Documentation
¶
Index ¶
- func ParseSensitive(dbDir string) (sensitive, nosensitive map[string]map[string]bool, err error)
- type ArchivedInfo
- type CrossError
- func CheckAuthz(funcs []ssacparser.ServiceFunc, authzPackage string) []CrossError
- func CheckClaims(serviceFuncs []ssacparser.ServiceFunc, ...) []CrossError
- func CheckClaimsRego(policies []*policy.Policy, claims map[string]projectconfig.ClaimDef) []CrossError
- func CheckDDLCoverage(st *ssacvalidator.SymbolTable, funcs []ssacparser.ServiceFunc, ...) []CrossError
- func CheckFuncCoverage(funcs []ssacparser.ServiceFunc, projectFuncSpecs []funcspec.FuncSpec) []CrossError
- func CheckFuncs(serviceFuncs []ssacparser.ServiceFunc, ...) []CrossError
- func CheckHurlFiles(hurlFiles []string, doc *openapi3.T) []CrossError
- func CheckInputKeyCase(funcs []ssacparser.ServiceFunc, st *ssacvalidator.SymbolTable) []CrossError
- func CheckJWTBuiltinInputs(serviceFuncs []ssacparser.ServiceFunc, ...) []CrossError
- func CheckMiddleware(middleware []string, doc *openapi3.T) []CrossError
- func CheckOpenAPIConstraints(input *CrossValidateInput) []CrossError
- func CheckOpenAPIDDL(doc *openapi3.T, st *ssacvalidator.SymbolTable, funcs []ssacparser.ServiceFunc, ...) []CrossError
- func CheckPolicy(policies []*policy.Policy, funcs []ssacparser.ServiceFunc, ...) []CrossError
- func CheckQueue(funcs []ssacparser.ServiceFunc, queueBackend string) []CrossError
- func CheckRegoRoleDDL(policies []*policy.Policy, st *ssacvalidator.SymbolTable) []CrossError
- func CheckRoles(policies []*policy.Policy, roles []string) []CrossError
- func CheckSSaCDDL(funcs []ssacparser.ServiceFunc, st *ssacvalidator.SymbolTable, ...) []CrossError
- func CheckSSaCOpenAPI(funcs []ssacparser.ServiceFunc, st *ssacvalidator.SymbolTable, doc *openapi3.T, ...) []CrossError
- func CheckSensitiveColumns(st *ssacvalidator.SymbolTable, ...) []CrossError
- func CheckStates(diagrams []*statemachine.StateDiagram, funcs []ssacparser.ServiceFunc, ...) []CrossError
- func Run(input *CrossValidateInput) []CrossError
- func RunRules(input *CrossValidateInput, skipRules map[string]bool) []CrossError
- type CrossValidateInput
- type Rule
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type ArchivedInfo ¶
type ArchivedInfo struct {
Tables map[string]bool // "legacy_notifications" → true
Columns map[string]map[string]bool // "courses" → {"old_category": true}
}
ArchivedInfo holds @archived tags parsed from DDL files.
func ParseArchived ¶
func ParseArchived(dbDir string) (*ArchivedInfo, error)
ParseArchived parses DDL .sql files in dbDir for @archived tags.
type CrossError ¶
type CrossError struct {
Rule string // e.g. "x-sort ↔ DDL", "SSaC @result ↔ DDL"
Context string // e.g. operationId or funcName
Message string
Level string // "ERROR" or "WARNING" (empty = ERROR)
Suggestion string // fix suggestion (empty if none)
}
CrossError represents a cross-validation error between two SSOT layers.
func CheckAuthz ¶
func CheckAuthz(funcs []ssacparser.ServiceFunc, authzPackage string) []CrossError
CheckAuthz validates @auth inputs against the authz CheckRequest fields.
func CheckClaims ¶
func CheckClaims(serviceFuncs []ssacparser.ServiceFunc, claims map[string]projectconfig.ClaimDef) []CrossError
CheckClaims validates that all currentUser field references in SSaC specs are defined in fullend.yaml backend.auth.claims.
func CheckClaimsRego ¶
func CheckClaimsRego(policies []*policy.Policy, claims map[string]projectconfig.ClaimDef) []CrossError
CheckClaimsRego validates that Rego input.claims.xxx references match fullend.yaml claims values.
func CheckDDLCoverage ¶
func CheckDDLCoverage( st *ssacvalidator.SymbolTable, funcs []ssacparser.ServiceFunc, archived *ArchivedInfo, ) []CrossError
CheckDDLCoverage validates that DDL tables and columns are referenced by SSaC/OpenAPI.
func CheckFuncCoverage ¶
func CheckFuncCoverage( funcs []ssacparser.ServiceFunc, projectFuncSpecs []funcspec.FuncSpec, ) []CrossError
CheckFuncCoverage warns about project func specs not referenced by any SSaC @call.
func CheckFuncs ¶
func CheckFuncs( serviceFuncs []ssacparser.ServiceFunc, fullendPkgSpecs, projectFuncSpecs []funcspec.FuncSpec, symbolTable *ssacvalidator.SymbolTable, openAPIDoc *openapi3.T, ) []CrossError
CheckFuncs validates SSaC @func references against parsed func specs.
func CheckHurlFiles ¶
func CheckHurlFiles(hurlFiles []string, doc *openapi3.T) []CrossError
CheckHurlFiles validates that .hurl scenario files reference valid OpenAPI paths.
func CheckInputKeyCase ¶
func CheckInputKeyCase(funcs []ssacparser.ServiceFunc, st *ssacvalidator.SymbolTable) []CrossError
CheckInputKeyCase validates that SSaC input keys exactly match sqlc method parameter names (case-sensitive).
func CheckJWTBuiltinInputs ¶
func CheckJWTBuiltinInputs(serviceFuncs []ssacparser.ServiceFunc, claims map[string]projectconfig.ClaimDef) []CrossError
CheckJWTBuiltinInputs validates that @call inputs for jwt builtin functions use keys that match claims field names.
func CheckMiddleware ¶
func CheckMiddleware(middleware []string, doc *openapi3.T) []CrossError
CheckMiddleware validates that fullend.yaml middleware matches OpenAPI securitySchemes.
func CheckOpenAPIConstraints ¶
func CheckOpenAPIConstraints(input *CrossValidateInput) []CrossError
func CheckOpenAPIDDL ¶
func CheckOpenAPIDDL(doc *openapi3.T, st *ssacvalidator.SymbolTable, funcs []ssacparser.ServiceFunc, sensitiveCols map[string]map[string]bool) []CrossError
CheckOpenAPIDDL validates x-sort, x-filter, x-include against DDL tables.
func CheckPolicy ¶
func CheckPolicy(policies []*policy.Policy, funcs []ssacparser.ServiceFunc, st *ssacvalidator.SymbolTable, diagrams []*statemachine.StateDiagram) []CrossError
CheckPolicy validates policy against SSaC, DDL, and States.
func CheckQueue ¶
func CheckQueue(funcs []ssacparser.ServiceFunc, queueBackend string) []CrossError
CheckQueue validates publish ↔ subscribe cross-references.
func CheckRegoRoleDDL ¶
func CheckRegoRoleDDL(policies []*policy.Policy, st *ssacvalidator.SymbolTable) []CrossError
CheckRegoRoleDDL validates that Rego input.claims.role values exist in DDL CHECK constraints.
func CheckRoles ¶
func CheckRoles(policies []*policy.Policy, roles []string) []CrossError
CheckRoles validates that OPA Rego input.role values match fullend.yaml auth.roles.
func CheckSSaCDDL ¶
func CheckSSaCDDL(funcs []ssacparser.ServiceFunc, st *ssacvalidator.SymbolTable, dtoTypes map[string]bool) []CrossError
CheckSSaCDDL validates SSaC @result types and @param types against DDL.
func CheckSSaCOpenAPI ¶
func CheckSSaCOpenAPI(funcs []ssacparser.ServiceFunc, st *ssacvalidator.SymbolTable, doc *openapi3.T, funcSpecs []funcspec.FuncSpec) []CrossError
CheckSSaCOpenAPI validates SSaC function names match OpenAPI operationIds and vice versa, and SSaC @response fields match OpenAPI response schema properties.
func CheckSensitiveColumns ¶
func CheckSensitiveColumns(st *ssacvalidator.SymbolTable, sensitiveCols, noSensitiveCols map[string]map[string]bool) []CrossError
CheckSensitiveColumns warns when DDL column names match sensitive patterns but lack an @sensitive annotation.
func CheckStates ¶
func CheckStates(diagrams []*statemachine.StateDiagram, funcs []ssacparser.ServiceFunc, st *ssacvalidator.SymbolTable, doc *openapi3.T) []CrossError
CheckStates validates state diagrams against SSaC, DDL, and OpenAPI.
func Run ¶
func Run(input *CrossValidateInput) []CrossError
Run executes all cross-validation rules and returns collected errors.
func RunRules ¶
func RunRules(input *CrossValidateInput, skipRules map[string]bool) []CrossError
RunRules executes rules, skipping names in skipRules.
type CrossValidateInput ¶
type CrossValidateInput struct {
*genapi.ParsedSSOTs
DTOTypes map[string]bool // model types marked with @dto (skip DDL matching)
Middleware []string // from fullend.yaml backend.middleware
Archived *ArchivedInfo // @archived tables/columns from DDL
Claims map[string]projectconfig.ClaimDef // from fullend.yaml backend.auth.claims
QueueBackend string // from fullend.yaml queue.backend ("postgres", "memory", "")
AuthzPackage string // from fullend.yaml authz.package ("" = default pkg/authz)
SensitiveCols map[string]map[string]bool // @sensitive columns per table (table → column → true)
NoSensitiveCols map[string]map[string]bool // @nosensitive columns per table (suppress WARNING)
Roles []string // from fullend.yaml auth.roles
}
CrossValidateInput holds the pre-loaded data from individual validations.
type Rule ¶
type Rule struct {
Name string // e.g. "OpenAPI ↔ DDL", "SSaC → OpenAPI"
Source string // "OpenAPI", "SSaC", "Policy", "States", "Config", "DDL"
Target string // "DDL", "OpenAPI", ... ("" = standalone)
Requires func(*CrossValidateInput) bool
Check func(*CrossValidateInput) []CrossError
}
Rule represents a single cross-validation rule with metadata.
Source Files
¶
- add_path_item_operations.go
- add_path_response_props.go
- add_response_schema_props.go
- api_route.go
- archived_info.go
- build_call_references.go
- build_claim_values.go
- build_func_primary_table.go
- build_func_spec_map.go
- build_hurl_routes.go
- build_operation_map.go
- build_operation_response_props.go
- build_path_routes.go
- build_referenced_tables.go
- build_ssac_auth_pairs.go
- check_authz.go
- check_authz_func.go
- check_authz_seq_inputs.go
- check_c1_required_missing.go
- check_claims.go
- check_claims_rego.go
- check_cursor_sort.go
- check_ddl_coverage.go
- check_diagram_events.go
- check_diagram_missing_guards.go
- check_endpoint_security.go
- check_err_status.go
- check_explicit_response_fields.go
- check_field_constraints.go
- check_forbidden_imports.go
- check_func_coverage.go
- check_func_err_status.go
- check_func_guard_states.go
- check_func_state_inputs.go
- check_funcs.go
- check_ghost_properties.go
- check_guard_states.go
- check_hurl_files.go
- check_input_key_case.go
- check_join_table_ddl.go
- check_jwt_builtin_inputs.go
- check_jwt_inputs_for_func.go
- check_middleware.go
- check_missing_guards.go
- check_missing_properties.go
- check_op_security.go
- check_openapi_constraints.go
- check_openapi_ddl.go
- check_ownership_annotations.go
- check_ownership_ddl.go
- check_param_column.go
- check_param_types.go
- check_path_operations.go
- check_policy.go
- check_publish_has_subscribe.go
- check_queue.go
- check_queue_field_mismatch.go
- check_rego_pairs_coverage.go
- check_rego_role_ddl.go
- check_response_fields.go
- check_response_success_code.go
- check_result_type.go
- check_roles.go
- check_schema_ghost_props.go
- check_schema_missing_props.go
- check_security_req_names.go
- check_sensitive_columns.go
- check_seq_input_key_case.go
- check_seq_jwt_inputs.go
- check_service_func_calls.go
- check_shorthand_response.go
- check_single_call.go
- check_single_field_constraint.go
- check_single_ownership_ddl.go
- check_ssac_ddl.go
- check_ssac_ddl_func.go
- check_ssac_openapi.go
- check_ssac_pairs_coverage.go
- check_state_input_fields.go
- check_states.go
- check_subscribe_fields.go
- check_subscribe_has_publish.go
- check_table_sensitive_columns.go
- check_transition_events.go
- check_x_filter.go
- check_x_include.go
- check_x_sort.go
- claim_field_list.go
- collect_auth_pairs_from_func.go
- collect_call_refs_from_func.go
- collect_current_user_fields.go
- collect_current_user_from_inputs.go
- collect_ddl_role_values.go
- collect_func_queue_topics.go
- collect_guard_state_funcs.go
- collect_input_keys.go
- collect_op_x_include_fields.go
- collect_operation_response_props.go
- collect_path_x_include_fields.go
- collect_policy_claims_refs.go
- collect_policy_roles.go
- collect_queue_topics.go
- collect_referenced_table.go
- collect_rego_claims_refs.go
- collect_rego_roles.go
- collect_request_fields.go
- collect_response_codes.go
- collect_role_values_from_table.go
- collect_scheme_names.go
- collect_x_include_local_fields.go
- column_exists_in_any_table.go
- column_exists_in_table.go
- column_has_usable_index.go
- cross_error.go
- cross_validate_input.go
- diagram_id_to_table.go
- enums_match.go
- extract_field_names.go
- extract_func_spec_field_keys.go
- extract_response_field_keys.go
- extract_status_field.go
- extract_table_name.go
- find_case_insensitive_param.go
- find_ddl_column_constraints.go
- find_field_type.go
- find_first_model_table.go
- find_matching_route.go
- find_operation_field_type.go
- find_schema_property.go
- find_struct_fields.go
- find_table_with_column.go
- func_has_auth.go
- generate_skeleton.go
- has_auth_sequence.go
- has_explicit_2xx.go
- has_fk_column.go
- has_fk_to.go
- has_response_sequence.go
- has_state_sequence.go
- hurl_entry.go
- infer_literal_type.go
- infer_table_from_ctx.go
- is_constraint_line.go
- is_email_field.go
- is_forbidden_import.go
- is_no_sensitive_annotated.go
- is_password_field.go
- is_sensitive_annotated.go
- is_skipped_column.go
- is_unique_column.go
- join_keys.go
- jwt_builtin_funcs.go
- mark_archived_column.go
- match_input_keys_to_params.go
- match_sensitive_pattern.go
- match_table_type.go
- matches_sensitive_pattern.go
- merge_policies.go
- model_to_table.go
- new_missing_func_error.go
- normalize_hurl_path.go
- normalize_openapi_path.go
- normalize_type_name.go
- openapi_type_to_go.go
- parse_archived.go
- parse_archived_line.go
- parse_archived_sql.go
- parse_call_key.go
- parse_hurl_file.go
- parse_sensitive.go
- parse_sensitive_line.go
- parse_sensitive_sql.go
- pascal_to_snake.go
- pascal_to_snake_state.go
- path_item_operations.go
- process_hurl_line.go
- resolve_call_response_fields.go
- resolve_ddl_column_type.go
- resolve_ddl_response_fields.go
- resolve_field_from_request_body.go
- resolve_func_response_field_type.go
- resolve_input_value_type.go
- resolve_openapi_field_type.go
- resolve_response_fields_by_type.go
- resolve_schema_ref.go
- resolve_shorthand_response_fields.go
- resolve_table_name.go
- rule.go
- rules.go
- rules_list.go
- run.go
- run_rules.go
- segments_match.go
- snake_to_pascal.go
- sorted_column_names.go
- sorted_strings.go
- strip_crud_prefix.go
- table_has_leading_index.go
- table_to_model.go
- to_snake_case.go
- types_compatible.go
- uc_first.go
- unmarshal_ext.go
- validate_call_body.go
- validate_call_imports.go
- validate_call_input_count.go
- validate_call_input_types.go
- validate_call_result.go
- validate_call_source_vars.go
- validate_call_spec.go
- validate_hurl_entry.go
- validate_x_include_spec.go
Click to show internal directories.
Click to hide internal directories.