semantics

package

Go to main page

Versions in this module

v0

v0.10.0

Oct 23, 2026

Changes in this version

+ func NormalizeForDomains(params map[string]any, dm DomainMap) (map[string]any, string)

type ContainmentResult

+ func ContainsWithDomains(parent, child Grant, parentDom, childDom DomainMap) ContainmentResult

type Decision

+ func AuthorizeSetWithDomains(grants []Grant, op Operation, dm DomainMap) Decision

+ type DomainMap map[string]DomainSpec

+ type DomainSpec struct

+ Name string

+ Unit string

type MatchResult

+ func EntailsWithDomains(g Grant, op Operation, dm DomainMap) MatchResult

v0.9.0

Oct 16, 2026

v0.8.0

Oct 2, 2026

Changes in this version

+ type ContainmentResult struct

+ Contains bool

+ Reason string

v0.7.0

Sep 22, 2026

Changes in this version

+ const ResolutionSatisfied

+ const ResolutionUnknown

+ const ResolutionViolated

+ var ErrChildExceedsParent = errors.New("child_exceeds_parent")

+ var ErrInvalidParamsBinding = errors.New("invalid_params_binding")

+ var ErrInvalidResolution = errors.New("invalid_resolution")

+ var ErrInvalidTimestamp = errors.New("invalid_timestamp")

+ var ErrParamsCardinality = errors.New("params_cardinality")

+ var ErrParamsNotMultiple = errors.New("params_not_multiple")

+ var ErrParamsNotNarrower = errors.New("params_not_narrower")

+ var ErrParamsOutOfRange = errors.New("params_out_of_range")

+ func ConstraintUnion(chain ...Grant) ([]string, error)

+ func ValidateParamBounds(bounds, params map[string]any) error

type Decision

+ func AuthorizeWithChain(chain []Grant, op Operation) Decision

+ func Resolve(d Decision, resolutions []Resolution, now string) Decision

type Grant

+ ParamBounds map[string]any

type MatchResult

+ func Contains(parent, child Grant) MatchResult

type Operation

+ func MaterializeDefaults(grant Grant, op Operation, defaults map[string]any) Operation

+ type Resolution struct

+ Constraint string

+ Status string

v0.6.0

Sep 16, 2026

Changes in this version

+ func ConstraintWithin(value, bound any) error

type Decision

+ func AuthorizeJSONText(grants []Grant, opID, rawParams string) Decision

v0.5.0

Sep 15, 2026

v0.4.0

Sep 14, 2026

Changes in this version

+ const SatisfactionReasonExpressionFalse

+ const SatisfactionReasonUnsatisfied

+ var ErrCanonicalInvalidUTF8 = errors.New("canonical_invalid_utf8")

+ var ErrCanonicalNumber = errors.New("canonical_invalid_number")

+ var ErrCanonicalSurrogate = errors.New("canonical_lone_surrogate")

type RequirementResult

+ func (r RequirementResult) Satisfaction() Satisfaction

+ type Satisfaction struct

+ Reason string

+ Verdict SatisfactionVerdict

+ type SatisfactionVerdict string

+ const SatisfactionSatisfied

+ const SatisfactionUnsatisfied

v0.3.0

Sep 14, 2026

Changes in this version

+ const ChallengeVersion

+ const DefaultCombiningAlgorithm

+ const DigestAlgSHA256

+ const PayloadTypeInToto

+ const PredicateTypeCLCDecision

+ const RecordLang

+ const RequirementVersion

+ const StatementTypeInToto

+ var ErrActionNotMatchable = errors.New("action_not_matchable")

+ var ErrActionProjectionLossy = errors.New("action_projection_lossy")

+ var ErrActionShape = errors.New("action_shape")

+ var ErrActionSuite = errors.New("action_suite")

+ var ErrChallengeExpired = errors.New("challenge_expired")

+ var ErrChallengeNotOutstanding = errors.New("challenge_not_outstanding")

+ var ErrChallengeRetryNotBefore = errors.New("challenge_retry_not_before")

+ var ErrChallengeShape = errors.New("challenge_shape")

+ var ErrCombiningWouldDropObligations = errors.New("combining_would_drop_obligations")

+ var ErrContextFuture = errors.New("context_future")

+ var ErrContextMissing = errors.New("context_missing")

+ var ErrContextNoClock = errors.New("context_no_clock")

+ var ErrContextNotUTC = errors.New("context_not_utc")

+ var ErrContextShape = errors.New("context_shape")

+ var ErrContextStale = errors.New("context_stale")

+ var ErrEnvelopePayloadType = errors.New("envelope_payload_type")

+ var ErrEnvelopeShape = errors.New("envelope_shape")

+ var ErrEnvelopeSignature = errors.New("envelope_signature")

+ var ErrEnvelopeSubjectMismatch = errors.New("envelope_subject_mismatch")

+ var ErrEvidenceConstraint = errors.New("invalid_evidence_constraint")

+ var ErrEvidenceNotCoreEvaluated = errors.New("evidence_not_core_evaluated")

+ var ErrNoDecisions = errors.New("no_decisions")

+ var ErrObligationShape = errors.New("obligation_shape")

+ var ErrObligationUnknown = errors.New("obligation_unknown")

+ var ErrRecordDigestMismatch = errors.New("record_input_digest_mismatch")

+ var ErrRecordOperationCount = errors.New("record_operation_count")

+ var ErrRecordRevision = errors.New("record_unsupported_revision")

+ var ErrRecordVerdictMismatch = errors.New("record_verdict_mismatch")

+ var ErrRequirementExpression = errors.New("requirement_expression")

+ var ErrRequirementShape = errors.New("requirement_shape")

+ var ErrRequirementVersion = errors.New("requirement_version")

+ var ErrSourceChainBranch = errors.New("source_chain_branch")

+ var ErrSourceChainCycle = errors.New("source_chain_cycle")

+ var ErrSourceChainEmpty = errors.New("source_chain_empty")

+ var ErrSourceDanglingLink = errors.New("source_dangling_link")

+ var ErrSourceDuplicate = errors.New("source_duplicate")

+ var ErrSourceEdgeUnbacked = errors.New("source_edge_unbacked")

+ var ErrSourceShape = errors.New("source_shape")

+ var ErrUnknownCombiningAlgorithm = errors.New("unknown_combining_algorithm")

+ func ConstraintIdentity(c string) (string, error)

+ func CoreEvaluatesEvidenceConstraint(c string) bool

+ func Discharge(d Decision, understood []string) error

+ func EpochIDOf(v uint64) *uint64

+ func MaterialFieldDigest(def ActionTypeDefinition, action map[string]any) ([]string, error)

+ func MaterialProjection(def ActionTypeDefinition, action map[string]any) (map[string]any, error)

+ func ObligationIdentities(d Decision) ([]string, error)

+ func Obligations(d Decision) []string

+ func PAE(payloadType string, payload []byte) []byte

+ func ValidateEvidenceConstraint(c string) error

+ type ActionId struct

+ Digest Digest

+ Suite ActionIdSuite

+ Type string

+ func ComputeActionID(def ActionTypeDefinition, suite ActionIdSuite, action map[string]any) (ActionId, error)

+ func ParseActionId(s string) (ActionId, error)

+ func (a ActionId) String() string

+ func (a ActionId) Validate() error

+ type ActionIdSuite string

+ const SuiteJCSSHA256

+ type ActionMappingProfile struct

+ Digest Digest

+ ID string

+ func (p ActionMappingProfile) Pinned() bool

+ type ActionProjector func(profile ActionMappingProfile, in ActionId) (ActionId, error)

+ type ActionTypeDefinition struct

+ MaterialFields []string

+ Type string

+ func (d ActionTypeDefinition) Validate() error

+ type Challenge struct

+ ActionDigest Digest

+ Audience string

+ ExpiresAt time.Time

+ ID string

+ Nonce string

+ ObtainHints []ObtainHint

+ Required []ChallengeItem

+ RequirementDigest *Digest

+ RequirementID string

+ Retry *RetryTiming

+ Version string

+ func BuildChallengeFromDecision(d Decision, params ChallengeParams) (Challenge, error)

+ func BuildChallengeFromRequirement(req Requirement, result RequirementResult, params ChallengeParams) (Challenge, error)

+ func (c Challenge) Authorizes() bool

+ func (c Challenge) Digest() (Digest, error)

+ func (c Challenge) Usable(now time.Time) error

+ func (c Challenge) Validate() error

+ type ChallengeItem struct

+ Constraint string

+ ID string

+ Reason string

+ type ChallengeParams struct

+ ActionDigest Digest

+ Audience string

+ ID string

+ Nonce string

+ Now time.Time

+ ObtainHints []ObtainHint

+ Retry *RetryTiming

+ TTL time.Duration

+ type CombiningAlgorithm string

+ const CombiningDenyOverrides

+ const CombiningFirstApplicable

+ const CombiningPermitOverrides

+ func (a CombiningAlgorithm) Valid() bool

type Decision

+ func Combine(alg CombiningAlgorithm, decisions ...Decision) (Decision, error)

+ type DecisionContext struct

+ At time.Time

+ EpochID *uint64

+ MaxAgeSec int64

+ Nonce string

+ SnapshotDigest *Digest

+ func (c DecisionContext) Digest() (Digest, error)

+ func (c DecisionContext) Fresh(now time.Time) error

+ func (c DecisionContext) IsZero() bool

+ func (c DecisionContext) MaxAge() time.Duration

+ func (c DecisionContext) Validate() error

+ type DecisionRecord struct

+ Constraints RecordConstraints

+ InputDigest Digest

+ Inputs RecordInputs

+ Lang string

+ Reason string

+ Ver string

+ Verdict string

+ func Record(grants []Grant, op Operation) (DecisionRecord, error)

+ func RecordWith(grants []Grant, op Operation, opts RecordOptions) (DecisionRecord, error)

+ func RecordWithContext(grants []Grant, op Operation, ctx DecisionContext) (DecisionRecord, error)

+ func (r DecisionRecord) CanonicalBytes() ([]byte, error)

+ func (r DecisionRecord) Recompute() (Decision, error)

+ func (r DecisionRecord) Verify() error

+ func (r DecisionRecord) VerifyAsOf(now time.Time) error

+ type Digest struct

+ Alg string

+ Value []byte

+ func DigestOf(v any) (Digest, error)

+ func DigestOfCanonical(canonical []byte) Digest

+ func (d Digest) Equal(o Digest) bool

+ type Envelope struct

+ Payload []byte

+ PayloadType string

+ Signatures []Signature

+ func NewEnvelope(rec DecisionRecord) (Envelope, error)

+ func (e *Envelope) Sign(keyID string, sign func(pae []byte) ([]byte, error)) error

+ func (e Envelope) Check() error

+ func (e Envelope) DecisionRecord() (DecisionRecord, error)

+ func (e Envelope) Statement() (Statement, error)

+ func (e Envelope) VerifyRecord(verify func(keyID string, pae, sig []byte) error) error

+ type EvidenceContext struct

+ Executor string

+ Initiator string

+ Now time.Time

+ type EvidenceEvaluation struct

+ Constraint string

+ Reason string

+ Verdict EvidenceVerdict

+ func EvaluateEvidenceConstraint(c string, facts []EvidenceFact, ctx EvidenceContext) (EvidenceEvaluation, error)

+ type EvidenceFact struct

+ IssuedAt time.Time

+ Subject string

+ Type string

+ Verified bool

+ func EvidenceFactsOfRole(facts []EvidenceFact, role string) []EvidenceFact

+ type EvidenceVerdict string

+ const EvidenceSatisfied

+ const EvidenceUnknown

+ const EvidenceViolated

+ type MatchVerdict string

+ const MatchExact

+ const MatchIndeterminate

+ const MatchNotEquivalent

+ func MapAndMatch(profile ActionMappingProfile, projector ActionProjector, ...) MatchVerdict

+ func Match(observed, evidence ActionId) MatchVerdict

+ type ObtainHint struct

+ ID string

+ Mechanism string

+ URI string

+ type RecordConstraints struct

+ Unresolved []string

+ type RecordInputs struct

+ Context *DecisionContext

+ Grants []Grant

+ Operations []Operation

+ RequirementDigest *Digest

+ Sources *SourceChain

+ type RecordOptions struct

+ Context *DecisionContext

+ Requirement *Requirement

+ Sources *SourceChain

+ type Requirement struct

+ Constraints []RequirementConstraint

+ Expression string

+ ID string

+ Purpose string

+ Version string

+ func ParseRequirement(raw []byte) (Requirement, error)

+ func (r Requirement) Digest() (Digest, error)

+ func (r Requirement) Roles() ([]string, error)

+ func (r Requirement) Validate() error

+ type RequirementConstraint struct

+ Constraint string

+ Role string

+ type RequirementResult struct

+ Constraints []EvidenceEvaluation

+ Digest Digest

+ Expression bool

+ MissingRoles []string

+ RequirementID string

+ Verdict EvidenceVerdict

+ func EvaluateRequirement(req Requirement, facts []EvidenceFact, ctx EvidenceContext) (RequirementResult, error)

+ func (r RequirementResult) Satisfied() bool

+ type RetryTiming struct

+ JitterSec int

+ NotBefore time.Time

+ type Signature struct

+ KeyID string

+ Sig []byte

+ type SourceChain struct

+ Links []SourceLink

+ Sources []SourceRef

+ func (c SourceChain) Digest() (Digest, error)

+ func (c SourceChain) StandingOn(from Digest) ([]SourceRef, error)

+ func (c SourceChain) Validate() error

+ type SourceLink struct

+ From Digest

+ To Digest

+ type SourceRef struct

+ Digest Digest

+ ID string

+ Issuer string

+ Kind string

+ References []Digest

+ type Statement struct

+ Predicate DecisionRecord

+ PredicateType string

+ Subject []Subject

+ Type string

+ func NewStatement(rec DecisionRecord) (Statement, error)

+ type Subject struct

+ Digest map[string]string

+ Name string

v0.2.0

Sep 12, 2026

Changes in this version

+ const CLCRevision

+ const VerdictAllow

+ const VerdictAllowUR

+ const VerdictDeny

+ var ErrAbsentSource = errors.New("absent_source")

+ var ErrCapabilityNotAuth = errors.New("capability_not_authorized")

+ var ErrDifferentNamespace = errors.New("different_namespace")

+ var ErrEmptyBoundDenies = errors.New("empty_bound_denies_class")

+ var ErrInvalidCapabilityID = errors.New("invalid_capability_id")

+ var ErrInvalidConstraint = errors.New("invalid_constraint")

+ var ErrInvalidParamsDupKey = errors.New("invalid_params_duplicate_key")

+ var ErrInvalidParamsNull = errors.New("invalid_params_null")

+ var ErrInvalidParamsNumber = errors.New("invalid_params_number")

+ var ErrInvalidParamsSize = errors.New("invalid_params_size")

+ var ErrLiteralMismatch = errors.New("literal_mismatch")

+ var ErrMissingCapabilityID = errors.New("missing_capability_id")

+ var ErrNoOverlap = errors.New("no_overlap")

+ var ErrNotInEnum = errors.New("not_in_enum")

+ var ErrParamsExceedGrant = errors.New("params_exceed_grant")

+ var ErrParamsMissing = errors.New("params_missing")

+ var ErrParamsUndeclared = errors.New("undeclared_param")

+ var ErrUnknownConstraint = errors.New("unknown_constraint")

+ var ErrUnsupportedLangRev = errors.New("unsupported_language_revision")

+ var ErrUnsupportedWildcard = errors.New("unsupported_wildcard")

+ var ErrWildcardNoTrailing = errors.New("wildcard_requires_trailing_segment")

+ var ValidateIDRegex = regexp.MustCompile(...)

+ func CanonicalJSON(v any) ([]byte, error)

+ func CheckConstraint(c string, op Operation) error

+ func RevisionCompatible(inputRevision string) bool

+ func ValidateCapabilityID(id string) error

+ func ValidateConstraint(c string) error

+ func ValidateGrantParams(params map[string]any) error

+ func ValidateOperationParams(params map[string]any) error

+ func ValidateRawParams(raw string) error

+ type Decision struct

+ Reason string

+ Unresolved []string

+ Verdict string

+ func Authorize(effectiveGrant Grant, op Operation) Decision

+ func AuthorizeSet(grants []Grant, op Operation) Decision

+ type Grant struct

+ Constraints []string

+ ID string

+ Params map[string]any

+ func Intersect(grants ...Grant) (Grant, error)

+ type MatchResult struct

+ Entails bool

+ Reason string

+ func Entails(grant Grant, op Operation) MatchResult

+ type Operation struct

+ ID string

+ Params map[string]any

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL