Documentation
¶
Overview ¶
Package connreach answers, in the deployment's own terms, which connections one caller's authority reaches.
It is the enumeration a picker is filled from and the enumeration an automatic approval is checked against, and it is one implementation because those two have to agree: a form offering a connection the run then refuses, or an approval refusing a connection the picker offered, are the same defect read from opposite ends.
The persona predicate is connscope's, which delegates to the same persona.ToolFilter rule the authorizer applies to a tool call, so nothing here re-derives what a persona may reach.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Connection ¶
type Connection struct {
// Name is the name a persona's rules match and a tool call's connection
// argument carries — not always the name the enumeration leads with, since a
// single-connection toolkit's entry carries its INSTANCE name.
Name string
Kind string
Description string
}
Connection is one connection a caller reaches: the value a call binds, and what a person needs to pick it by.
type Deps ¶
type Deps struct {
// Toolkits is the live toolkit registry. Nil yields a nil Lister, which
// answers nothing rather than answering "reaches no connection".
Toolkits *registry.Registry
// Personas resolves a persona's connection rules. Nil denies every named
// connection, matching the fail-closed action path.
Personas *persona.Registry
}
Deps are the live registries a listing reads. They are held rather than snapshotted, so a connection added or a persona edited through the admin API takes effect on the next call.
type Lister ¶
type Lister struct {
// contains filtered or unexported fields
}
Lister enumerates connections for one caller at a time.
func New ¶
New builds a Lister, or nil when there is no toolkit registry to read.
Nil is meaningful: a deployment that cannot enumerate its connections should serve no set at all rather than an empty one, which a form renders as "this reaches nothing" and an approval would read as a refusal.
func (*Lister) ForPersona ¶
func (l *Lister) ForPersona(ctx context.Context, personaName string, unrestricted bool) []Connection
ForPersona lists what one resolved persona reaches. unrestricted lifts the persona boundary for an administrator, whose reach is unrestricted by design.
Source Files