initial commit

internal/auth/scope.go

@@ -0,0 +1,39 @@
+package auth
+
+import (
+	"github.com/kami/maven/internal/ipc"
+)
+
+// Scope — the resolved authority of a caller. Built by Enrollment *once*
+// when a connection is accepted (or once per call, depending on impl), then
+// threaded through Check → Can as pure data. The impure part (looking up the
+// module enrollment table from ipc.Caller Uid+Pid) ends at the Enrollment
+// boundary; everything downstream is pure.
+type Scope struct {
+	// Surface — the channel the caller entered through. Caps the layer.
+	Surface Surface
+
+	// Module — the enrolled module name ("tts", "poll:healthcheck",
+	// "router", "telegram-relay", ""). "" ⇒ unenrolled; Check refuses.
+	// The daemon's in-process path sets "core" by convention.
+	Module string
+
+	// SourceScope — the sources this module may WriteFact under. The spec's
+	// exact "compromised poller can't forge a trigger" guard: a module
+	// only writes sources it owns. The floor enrollment grants "*"
+	// (anything); a real enrollment scopes a poller to one source prefix.
+	// Empty slice ⇒ refuse all writes (fail closed); the daemon never sets
+	// this empty for an enrolled caller.
+	SourceScope []string
+}
+
+// Lookup — the Enroller's input: ipc.Caller when present (Uid/Pid from
+// SO_PEERCRED on the socket), or the zero value for in-process (no Caller
+// attached to ctx — the daemon treats this as SurfaceCoreProcess, "core").
+type Lookup struct {
+	// Caller — when CallerFrom(ctx) is absent (the in-process path), this is
+	// the zero ipc.Caller. The Enrollment floor returns SurfaceCoreProcess in
+	// that case.
+	Caller    ipc.Caller
+	HasCaller bool
+}