policy

type CachingChecker ¶

type CachingChecker struct {
	// contains filtered or unexported fields
}

CachingChecker wraps a Checker with per-request memoization and a fail-closed error policy. It is the only place caching and fail-mode live, so both Checker implementations stay simple. Safe for concurrent use: the proxy calls Check from multiple tunnel goroutines.

Concurrent calls for the same request are coalesced: the first caller runs the inner check while the rest block on the entry's sync.Once, so a popular transitive dependency triggers a single inner check at cold start rather than one per tunnel goroutine.

Lifetime invariant: the cache grows unbounded and is never evicted. It is sized for a single package-manager run (the proxy's lifetime). Callers must not share one CachingChecker across unrelated or long-lived workloads.

func NewCachingChecker(inner Checker, log Logf) *CachingChecker

func (c *CachingChecker) Check(ctx context.Context, r Request) (Result, error)

type Checker ¶

type Checker interface {
	Check(ctx context.Context, req Request) (Result, error)
}

Checker answers policy questions.

func New(client *gitlab.Client) Checker

type Coordinate ¶

type Coordinate struct {
	Ecosystem string // "npm", "pypi", "maven", "gem"
	Name      string
	Version   string
}

Coordinate is the exact package identity a check is performed against.

func (c Coordinate) Key() string

type Logf ¶

type Logf func(format string, a ...any)

Logf logs a diagnostic line. It matches iostreams.IOStreams.LogErrorf so callers can pass io.LogErrorf directly; nil is allowed (no logging).

type Operation ¶

type Operation int

Operation is the package-manager action that triggered a check.

const (
	// Download is an artifact fetch (tarball, wheel, jar, gem).
	Download Operation = iota
	// Upload is a publish/push of a package.
	Upload
)

func (o Operation) String() string

type Request ¶

type Request struct {
	Coordinate Coordinate
	ProjectID  string // project id or full-path slug, from git repo context
	Operation  Operation
}

Request is a single policy question. ProjectID selects the project whose firewall answers it; the REST checker evaluates against this field. Operation records the package-manager action for cache-key isolation and diagnostics; the evaluate API is scoped to project and coordinate only and does not accept an operation, so it is not transmitted.

func (r Request) Key() string

type Result ¶

type Result struct {
	Verdict verdict.Verdict // verdict.Allowed, verdict.Blocked, or verdict.Warning
	Reason  string          // human-readable; used in the 403 body and summary
}

Result is the outcome of a policy check. A zero Verdict (verdict.Allowed) means allow.

func (r Result) Allowed() bool

func (r Result) Blocked() bool

func (r Result) Warned() bool