events
events
¶
The ClearanceEvent value type.
One flat dataclass carries every event kind the hub fans out to
subscribers. Varlink IDL can't model sum types directly, so the
type field discriminates and the remaining fields are populated
per-kind — the same pattern io.systemd.Resolve.Monitor uses.
The orchestrator-supplied identity bundle that rides on each event —
the Dossier dict — is a
free-form string-to-string map: the wire format treats it as opaque
and the renderer only dereferences the small set of well-known keys
named by the DOSSIER_* constants below.
This module deliberately does not use from __future__ import
annotations: asyncvarlink derives the varlink IDL by reading the raw
dataclasses.fields(...).type of
ClearanceEvent, and under PEP
563 those become strings it can't resolve — so every field silently degrades to
a foreign object. asyncvarlink >=0.3.2 rejects foreign types outright,
turning that degradation into an import-time TypeError. Keep the annotations
as real objects.
VerdictAction = Literal['allow', 'deny']
module-attribute
¶
VERDICT_ACTIONS = ('allow', 'deny')
module-attribute
¶
Dossier = dict[str, str]
module-attribute
¶
DOSSIER_PROJECT = 'project'
module-attribute
¶
DOSSIER_TASK = 'task'
module-attribute
¶
DOSSIER_NAME = 'name'
module-attribute
¶
DOSSIER_CONTAINER_NAME = 'container_name'
module-attribute
¶
ClearanceEvent(type, container, request_id='', dest='', port=0, proto=0, domain='', action='', ok=False, reason='', dossier=dict())
dataclass
¶
One event fanned out to every Subscribe() caller.
type + container are always populated; the remaining fields
are filled in per-kind and default to zero-values otherwise.
Known values of type (additional fields beyond container):
connection_blocked—request_id,dest,port,proto,domain,dossier. Requires an operator verdict.verdict_applied—request_id,action,ok.container_started—dossier.container_exited—reason,dossier.shield_up/shield_down/shield_disengaged—dossier.
Unknown values are forwarded unchanged so the wire format can grow without breaking clients pinned to older schemas.