kami
40 lines
1.6 KiB
Go
40 lines
1.6 KiB
Go
package auth
|
|
|
|
import (
|
|
"github.com/kami/maven/internal/ipc"
|
|
)
|
|
|
|
// Scope — the resolved authority of a caller. Built by Enrollment *once*
|
|
// when a connection is accepted (or once per call, depending on impl), then
|
|
// threaded through Check → Can as pure data. The impure part (looking up the
|
|
// module enrollment table from ipc.Caller Uid+Pid) ends at the Enrollment
|
|
// boundary; everything downstream is pure.
|
|
type Scope struct {
|
|
// Surface — the channel the caller entered through. Caps the layer.
|
|
Surface Surface
|
|
|
|
// Module — the enrolled module name ("tts", "poll:healthcheck",
|
|
// "router", "telegram-relay", ""). "" ⇒ unenrolled; Check refuses.
|
|
// The daemon's in-process path sets "core" by convention.
|
|
Module string
|
|
|
|
// SourceScope — the sources this module may WriteFact under. The spec's
|
|
// exact "compromised poller can't forge a trigger" guard: a module
|
|
// only writes sources it owns. The floor enrollment grants "*"
|
|
// (anything); a real enrollment scopes a poller to one source prefix.
|
|
// Empty slice ⇒ refuse all writes (fail closed); the daemon never sets
|
|
// this empty for an enrolled caller.
|
|
SourceScope []string
|
|
}
|
|
|
|
// Lookup — the Enroller's input: ipc.Caller when present (Uid/Pid from
|
|
// SO_PEERCRED on the socket), or the zero value for in-process (no Caller
|
|
// attached to ctx — the daemon treats this as SurfaceCoreProcess, "core").
|
|
type Lookup struct {
|
|
// Caller — when CallerFrom(ctx) is absent (the in-process path), this is
|
|
// the zero ipc.Caller. The Enrollment floor returns SurfaceCoreProcess in
|
|
// that case.
|
|
Caller ipc.Caller
|
|
HasCaller bool
|
|
}
|