policy

type AskFunc ¶

type AskFunc func(
	ctx context.Context,
	action string,
	args map[string]interface{},
	p *Policy,
) bool

AskFunc is invoked when Mode==ask. Returning true approves the action, false rejects it. Implementations MAY mutate the policy (for example, switching to ModeAuto after the first approval).

type Config ¶

type Config struct {
	Mode      string   `json:"mode,omitempty" yaml:"mode,omitempty"`
	AllowList []string `json:"allow,omitempty" yaml:"allow,omitempty"`
	BlockList []string `json:"block,omitempty" yaml:"block,omitempty"`
}

Config represents the declarative, serialisable part of a Policy.

func ToConfig(p *Policy) *Config

type Policy ¶

type Policy struct {
	Mode      string   // ask / auto / deny      (default = auto)
	AllowList []string // whitelist (empty => all)
	BlockList []string // blacklist
	Ask       AskFunc  // used only when Mode==ask
}

Policy represents the approval / debugging settings for the current workflow-run.

• Mode controls the high-level behaviour (ask / auto / deny).
• AllowList, BlockList allow coarse filtering regardless of Mode.
• Ask is only used when Mode==ask.

A nil *Policy means "execute everything automatically" and is therefore the zero-cost default.

func FromConfig(c *Config) *Policy

func FromContext(ctx context.Context) *Policy

func (p *Policy) IsAllowed(action string) bool