Documentation
¶
Overview ¶
Package auth evaluates current authority facts without owning transactions.
Index ¶
- Variables
- func Authenticate(c config.Config, token string, now time.Time) (string, string, error)
- func Binding(c config.Config, principalID, agentID string, now time.Time) *config.Binding
- func BindingByID(c config.Config, id string, now time.Time) *config.Binding
- func Can(c config.Config, principalID, agentID string, task domain.Task, ...) (bool, []string)
- func CanCreate(c config.Config, principalID string, contract domain.Contract, now time.Time) bool
- func CanIssue(c config.Config, principalID string, task domain.Task, grant domain.Grant, ...) bool
- func CreateAuthorization(c config.Config, principalID string, contract domain.Contract, now time.Time) (bool, []string)
- func Horizon(c config.Config, allGrants []domain.Grant, now time.Time) *string
- func IssueAuthorization(c config.Config, principalID string, task domain.Task, grant domain.Grant, ...) (bool, []string)
- func PrepareImport(old *config.Config, desired config.Config, now time.Time) (config.Config, error)
- func TokenHash(token string) string
Constants ¶
This section is empty.
Variables ¶
var ErrUnauthenticated = errors.New("unauthenticated")
Functions ¶
func Authenticate ¶
func Can ¶
func Can(c config.Config, principalID, agentID string, task domain.Task, grants []domain.Grant, action string, now time.Time) (bool, []string)
Can checks one action, independently of lifecycle/CAS guards. It returns the explicit authorization IDs used for audit. A supplied Agent context must be currently bound even when the Principal also has independent Owner rights.
func CreateAuthorization ¶
func CreateAuthorization(c config.Config, principalID string, contract domain.Contract, now time.Time) (bool, []string)
CreateAuthorization returns the authority actually used to create a Task.
func Horizon ¶
Horizon conservatively invalidates cursors at the next configured temporal boundary, including grants that will become effective in the future.
func IssueAuthorization ¶
func IssueAuthorization(c config.Config, principalID string, task domain.Task, grant domain.Grant, now time.Time) (bool, []string)
IssueAuthorization validates the requested grant and the issuer envelope. The caller separately checks current task.read (or atomic creation rights for a new Task).
func PrepareImport ¶
PrepareImport validates a full declarative configuration update. The returned value is safe to persist: bearer values are replaced by hashes, omitted identities remain disabled, and revoked authorization instances retain their tombstones. The caller must commit this result and auth_epoch atomically.
Types ¶
This section is empty.
Source Files