path string, write bool) Decision