| 199 | } |
| 200 | |
| 201 | func validatePolicyEnforcement(status *action.AttestationStatusResult, bypassPolicyCheck bool) error { |
| 202 | // Block if any of the policies has been configured as a gate. Entries |
| 203 | // flagged Suppress are excluded from the gate count but remain in |
| 204 | // eval.Violations for CAS storage and ingestion (audit trail preserved). |
| 205 | for _, evaluations := range status.PolicyEvaluations { |
| 206 | for _, eval := range evaluations { |
| 207 | if eval.Gate && hasGatingViolation(eval.Violations) { |
| 208 | if bypassPolicyCheck { |
| 209 | logger.Warn().Msg(exceptionBypassPolicyCheck) |
| 210 | continue |
| 211 | } |
| 212 | |
| 213 | return NewGateError(eval.Name) |
| 214 | } |
| 215 | } |
| 216 | } |
| 217 | |
| 218 | // Do a final check in case the operator has configured the attestation |
| 219 | // to be blocked on any policy violation. |
| 220 | if status.MustBlockOnPolicyViolations { |
| 221 | if bypassPolicyCheck { |
| 222 | logger.Warn().Msg(exceptionBypassPolicyCheck) |
| 223 | return nil |
| 224 | } |
| 225 | |
| 226 | } |
| 227 | |
| 228 | return nil |
| 229 | } |