store

package
v1.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 4, 2026 License: MIT Imports: 19 Imported by: 0

Documentation

Overview

Package store defines the composite store interface for Shield.

The composite store composes all subsystem store interfaces into a single interface. Implementations (Postgres, SQLite, Memory) satisfy the composite.

Index

Constants

This section is empty.

Variables

View Source 
var ErrCollection = errors.New("shield: unsupported dashboard collection")
View Source 
var ErrConflict = errors.New("shield: resource conflict")
View Source 
var ErrNotFound = errors.New("shield: scoped resource not found")
View Source 
var ErrReadOnly = errors.New("shield: resource is read-only in this scope")

ErrReadOnly reports a write to a resource the scope may read but not change: an app-level policy seen from a tenant scope.

View Source 
var ErrScope = errors.New("shield: tenant and app scope are required")

Functions

func DashboardWritable 

func DashboardWritable(scope Scope, kind string, row map[string]any) bool

DashboardWritable reports whether scope may update or delete row, a stored dashboard row of kind: a policy only in the scope's PolicyScope.

func Editable 

func Editable(kind string) bool

func FilterColumn 

func FilterColumn(kind, field string) bool

func MarshalDashboard 

func MarshalDashboard(v any) (json.RawMessage, error)

MarshalDashboard keeps zero and empty values that domain omitempty tags hide. Dashboard editors need explicit false, zero and cleared arrays on reload.

func NextRevision 

func NextRevision(previous any) time.Time

NextRevision remains distinct after MongoDB's millisecond timestamp encoding.

func Prefix 

func Prefix(kind string) string

func ReferenceField 

func ReferenceField(kind string) string

func ReportLevels 

func ReportLevels(ctx context.Context, key string) ([]string, error)

ReportLevels resolves which scope levels a compliance report list keyed by key may cover. An empty key is ErrTenantRequired. With no tenant on ctx the list is a filter-only call and gets no level restriction (nil). With a tenant on ctx only its own org level is readable: any other key is ErrTenantMismatch.

func ReportScope 

func ReportScope(ctx context.Context) (key, level string, ok bool)

ReportScope is the one compliance report scope ctx may read: a tenant's own org scope, or, with no tenant on ctx, the app scope of the context app (an operator call). App-level reports are shared by every tenant of the app, so a tenant never reads them. ok is false when ctx names neither.

func ScopeLevels 

func ScopeLevels(ctx context.Context, key, level string) ([]string, error)

ScopeLevels resolves which scope levels a policy or compliance read keyed by key may cover. level narrows the answer to one level when set.

An empty key is ErrTenantRequired. With no tenant on ctx the read is a filter-only call (cortex's catalogs make these), so it returns nil and the caller adds no level restriction. With a tenant on ctx it returns the levels at which ScopeVisible accepts key, and ErrTenantMismatch when there are none.

func ScopeVisible 

func ScopeVisible(ctx context.Context, key, level string) bool

ScopeVisible reports whether a policy or compliance scope is readable from ctx: level "org" needs key == context tenant, level "app" needs key == context app.

func ScopeWritable 

func ScopeWritable(ctx context.Context, key, level string) error

ScopeWritable checks that ctx may create, change or delete a policy or compliance report in the scope (key, level).

With a tenant on ctx, only that tenant's org scope is writable. App scope is shared by every tenant of the app (Loomplane gives all workspaces one app ID), so a tenant writing there would change every other tenant's safety configuration: app-level writes return ErrTenantMismatch, as does an org key that is not the context tenant. With no tenant on ctx the call is an operator call and any scope is writable. An empty key is ErrTenantRequired.

func Tenant 

func Tenant(ctx context.Context, want string) (string, error)

Tenant returns the tenant a store call runs for. want is a filter's or an entity's TenantID. Empty want takes the context tenant. Both empty is ErrTenantRequired; both set and different is ErrTenantMismatch.

func UpdateRevision 

func UpdateRevision(before, patch map[string]any) (time.Time, error)

UpdateRevision removes the internal precondition and returns the persisted revision.

func ValidReferenceKind 

func ValidReferenceKind(kind string) bool

func ValidateRetention 

func ValidateRetention(scope Scope, cutoff time.Time, keys []string) error

Types

type AssignmentStore 

type AssignmentStore interface {
	DashboardAssign(context.Context, Scope, string, bool) error
	DashboardAssigned(context.Context, Scope, string) (bool, error)
}

type DashboardStore 

type DashboardStore interface {
	DashboardList(context.Context, Scope, string, Filter) (Page, error)
	DashboardGet(context.Context, Scope, string, string) (json.RawMessage, error)
	DashboardCreate(context.Context, Scope, string, json.RawMessage) (json.RawMessage, error)
	DashboardUpdate(context.Context, Scope, string, string, json.RawMessage) (json.RawMessage, error)
	DashboardDelete(context.Context, Scope, string, string) error
}

DashboardStore is an additional, strict interface. Legacy engine methods retain their original contracts; dashboard calls must never broaden an empty scope.

type Filter 

type Filter struct {
	Limit         int    `json:"limit"`
	Offset        int    `json:"offset"`
	Enabled       *bool  `json:"enabled,omitempty"`
	Name          string `json:"name,omitempty"`
	Field         string `json:"field,omitempty"`
	Value         string `json:"value,omitempty"`
	Search        string `json:"search,omitempty"`
	ReferenceKind string `json:"reference_kind,omitempty"`
	ReferenceName string `json:"reference_name,omitempty"`
	Direction     string `json:"direction,omitempty"`
}

func (Filter) Validate 

func (f Filter) Validate() error

type Page 

type Page struct {
	Items       []json.RawMessage `json:"items"`
	Total       int64             `json:"total"`
	Limit       int               `json:"limit"`
	Offset      int               `json:"offset"`
	HasMore     bool              `json:"has_more"`
	RefreshedAt time.Time         `json:"refreshed_at"`
}

type PrivacyStatsStore 

type PrivacyStatsStore interface {
	DashboardTokenStats(context.Context, Scope) (TokenStats, error)
}

type PrivacyStore 

type PrivacyStore interface {
	DashboardTokens(context.Context, Scope, string, *time.Time, Filter) (Page, error)
	DashboardDeleteTokens(context.Context, Scope, time.Time, []string) (int64, error)
}

type Scope 

type Scope struct {
	TenantID    string `json:"tenant_id"`
	AppID       string `json:"app_id"`
	PolicyKey   string `json:"policy_key,omitempty"`
	PolicyLevel string `json:"policy_level,omitempty"`
}

func (Scope) AppScope 

func (s Scope) AppScope() bool

AppScope reports whether the host's authorization adapter granted this scope the app level (PolicyLevel "app"): an operator acting for the whole app. It is never set from request params.

func (Scope) PolicyScope 

func (s Scope) PolicyScope() (key, level string)

PolicyScope is where a dashboard policy write lands, the only scope a policy update or delete may touch, and the only scope of the compliance reports a dashboard actor reads: the app scope for an app-scope actor (see AppScope), otherwise the actor tenant's org scope. App-level policies are shared by every tenant of the app, so a tenant actor never writes them; it reads the ones assigned to it (see the store's dashboard list and get).

func (Scope) Validate 

func (s Scope) Validate() error

type Store 

type Store interface {
	instinct.Store
	awareness.Store
	boundary.Store
	values.Store
	judgment.Store
	reflex.Store
	profile.Store
	scan.Store
	policy.Store
	pii.Store
	compliance.Store

	// Migrate runs database migrations.
	Migrate(ctx context.Context) error

	// Ping verifies the store connection is alive.
	Ping(ctx context.Context) error

	// Close releases store resources.
	Close() error
}

Store is the composite store interface that combines all subsystem stores.

type TokenStats 

type TokenStats struct {
	Total         int64            `json:"total"`
	ByType        map[string]int64 `json:"by_type"`
	DistinctTypes int              `json:"distinct_types"`
}

TokenStats includes the entire authorized tenant, independent of pagination.

Source Files

View all Source files

Directories

Path Synopsis
Package mongo provides a MongoDB implementation of the Shield composite store using grove ORM with index-based migrations.
 Package mongo provides a MongoDB implementation of the Shield composite store using grove ORM with index-based migrations.
Package postgres provides a PostgreSQL implementation of the Shield composite store using grove ORM with Go-based migrations.
 Package postgres provides a PostgreSQL implementation of the Shield composite store using grove ORM with Go-based migrations.
Package sqlite provides a SQLite implementation of the Shield composite store using grove ORM with Go-based migrations.
 Package sqlite provides a SQLite implementation of the Shield composite store using grove ORM with Go-based migrations.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.