Kyle Isom
f5e67bd4aa
internal/policy/: Priority-based policy engine per ARCHITECTURE.md §4. Stateless Evaluate() sorts rules by priority, collects all matches, deny-wins over allow, default-deny if no match. Rule matching: all populated fields ANDed, empty fields are wildcards, repository glob via path.Match. Built-in defaults: admin wildcard (all actions), human user content access (pull/push/delete/catalog), version check (always accessible). Engine wrapper with sync.RWMutex-protected cache, SetRules merges with defaults, Reload loads from RuleStore. internal/db/: LoadEnabledPolicyRules() parses rule_json column from policy_rules table into []policy.Rule, filtered by enabled=1, ordered by priority. internal/server/: RequirePolicy middleware extracts claims from context, repo from chi URL param, evaluates policy, returns OCI DENIED (403) on deny with optional audit callback. 69 tests passing across all packages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
48 lines
1.0 KiB
Go
48 lines
1.0 KiB
Go
package policy
|
|
|
|
// allActions lists every Action constant for the admin wildcard rule.
|
|
var allActions = []Action{
|
|
ActionVersionCheck,
|
|
ActionPull,
|
|
ActionPush,
|
|
ActionDelete,
|
|
ActionCatalog,
|
|
ActionPolicyManage,
|
|
}
|
|
|
|
// DefaultRules returns the built-in policy rules per ARCHITECTURE.md §4.
|
|
// Default rules use negative IDs and priority 0.
|
|
func DefaultRules() []Rule {
|
|
return []Rule{
|
|
{
|
|
ID: -1,
|
|
Priority: 0,
|
|
Description: "admin wildcard",
|
|
Effect: Allow,
|
|
Roles: []string{"admin"},
|
|
Actions: allActions,
|
|
},
|
|
{
|
|
ID: -2,
|
|
Priority: 0,
|
|
Description: "human users have full content access",
|
|
Effect: Allow,
|
|
Roles: []string{"user"},
|
|
AccountTypes: []string{"human"},
|
|
Actions: []Action{
|
|
ActionPull,
|
|
ActionPush,
|
|
ActionDelete,
|
|
ActionCatalog,
|
|
},
|
|
},
|
|
{
|
|
ID: -3,
|
|
Priority: 0,
|
|
Description: "version check always accessible",
|
|
Effect: Allow,
|
|
Actions: []Action{ActionVersionCheck},
|
|
},
|
|
}
|
|
}
|