Documentation
¶
Index ¶
- func AuthValueFromContext(ctx context.Context) cty.Value
- func EnvObject() cty.Value
- func IsConstantExpression(expr hcl.Expression) (cty.Value, bool)
- func IsExpressionProvided(expr hcl.Expression) bool
- func StartLinkedTriggerSpan(ctx context.Context, tp trace.TracerProvider, triggerType, name string) (context.Context, func(error))
- func StartTriggerSpan(ctx context.Context, tp trace.TracerProvider, triggerType, name string) (context.Context, func(error))
- func WithAuthValue(ctx context.Context, val cty.Value) context.Context
- type BaggageFilterConfig
- type EvalContextBuilder
- func (e *EvalContextBuilder) BuildEvalContext(parent *hcl.EvalContext) (*hcl.EvalContext, error)
- func (e *EvalContextBuilder) WithAttribute(name string, value cty.Value) *EvalContextBuilder
- func (e *EvalContextBuilder) WithFunction(name string, fn function.Function) *EvalContextBuilder
- func (e *EvalContextBuilder) WithFunctions(functions map[string]function.Function) *EvalContextBuilder
- func (e *EvalContextBuilder) WithInt64Attribute(name string, value int64) *EvalContextBuilder
- func (e *EvalContextBuilder) WithStringAttribute(name string, value string) *EvalContextBuilder
- func (e *EvalContextBuilder) WithStringMapAttribute(name string, m map[string]string) *EvalContextBuilder
- func (e *EvalContextBuilder) WithUInt64Attribute(name string, value uint64) *EvalContextBuilder
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AuthValueFromContext ¶ added in v0.20.0
AuthValueFromContext retrieves the ctx.auth value stored by WithAuthValue. Returns cty.NullVal(cty.DynamicPseudoType) if no auth value is present.
func EnvObject ¶ added in v0.37.0
EnvObject returns a cty object whose attributes are the current process's environment variables. Variable names are sanitized to be valid HCL attribute names: any character not in [A-Za-z0-9_-] (or not in [A-Za-z_] for the first character) is replaced with an underscore. An empty name becomes "_". An empty environment returns cty.EmptyObjectVal.
func IsConstantExpression ¶
func IsConstantExpression(expr hcl.Expression) (cty.Value, bool)
IsConstantExpression checks if an expression is a constant (evaluatable with nil context). Returns the value and true if constant, or cty.NilVal and false otherwise.
func IsExpressionProvided ¶
func IsExpressionProvided(expr hcl.Expression) bool
IsExpressionProvided checks if an HCL expression was actually provided in the configuration. HCL creates empty expression objects for optional fields that aren't specified, but empty expressions have Start.Byte == End.Byte (zero-length range). Real expressions have End.Byte > Start.Byte (non-zero length range).
func StartLinkedTriggerSpan ¶ added in v0.35.0
func StartLinkedTriggerSpan(ctx context.Context, tp trace.TracerProvider, triggerType, name string) (context.Context, func(error))
StartLinkedTriggerSpan starts a new root span for an async trigger or action that will outlive its caller. The returned context has the caller's cancellation severed (via context.WithoutCancel) so an upstream ctx cancellation — e.g. an HTTP request completing after spawning the dispatch goroutine — cannot interrupt the dispatched work mid-flight. The new span carries a Link back to the caller's span (if any) for trace correlation, per OTel async-messaging conventions.
Use this from any goroutine spawned on behalf of a caller whose ctx may be short-lived. For synchronous dispatch or autonomous root events (timer callbacks, signal handlers), use StartTriggerSpan.
func StartTriggerSpan ¶ added in v0.22.0
func StartTriggerSpan(ctx context.Context, tp trace.TracerProvider, triggerType, name string) (context.Context, func(error))
StartTriggerSpan starts a span for a single trigger execution using the provided context as parent (pass context.Background() for root spans). tp is the TracerProvider to use; if nil the global provider is used. The returned context carries the span; the stop function must be called when the execution completes to end the span and record any error.
Types ¶
type BaggageFilterConfig ¶ added in v0.42.0
type BaggageFilterConfig struct {
// Passthrough trusts all inbound baggage. Mutually exclusive with Allow/Deny.
Passthrough bool `hcl:"passthrough,optional"`
// Allow lists keys to keep; all others are dropped. Mutually exclusive with Deny.
Allow []string `hcl:"allow,optional"`
// Deny lists key prefixes to drop; all others are kept. Mutually exclusive with Allow.
Deny []string `hcl:"deny,optional"`
// MaxEntries caps the total number of entries (default 64).
MaxEntries *int `hcl:"max_entries,optional"`
// MaxBytes caps the total serialized size in bytes (default 8192).
MaxBytes *int `hcl:"max_bytes,optional"`
DefRange hcl.Range `hcl:",def_range"`
}
BaggageFilterConfig is the optional baggage{} sub-block on trust-boundary servers. It controls which inbound baggage keys are trusted — exposed in ctx.baggage and re-propagated downstream — after extraction from inbound headers but before action evaluation begins.
Inbound baggage is UNTRUSTED INPUT, so the default (no block, or an empty block) is to strip it entirely. Trace propagation (traceparent) is unaffected, and baggage your own VCL sets via set(ctx.baggage, …) always propagates outbound regardless of this policy. A server opts into trusting upstream baggage with one of:
baggage { passthrough = true } # trust all inbound baggage
baggage { allow = ["tenant_id"] } # trust only the listed keys
baggage { deny = ["internal."] } # trust all but the listed key prefixes
func (*BaggageFilterConfig) FilterContext ¶ added in v0.42.0
func (c *BaggageFilterConfig) FilterContext(ctx context.Context, logger *zap.Logger) context.Context
FilterContext applies the trust policy to ctx's inbound baggage. The default (nil receiver, an empty block, or no allow/deny/passthrough) is SECURE: all inbound baggage is stripped. passthrough=true trusts everything; otherwise allow/deny select which keys survive, subject to the size caps. Surplus entries beyond max_entries/max_bytes are dropped silently (matching the W3C spec's tolerance for oversized baggage) with a debug log.
func (*BaggageFilterConfig) Middleware ¶ added in v0.42.0
Middleware wraps next so that inbound baggage is filtered per this config. It must be installed INSIDE the otelhttp handler so it runs after the W3C propagator has extracted baggage. A nil receiver applies the secure default (strip all), so this should be installed unconditionally on trust-boundary servers. When passthrough is set it is a cheap pass-through.
func (*BaggageFilterConfig) Validate ¶ added in v0.42.0
func (c *BaggageFilterConfig) Validate() hcl.Diagnostics
Validate reports config-time errors. Call at parse time. Safe on a nil receiver.
type EvalContextBuilder ¶
type EvalContextBuilder struct {
Functions map[string]function.Function
// contains filtered or unexported fields
}
EvalContextBuilder builds an HCL eval context with a "ctx" variable containing a cty object that wraps a Go context and any additional attributes or functions.
func NewEvalContext ¶
func NewEvalContext(ctx context.Context) *EvalContextBuilder
NewEvalContext creates a new EvalContextBuilder wrapping the given context.
func (*EvalContextBuilder) BuildEvalContext ¶
func (e *EvalContextBuilder) BuildEvalContext(parent *hcl.EvalContext) (*hcl.EvalContext, error)
BuildEvalContext creates a child HCL eval context with the "ctx" variable set. It automatically includes ctx.auth from the Go context (set by auth middleware), and ctx.trace_id / ctx.span_id from any active OTel span.
func (*EvalContextBuilder) WithAttribute ¶
func (e *EvalContextBuilder) WithAttribute(name string, value cty.Value) *EvalContextBuilder
func (*EvalContextBuilder) WithFunction ¶
func (e *EvalContextBuilder) WithFunction(name string, fn function.Function) *EvalContextBuilder
func (*EvalContextBuilder) WithFunctions ¶
func (e *EvalContextBuilder) WithFunctions(functions map[string]function.Function) *EvalContextBuilder
func (*EvalContextBuilder) WithInt64Attribute ¶
func (e *EvalContextBuilder) WithInt64Attribute(name string, value int64) *EvalContextBuilder
func (*EvalContextBuilder) WithStringAttribute ¶
func (e *EvalContextBuilder) WithStringAttribute(name string, value string) *EvalContextBuilder
func (*EvalContextBuilder) WithStringMapAttribute ¶ added in v0.44.0
func (e *EvalContextBuilder) WithStringMapAttribute(name string, m map[string]string) *EvalContextBuilder
WithStringMapAttribute sets an attribute to an object whose attributes are the map's keys, each holding a string. A nil or empty map yields an empty object rather than a null, so expressions can always index it safely.
This is the shape used for the "fields" attribute that receivers extract from routing keys and message headers.
func (*EvalContextBuilder) WithUInt64Attribute ¶
func (e *EvalContextBuilder) WithUInt64Attribute(name string, value uint64) *EvalContextBuilder
Source Files