Documentation
¶
Overview ¶
glob.go implements capability pattern matching.
A capability has the form: class:subclass:resource/path/here Matching logic:
- The grant pattern and the required capability are split on the FIRST ':'.
- The class prefix must match exactly (case-sensitive).
- The remainder (everything after the first ':') is matched with glob rules: ** matches zero or more characters including '/' and '.' (greedy)
- matches one segment — any characters except '/' and '.'
- Example: "fs:read:/data/**" matches "fs:read:/data/foo/bar"
- Example: "net:fetch:*.example.com" matches "net:fetch:api.example.com" but NOT "net:fetch:a.b.example.com"
Package policy implements capability-based access control for LoopKit tools. Capabilities are expressed as dot-separated tokens like "fs:read:/data/**". The Engine evaluates ToolDescriptor requirements against a Grant and returns a Decision (Allow, Deny, or AskHuman).
Matching rules:
- A Capability is a string of the form "class:subclass:resource" (variable segments).
- Glob patterns use * (single path segment) and ** (zero or more segments) on the resource part.
- The class is the prefix before the first ':'.
- HumanGateClasses in a Grant cause AskHuman instead of Deny for matching capability classes.
- With a non-nil Grant: deny-by-default; only explicitly granted capabilities are allowed.
- With a nil Grant (no policy configured): allow-all.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Capability ¶
type Capability string
Capability is a capability token string such as "fs:read:/data/**" or "net:fetch:*.example.com". Format: class:subclass:resource (number of segments may vary; resource part supports globs).
type Decision ¶
type Decision struct {
// Action is the verdict (Allow / Deny / AskHuman).
Action Verdict
// Capability is the capability that was evaluated.
Capability Capability
// Reason is a human-readable explanation.
Reason string
}
Decision is the full result of an Engine.Check call.
type Engine ¶
type Engine struct {
// contains filtered or unexported fields
}
Engine evaluates policy checks. Construct with NewEngine(grant) for deny-by-default, or NewEngine(nil) for allow-all.
func NewEngine ¶
NewEngine creates an Engine with the given grant. Pass nil for allow-all (backward-compatible default when no policy is configured).
func (*Engine) Check ¶
func (e *Engine) Check(required []Capability) Decision
Check evaluates whether the given required capabilities are permitted by the grant. If multiple capabilities are required, the most restrictive verdict applies. Priority: AskHuman > Deny > Allow.
type Grant ¶
type Grant struct {
// Caps lists the permitted capability patterns.
// An empty Caps list means no capabilities are granted (deny-all).
Caps []Capability
// HumanGateClasses lists capability class prefixes that require human approval
// instead of an outright Deny. Example: []string{"write", "payment"}.
HumanGateClasses []string
}
Grant defines what capabilities a loop is allowed to use.
Source Files