Documentation
¶
Overview ¶
Package scriptauto approves a personal script for its own owner (#1367).
A managed script runs nothing until a version is approved, and approving binds the capability grant that run is confined to. For a script whose entire audience is its author that asked an administrator to authorize a person against themselves: the roles an approved run presents are copied from the version's AUTHOR and are refused from the approval request, so a reviewer of a personal script was narrowing a script only its owner could invoke.
This package is the other three axes of the grant, which do not follow from who the author is and therefore cannot simply be skipped. It reads what the code plainly reaches — the same static read the review route checks a reviewer's grant against — and mints exactly that:
- capabilities and connections come from the source;
- a portal destination resolves to the canonical portal address;
- any other destination resolves to the address the script's currently approved version already pins, because where a bucket destination points is a decision a person made and nothing in the source states it.
Anything it cannot read off the source is not guessed. The version stays unapproved and goes to the review queue, which is exactly where it was before this package existed.
It lives here rather than in pkg/script because minting the grant needs the Starlark reader in scriptrun and the deployment's connection enumeration, and the domain knows about neither.
Index ¶
- type Approver
- func (a *Approver) Approve(ctx context.Context, sc *script.Script, version int, ...) script.AutoOutcome
- func (a *Approver) AutoApprove(ctx context.Context, sc *script.Script, version int, author script.Author) script.AutoOutcome
- func (a *Approver) Consider(ctx context.Context, sc *script.Script, author script.Author) script.AutoDecision
- type ConnectionReach
- type Deps
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Approver ¶
type Approver struct {
// contains filtered or unexported fields
}
Approver mints and binds the grant an owner-authored personal version runs under. It implements script.AutoApprover.
func New ¶
New builds an approver. A nil result is never returned; a deployment that cannot approve is expressed by a nil Approvals, which declines every version with no reason, because "this deployment does not do that" is not something to put in front of the person who pressed save.
func (*Approver) Approve ¶
func (a *Approver) Approve( ctx context.Context, sc *script.Script, version int, decision script.AutoDecision, ) script.AutoOutcome
Approve binds a decision Consider admitted to the named version, and advances sc to what the write left behind, so the surface that saved the edit reports the state that now exists rather than the one it sent.
func (*Approver) AutoApprove ¶
func (a *Approver) AutoApprove( ctx context.Context, sc *script.Script, version int, author script.Author, ) script.AutoOutcome
AutoApprove is Consider followed by Approve, for a version with no edit funnel in front of it: the first version of a script being created.
func (*Approver) Consider ¶
func (a *Approver) Consider(ctx context.Context, sc *script.Script, author script.Author) script.AutoDecision
Consider decides whether this script's next version can be approved with no reviewer, and what it would be approved to reach. It writes nothing.
The nil receiver is the deployment with no automatic approval at all, and it is answered the same way a shared script is: an empty decision, which reads as "nobody approved this", because nobody did.
type ConnectionReach ¶
ConnectionReach lists the connections one author's authority reaches, in the deployment's terms. It is the composition root's, because resolving it means walking the live toolkit registry through the persona boundary.
Nil skips the check. The middleware enforces the same boundary at run time regardless, so what is lost is the early answer, not the boundary.
type Deps ¶
type Deps struct {
// Approvals binds the grant and moves the execution gate. Nil disables
// automatic approval entirely.
Approvals script.AutoApprovalStore
// Versions reads the currently approved version, which is where the address
// of an already-pinned destination comes from. Nil leaves every non-portal
// destination unresolvable, so those versions go to review.
Versions script.VersionStore
// Reach reports what the author's own authority can call.
Reach ConnectionReach
}
Deps are the collaborators an approver needs.
Source Files