38 lines
1.1 KiB
Go
38 lines
1.1 KiB
Go
|
// Package policy decides whether a given subject (= agent / client identity
|
||
|
|
// from the Pocket ID token) may sign a given key_ref. The in-prod backend is
|
||
|
|
// OPA; the dev-mode backend is AllowAll. OPA wiring is a follow-up subtask.
|
||
|
|
package policy
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"errors"
|
||
|
|
)
|
||
|
|
|
||
|
|
// Decision carries both the boolean verdict and (on deny) a human-readable
|
||
|
|
// reason that the HTTP layer surfaces in the error response.
|
||
|
|
type Decision struct {
|
||
|
|
Allow bool
|
||
|
|
Reason string
|
||
|
|
}
|
||
|
|
|
||
|
|
// Decider abstracts the policy backend.
|
||
|
|
type Decider interface {
|
||
|
|
Allow(ctx context.Context, subject, keyRef string) (Decision, error)
|
||
|
|
}
|
||
|
|
|
||
|
|
// AllowAll permits everything. Dev / CI only. Logs loudly in main.
|
||
|
|
type AllowAll struct{}
|
||
|
|
|
||
|
|
func (AllowAll) Allow(_ context.Context, _, _ string) (Decision, error) {
|
||
|
|
return Decision{Allow: true}, nil
|
||
|
|
}
|
||
|
|
|
||
|
|
// OPA is a stub for the real Rego-backed policy evaluator.
|
||
|
|
type OPA struct{}
|
||
|
|
|
||
|
|
var errNotWired = errors.New("policy.OPA: not wired yet (follow-up subtask)")
|
||
|
|
|
||
|
|
func (OPA) Allow(_ context.Context, _, _ string) (Decision, error) {
|
||
|
|
return Decision{}, errNotWired
|
||
|
|
}
|