Documentation
¶
Overview ¶
Package cedarauthority provides the optional Cedar-backed authority evaluator.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var DefaultPolicy = []byte(`permit(principal, action, resource);`)
DefaultPolicy is the static shipped policy. The carried capability set is checked before Cedar evaluates this broad permit, so this policy cannot grant a capability the caller did not carry.
Functions ¶
This section is empty.
Types ¶
type Evaluator ¶
type Evaluator struct {
// contains filtered or unexported fields
}
Evaluator evaluates one immutable, startup-loaded policy set. Request entities are constructed per authorization; no policy or entity is registered globally.
func New ¶
New parses an operator-owned static policy set. Definition-group permits are rejected because instance membership in a definition would widen authority.
func (*Evaluator) AuthorizeTool ¶
func (e *Evaluator) AuthorizeTool(_ context.Context, request port.AuthorityRequest) (port.AuthorityDecision, error)
AuthorizeTool first enforces the carried capability set, then permits Cedar to add only denials such as a workspace path boundary.
func (*Evaluator) RequiresOwnerIdentity ¶
RequiresOwnerIdentity reports that Cedar policies receive owner entities and therefore cannot safely evaluate an ownerless request.
Source Files