Method ValidateConstraints

model/constraint.go:133–163

ValidateConstraints validates all constraints against the current policy.

()

// ValidateConstraints validates all constraints against the current policy.
func (model Model) ValidateConstraints() error {
	// Check if constraints exist
	if model["c"] == nil || len(model["c"]) == 0 {
		return nil // No constraints to validate
	}

	// Check if RBAC is enabled
	if model["g"] == nil || len(model["g"]) == 0 {
		return errors.ErrConstraintRequiresRBAC
	}

	// Get grouping policy
	gAssertion := model["g"]["g"]
	if gAssertion == nil {
		return errors.ErrConstraintRequiresRBAC
	}

	// Validate each constraint
	for _, assertion := range model["c"] {
		constraint, err := parseConstraint(assertion.Key, assertion.Value)
		if err != nil {
			return fmt.Errorf("%w: %s", errors.ErrConstraintParsingError, err.Error())
		}

		if err := model.validateConstraint(constraint, gAssertion.Policy); err != nil {
			return err
		}
	}

	return nil
}

// validateConstraint validates a single constraint against the policy.
func (model Model) validateConstraint(constraint *Constraint, groupingPolicy [][]string) error {