Help us shape the future of Go! Take the 2026 Go Developer Survey

policy

package
v0.7.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 24, 2026 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type CLIHandler 

type CLIHandler struct {
	// contains filtered or unexported fields
}

CLIHandler provides command-line interface for policy management

func NewCLIHandler 

func NewCLIHandler(service *Service) *CLIHandler

NewCLIHandler creates a new CLI handler for policies

func (*CLIHandler) HandlePolicyCommand 

func (h *CLIHandler) HandlePolicyCommand(args []string) error

HandlePolicyCommand processes policy-related CLI commands

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

Manager handles policy evaluation and enforcement

func NewManager 

func NewManager() *Manager

NewManager creates a new policy manager

func (*Manager) AddPolicy 

func (m *Manager) AddPolicy(policy *Policy) error

AddPolicy adds a policy to the manager

func (*Manager) AddPolicySet 

func (m *Manager) AddPolicySet(policySet *PolicySet) error

AddPolicySet adds a policy set to the manager

func (*Manager) AssignPolicySet 

func (m *Manager) AssignPolicySet(userID, policySetID string) error

AssignPolicySet assigns a policy set to a user

func (*Manager) CheckResearchUserAction 

func (m *Manager) CheckResearchUserAction(userID, action, username string, profileID string) *PolicyResponse

CheckResearchUserAction is a convenience method for checking research user actions

func (*Manager) CheckTemplateAccess 

func (m *Manager) CheckTemplateAccess(userID, templateName string, profileID string) *PolicyResponse

CheckTemplateAccess is a convenience method for checking template access

func (*Manager) CreateDefaultPolicySets 

func (m *Manager) CreateDefaultPolicySets() error

CreateDefaultPolicySets creates example policy sets for different user types

func (*Manager) EvaluatePolicy 

func (m *Manager) EvaluatePolicy(request *PolicyRequest) *PolicyResponse

EvaluatePolicy evaluates a policy request and returns the decision

func (*Manager) GetProfileUserID 

func (m *Manager) GetProfileUserID() string

GetProfileUserID returns a user identifier for policy evaluation This integrates with the existing profile system

type Policy 

type Policy struct {
	ID          string                 `json:"id" yaml:"id"`
	Name        string                 `json:"name" yaml:"name"`
	Description string                 `json:"description,omitempty" yaml:"description,omitempty"`
	Type        PolicyType             `json:"type" yaml:"type"`
	Effect      PolicyEffect           `json:"effect" yaml:"effect"`
	Conditions  map[string]interface{} `json:"conditions,omitempty" yaml:"conditions,omitempty"`
	Resources   []string               `json:"resources,omitempty" yaml:"resources,omitempty"`
	Actions     []string               `json:"actions,omitempty" yaml:"actions,omitempty"`
	CreatedAt   time.Time              `json:"created_at" yaml:"created_at"`
	UpdatedAt   time.Time              `json:"updated_at" yaml:"updated_at"`
	Enabled     bool                   `json:"enabled" yaml:"enabled"`
}

Policy represents a single policy rule

type PolicyEffect 

type PolicyEffect string

PolicyEffect determines whether a policy allows or denies access 

const (
	PolicyEffectAllow PolicyEffect = "allow"
	PolicyEffectDeny  PolicyEffect = "deny"
)

type PolicyRequest 

type PolicyRequest struct {
	UserID    string                 `json:"user_id"`
	Action    string                 `json:"action"`
	Resource  string                 `json:"resource"`
	Context   map[string]interface{} `json:"context,omitempty"`
	ProfileID string                 `json:"profile_id,omitempty"`
}

PolicyRequest represents a request to check policy permissions

type PolicyResponse 

type PolicyResponse struct {
	Allowed         bool     `json:"allowed"`
	Reason          string   `json:"reason,omitempty"`
	MatchedPolicies []string `json:"matched_policies,omitempty"`
	Suggestions     []string `json:"suggestions,omitempty"`
}

PolicyResponse represents the result of a policy evaluation

type PolicySet 

type PolicySet struct {
	ID          string            `json:"id" yaml:"id"`
	Name        string            `json:"name" yaml:"name"`
	Description string            `json:"description,omitempty" yaml:"description,omitempty"`
	Policies    []*Policy         `json:"policies" yaml:"policies"`
	Tags        map[string]string `json:"tags,omitempty" yaml:"tags,omitempty"`
	CreatedAt   time.Time         `json:"created_at" yaml:"created_at"`
	UpdatedAt   time.Time         `json:"updated_at" yaml:"updated_at"`
	Enabled     bool              `json:"enabled" yaml:"enabled"`
}

PolicySet represents a collection of policies for a user or group

type PolicyType 

type PolicyType string

PolicyType represents different types of policies 

const (
	// PolicyTypeTemplateAccess controls which templates users can access
	PolicyTypeTemplateAccess PolicyType = "template_access"

	// PolicyTypeResourceLimits controls resource allocation limits
	PolicyTypeResourceLimits PolicyType = "resource_limits"

	// PolicyTypeResearchUser controls research user operations
	PolicyTypeResearchUser PolicyType = "research_user"

	// PolicyTypeInstance controls instance management
	PolicyTypeInstance PolicyType = "instance"
)

type ResearchUserPolicy 

type ResearchUserPolicy struct {
	AllowCreation     bool     `json:"allow_creation" yaml:"allow_creation"`
	AllowDeletion     bool     `json:"allow_deletion" yaml:"allow_deletion"`
	RequireApproval   bool     `json:"require_approval,omitempty" yaml:"require_approval,omitempty"`
	MaxUsers          int      `json:"max_users,omitempty" yaml:"max_users,omitempty"`
	AllowedShells     []string `json:"allowed_shells,omitempty" yaml:"allowed_shells,omitempty"`
	RequiredGroups    []string `json:"required_groups,omitempty" yaml:"required_groups,omitempty"`
	AllowSSHKeys      bool     `json:"allow_ssh_keys" yaml:"allow_ssh_keys"`
	AllowSudoAccess   bool     `json:"allow_sudo_access,omitempty" yaml:"allow_sudo_access,omitempty"`
	AllowDockerAccess bool     `json:"allow_docker_access,omitempty" yaml:"allow_docker_access,omitempty"`
}

ResearchUserPolicy controls research user operations

type ResourceLimitsPolicy 

type ResourceLimitsPolicy struct {
	MaxInstances     int               `json:"max_instances,omitempty" yaml:"max_instances,omitempty"`
	MaxInstanceTypes []string          `json:"max_instance_types,omitempty" yaml:"max_instance_types,omitempty"`
	MaxCostPerHour   float64           `json:"max_cost_per_hour,omitempty" yaml:"max_cost_per_hour,omitempty"`
	MaxVolumes       int               `json:"max_volumes,omitempty" yaml:"max_volumes,omitempty"`
	AllowedRegions   []string          `json:"allowed_regions,omitempty" yaml:"allowed_regions,omitempty"`
	RequireSpot      bool              `json:"require_spot,omitempty" yaml:"require_spot,omitempty"`
	Tags             map[string]string `json:"required_tags,omitempty" yaml:"required_tags,omitempty"`
}

ResourceLimitsPolicy controls resource allocation

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service provides policy enforcement for Prism

func NewService 

func NewService() *Service

NewService creates a new policy service

func (*Service) AssignResearcherPolicies 

func (s *Service) AssignResearcherPolicies() error

AssignResearcherPolicies assigns researcher-level policies to current user

func (*Service) AssignStudentPolicies 

func (s *Service) AssignStudentPolicies() error

AssignStudentPolicies assigns student-level policies to current user

func (*Service) CheckResearchUserCreation 

func (s *Service) CheckResearchUserCreation(username string) *PolicyResponse

CheckResearchUserCreation enforces research user creation policies

func (*Service) CheckResearchUserDeletion 

func (s *Service) CheckResearchUserDeletion(username string) *PolicyResponse

CheckResearchUserDeletion enforces research user deletion policies

func (*Service) CheckTemplateAccess 

func (s *Service) CheckTemplateAccess(templateName string) *PolicyResponse

CheckTemplateAccess enforces template access policies

func (*Service) CreateCustomPolicy 

func (s *Service) CreateCustomPolicy(policy *Policy) error

CreateCustomPolicy allows users to create custom policies

func (*Service) GetCurrentUserPolicies 

func (s *Service) GetCurrentUserPolicies() []string

GetCurrentUserPolicies returns the current user's assigned policies

func (*Service) GetManager 

func (s *Service) GetManager() *Manager

GetManager returns the underlying policy manager for advanced operations

func (*Service) GetPolicyViolationMessage 

func (s *Service) GetPolicyViolationMessage(response *PolicyResponse, action string) string

GetPolicyViolationMessage returns user-friendly policy violation messages

func (*Service) IsEnabled 

func (s *Service) IsEnabled() bool

IsEnabled returns whether policy enforcement is active

func (*Service) ListAvailablePolicySets 

func (s *Service) ListAvailablePolicySets() map[string]*PolicySet

ListAvailablePolicySets returns available policy sets for assignment

func (*Service) SetEnabled 

func (s *Service) SetEnabled(enabled bool)

SetEnabled controls whether policy enforcement is active

func (*Service) ValidateTemplateAccess 

func (s *Service) ValidateTemplateAccess(templates []string) ([]string, []string)

ValidateTemplateAccess provides template filtering based on policies

type TemplateAccessPolicy 

type TemplateAccessPolicy struct {
	AllowedTemplates []string `json:"allowed_templates,omitempty" yaml:"allowed_templates,omitempty"`
	DeniedTemplates  []string `json:"denied_templates,omitempty" yaml:"denied_templates,omitempty"`
	RequiredDomain   string   `json:"required_domain,omitempty" yaml:"required_domain,omitempty"`
	MaxComplexity    string   `json:"max_complexity,omitempty" yaml:"max_complexity,omitempty"`
}

TemplateAccessPolicy controls access to specific templates

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.