Documentation
¶
Overview ¶
Package capregistry provides a runtime wrapper around the capability register.
Purpose: core validates declared capabilities at three points — AIC issuance, authentication, and gateway — against the register's capability specification. Specification JSON is loaded via embedded + disk override (changing JSON updates policy without recompilation) and supports SIGHUP hot-reload.
Index ¶
- type CapabilityRegistry
- func (cr *CapabilityRegistry) Enabled() bool
- func (cr *CapabilityRegistry) LoadAndSet(diskDir string) error
- func (cr *CapabilityRegistry) Registry() *register.Registry
- func (cr *CapabilityRegistry) ValidateAICCapabilities(caps []pki.Capability) error
- func (cr *CapabilityRegistry) ValidateCapability(formatted string) error
- func (cr *CapabilityRegistry) ValidateCapabilityIDs(ids []string) error
- func (cr *CapabilityRegistry) ValidateClaim(scheme, capability string) error
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CapabilityRegistry ¶
type CapabilityRegistry struct {
// contains filtered or unexported fields
}
CapabilityRegistry is an atomic wrapper around register.Registry that supports hot-reload. nil-safe: when not loaded, validation passes without blocking existing workflows; loadErr records the failure reason.
func New ¶
func New() *CapabilityRegistry
New creates an empty capability registry (no schemes loaded).
func (*CapabilityRegistry) Enabled ¶
func (cr *CapabilityRegistry) Enabled() bool
Enabled reports whether the capability registry has been loaded.
func (*CapabilityRegistry) LoadAndSet ¶
func (cr *CapabilityRegistry) LoadAndSet(diskDir string) error
LoadAndSet loads schemes from a disk directory (capability data tree) and atomically replaces the current registry. diskDir must be non-empty; embedded schemes were removed when the capability data split into a separate subproject. Returns an error if loading fails; the current registry remains unchanged.
func (*CapabilityRegistry) Registry ¶
func (cr *CapabilityRegistry) Registry() *register.Registry
Registry returns the current registry (may be nil).
func (*CapabilityRegistry) ValidateAICCapabilities ¶
func (cr *CapabilityRegistry) ValidateAICCapabilities(caps []pki.Capability) error
ValidateAICCapabilities validates whether all capabilities declared in an AIC are registered. Returns the first invalid capability; returns nil if all are valid or the registry is not enabled.
func (*CapabilityRegistry) ValidateCapability ¶
func (cr *CapabilityRegistry) ValidateCapability(formatted string) error
ValidateCapability validates whether a full identifier "scheme:capability_id" is registered. Returns nil when the registry is not loaded (does not block).
func (*CapabilityRegistry) ValidateCapabilityIDs ¶
func (cr *CapabilityRegistry) ValidateCapabilityIDs(ids []string) error
ValidateCapabilityIDs validates whether a set of "scheme:capability_id" identifiers are all registered. Returns the first unregistered capability identifier; returns nil if all are valid.
func (*CapabilityRegistry) ValidateClaim ¶
func (cr *CapabilityRegistry) ValidateClaim(scheme, capability string) error
ValidateClaim validates a single capability claim (AI-generated least-privilege set). Returns an error if the claim is invalid (unknown scheme / unregistered capability / undefined parameters).
Source Files