evaluator

type GoRule ¶

type GoRule struct {
	IDValue string
	Fn      func(ctx context.Context, in core.RuleInput) (core.RuleResult, error)
}

GoRule is a thin core.Rule implementation backed by a closure. It exists so framework packages can register hand-written Go rules without each defining its own type.

func (r *GoRule) Evaluate(ctx context.Context, in core.RuleInput) (core.RuleResult, error)

func (r *GoRule) ID() string

type Input ¶

type Input struct {
	Plan                  *planner.RunPlan
	Rules                 *registry.Registry[core.Rule]
	RecordsByPolicy       map[string]map[string][]core.EvidenceRecord
	EnvelopesByPolicy     map[string][]string
	CollectErrorsByPolicy map[string]error
	Now                   time.Time

	// RosterUsage, when set, accumulates which experimental.roster
	// account names actually matched a collected account. It is the one
	// run-scoped output of evaluation: the caller allocates it, reads it
	// after Evaluate returns, and warns about the keys that matched
	// nothing. Nil disables the bookkeeping entirely.
	RosterUsage *RosterUsage
}

Input is the per-run input to Evaluate. RecordsByPolicy is keyed by PolicyID; the inner map is keyed by slot name. CollectErrorsByPolicy holds collector-side errors (network, auth, schema-validation); a non-empty entry forces the policy's status to "error" without invoking the rule.

type RegoRule ¶

type RegoRule struct {
	// contains filtered or unexported fields
}

RegoRule wraps an OPA Rego module. The module is prepared once at New; each Evaluate call instantiates a fresh evaluator with the per-policy input. Pure-function semantics are preserved by OPA's sandbox.

func NewRegoRule(id, module, query string) (*RegoRule, error)

func (r *RegoRule) Evaluate(ctx context.Context, in core.RuleInput) (core.RuleResult, error)

func (r *RegoRule) ID() string

type RosterKey ¶ added in v0.76.0

type RosterKey struct {
	SourceID string
	Name     string
}

RosterKey identifies one declared roster entry: the source ID keying the aliases / non_human map and the account name inside it. Both are already lowercased by the config loader.

type RosterUsage ¶ added in v0.76.0

type RosterUsage struct {
	// contains filtered or unexported fields
}

RosterUsage accumulates, across a whole run, which experimental.roster account names actually met a collected account.

The source-ID half of a typo is fatal at plan time (planner.checkRosterSourceKeys). The account-name half cannot be: only the evaluator ever sees the universe of account names, and it sees it one record at a time. So the keys are recorded as they match and the leftovers — declared minus matched — are what the orchestrator warns about.

It must be run-scoped, not per-policy. The planner copies the same Aliases/NonHuman maps into every roster policy's RosterLink, but each policy gets its own evalCtx over its own bound accounts; a per-policy verdict would call an alias unused in the policy whose accounts slot did not bind that source even though the sibling policy used it.

Nothing here crosses the aggregation boundary: these are account names and source IDs, which is identity data. It reaches local stdout only.

The zero value is not usable; call NewRosterUsage. A nil *RosterUsage is a no-op accumulator, which is what every caller that does not care (rule: policies, most tests) passes.

func NewRosterUsage() *RosterUsage

func (u *RosterUsage) Declare(link *planner.RosterLink)

func (u *RosterUsage) UnusedAliases() []RosterKey

func (u *RosterUsage) UnusedNonHuman() []RosterKey