29 lines
806 B
Go
29 lines
806 B
Go
|
// Package policy decides whether a given subject (= agent / client identity
|
||
|
|
// from the Pocket ID token) may sign a given key_ref. The in-prod backend is
|
||
|
|
// OPA; the dev-mode backend is AllowAll. OPA wiring is a follow-up subtask.
|
||
|
|
package policy
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
)
|
||
|
|
|
||
|
|
// Decision carries both the boolean verdict and (on deny) a human-readable
|
||
|
|
// reason that the HTTP layer surfaces in the error response.
|
||
|
|
type Decision struct {
|
||
|
|
Allow bool
|
||
|
|
Reason string
|
||
|
|
}
|
||
|
|
|
||
|
|
// Decider abstracts the policy backend.
|
||
|
|
type Decider interface {
|
||
|
|
Allow(ctx context.Context, subject, keyRef string) (Decision, error)
|
||
|
|
}
|
||
|
|
|
||
|
|
// AllowAll permits everything. Dev / CI only. Logs loudly in main.
|
||
|
|
type AllowAll struct{}
|
||
|
|
|
||
|
|
func (AllowAll) Allow(_ context.Context, _, _ string) (Decision, error) {
|
||
|
|
return Decision{Allow: true}, nil
|
||
|
|
}
|
||
|
|
|