Documentation
¶
Overview ¶
Package kernelidentity serves the KernelIdentity contract: the kernel side of the identity module. Identity owns accounts and credentials; the kernel owns subscribers (v2_user rows and their entitlements), keeps the identity columns of v2_user as a versioned read projection, and enforces revocations. Only the official identity package, whose signed release declares kernel.identity.v1, may call it.
Index ¶
Constants ¶
const UnusableLegacyPassword = model.UnusableLegacyPassword
UnusableLegacyPassword is stored in v2_user.password for accounts whose credentials live in identity. It never matches a password.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Authorizer ¶
type Authorizer interface {
AuthorizeIdentity(ctx context.Context, host packagebridge.HostIdentity) error
}
Authorizer admits a calling host to KernelIdentity.
type IdentitySettings ¶
type IdentitySettings struct {
Registration RegistrationSettings `json:"registration"`
LoginRateLimit RateLimitSettings `json:"login_rate_limit"`
RegisterRateLimit RateLimitSettings `json:"register_rate_limit"`
AdminMFA map[string]any `json:"admin_mfa"`
TokenLifetimeSeconds int `json:"token_lifetime_seconds"`
LegacyTokenIssuer string `json:"legacy_token_issuer"`
AuthorityState string `json:"authority_state"`
SettingsSchemaVersion int `json:"settings_schema_version"`
}
IdentitySettings is the settings_json document of GetIdentitySettings.
type RateLimitSettings ¶
type RateLimitSettings struct {
Enabled bool `json:"enabled"`
MaxAttempts int `json:"max_attempts"`
WindowSeconds int `json:"window_seconds"`
LockoutSeconds int `json:"lockout_seconds"`
}
RateLimitSettings mirrors one login or registration rate limit.
type RegistrationSettings ¶
type RegistrationSettings struct {
Enabled bool `json:"enabled"`
RequireInvite bool `json:"require_invite"`
AllowedEmailDomains []string `json:"allowed_email_domains"`
BlockedEmailDomains []string `json:"blocked_email_domains"`
}
RegistrationSettings mirrors the kernel's registration policy.
type Server ¶
type Server struct {
DB *gorm.DB
Authorizer Authorizer
// Config returns the current configuration (settings, token lifetime).
Config func() *config.Config
}
Server holds what every host's KernelIdentity calls share.
func (*Server) For ¶
func (s *Server) For(host packagebridge.HostIdentity) kernelidentityv1.KernelIdentityServer
For returns the KernelIdentity server that host reaches; it has the shape of packagebridge.KernelIdentityProvider.
Source Files