Documentation
¶
Overview ¶
Package auth closes the Brevis interface behind an operator credential.
It exists for a concrete reason: in dev, an anonymous `POST /workflows/<slug>/trigger` answered 303 and started the pipeline. Anyone on the internet could run a `dbt build` that MERGEs into the warehouse. An orchestration interface is a remote control for the warehouse -- leaving it open is the same as publishing the terminal.
The scope is deliberately small: ONE operator credential, from the configuration. There is no user registry, no roles and no multi-user, because none of that exists in the product yet and inventing it here would be building the floor before the wall. What does exist has to be right: a slow derivation hash, a signed session, constant-time comparison.
All stdlib. `crypto/pbkdf2` landed in the standard library in Go 1.24, which removes the need for `x/crypto` for the one piece that was missing.
Index ¶
Constants ¶
const CookieName = "brevis_sessao"
CookieName is the session cookie's name.
const NextParam = "next"
NextParam is the query parameter carrying where the operator was going.
It is a constant because it has two ends -- the redirect that writes it, in this file, and the login screen that reads it, in internal/api -- and they were once different words.
const SessionLifetime = 12 * time.Hour
SessionLifetime is how long a login lasts. A working shift: short enough that a tab forgotten on a laptop does not become permanent access, long enough not to ask for a password in the middle of an investigation.
Variables ¶
This section is empty.
Functions ¶
func CheckPassword ¶ added in v0.7.0
CheckPassword compares the password against the hash in constant time.
Returns false -- and not an error -- for a malformed hash: the caller is on a login path, and the only safe answer there is "did not get in". The configuration error is caught at boot, by Credential.Validate.
func GenerateHash ¶ added in v0.7.0
GenerateHash produces the text that goes into the configuration, as `pbkdf2-sha256$<iterations>$<salt>$<key>`.
The format carries the iteration count with it because that number will change: when we double the cost a few years from now, old hashes have to keep verifying. A format that stores only the digest forces invalidating everyone.
func IntoContext ¶ added in v0.7.0
IntoContext stores the request's operator. The layout uses it to decide whether to show the sign-out button -- an installation with no credential should not display a button that does nothing.
Types ¶
type Credential ¶ added in v0.7.0
type Credential struct {
User string
Hash string
// Secret signs the session cookie. Changing it drops every session, which
// is the emergency lever when a leak is suspected.
Secret []byte
}
Credential is the installation's single operator, coming from the configuration.
func (Credential) Enabled ¶ added in v0.7.0
func (c Credential) Enabled() bool
Enabled says whether a credential is configured.
func (Credential) Validate ¶ added in v0.7.0
func (c Credential) Validate() error
Validate refuses a half-finished configuration.
Half configured is worse than nothing: whoever filled in the username believes they closed the door. Failing at boot is the only way that belief does not last until the incident.
type Gate ¶ added in v0.7.0
type Gate struct {
Cred Credential
Next http.Handler
Login http.Handler // renderiza a tela de login
Insecure bool // plain http: sends the cookie without the Secure flag
}
Gate wraps a handler, requiring a valid session.
The routes that need no session are few and explicit. Kubernetes probes are on that list out of necessity -- a /health that asks for a password kills the pod.
func (*Gate) ServeHTTP ¶ added in v0.7.0
func (p *Gate) ServeHTTP(w http.ResponseWriter, r *http.Request)
func (*Gate) SignIn ¶ added in v0.7.0
func (p *Gate) SignIn(w http.ResponseWriter, user, password string) bool
SignIn checks the credential and writes the cookie. Returns false if it did not match.
func (*Gate) SignOut ¶ added in v0.7.0
func (p *Gate) SignOut(w http.ResponseWriter)
SignOut apaga o cookie.
Source Files