Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrDestructionCanceled = errors.New("destruction canceled by user")
ErrDestructionCanceled is returned when the user does not confirm destruction.
var ErrForceLocalRequired = errors.New("force_local guard: command targets non-local environment")
ErrForceLocalRequired is returned by RequireLocal when a command is executing against a non-local target without an explicit local opt-in (--local flag or NSELF_LOCAL=true env var).
Functions ¶
func ConfirmDestruction ¶
ConfirmDestruction prompts the user to type projectName to confirm. It writes the prompt to w and reads a response line from r. Returns nil if the typed string matches projectName exactly. Returns ErrDestructionCanceled if the input does not match or if r is exhausted (EOF).
func ConfirmHostWidePrune ¶ added in v1.3.4
ConfirmHostWidePrune prompts the user to type "yes" before a command runs a host-wide `docker system prune`. Unlike ConfirmDestruction there is no project name to type against: the operation is not scoped to a project at all, it affects every Docker resource on the machine, so the prompt states that plainly instead. Returns nil only when the typed response is exactly "yes" (case-insensitive). Returns ErrDestructionCanceled on any other input, including EOF.
func RequireLocal ¶ added in v1.0.16
func RequireLocal(intent LocalIntent) error
RequireLocal enforces that destructive or production-affecting commands only run against a non-local target when the caller has explicitly opted in (via --local flag OR NSELF_LOCAL=true env var) AND the target itself is genuinely local.
The guard fires (returns ErrForceLocalRequired) when:
- intent.Target resolves to a non-local label, AND
- intent.LocalFlag is false, AND
- NSELF_LOCAL is not truthy in the environment.
Callers that legitimately operate on staging or prod must NOT route through this guard — it exists specifically to catch accidental cloud actions when the operator's intent was local. Production deploy paths use their own --force / --confirm gates higher up the call stack.
Types ¶
type LocalIntent ¶ added in v1.0.16
type LocalIntent struct {
// LocalFlag is true when the caller passed --local (or equivalent).
LocalFlag bool
// Target is the resolved deploy target string ("local", "staging",
// "prod", "production", or any non-local label). Empty means caller
// could not determine the target — treated as non-local for safety.
Target string
// CommandName is the user-facing command label (e.g. "deploy",
// "db migrate", "stack restart") used in error messages.
CommandName string
}
LocalIntent encodes how a caller declared its intent for a destructive command. Exactly one of WantLocal / WantRemote should be set.
Source Files