gate

type AuditLog struct {
	// contains filtered or unexported fields
}

type CertSource interface {
	Certificate(ctx context.Context, host string) (*tls.Certificate, error)
}

type Config struct {
	Profile string
	// Upstream is the proxy the gate sends through (squid on loopback);
	// nil dials the target itself, refusing private addresses.
	Upstream *url.URL
	Sources  *Sources
	Creds    *Credentials
	Console  Console
	Audit    *AuditLog
	// StatusFile is rewritten when the console state or the pending
	// counts change ("" for none).
	StatusFile string
	// Certs enables MITM; nil decides CONNECTs at the domain.
	Certs CertSource
	// UpstreamTLS verifies the targets (nil: the system roots). The gate
	// never skips verification.
	UpstreamTLS *tls.Config
	// Dial replaces the network dialer (tests).
	Dial func(ctx context.Context, network, addr string) (net.Conn, error)
	// Resolve replaces the resolver of direct mode (tests).
	Resolve func(ctx context.Context, host string) ([]netip.Addr, error)
	// Hub, when set, sends the asks to lockhub (hub mode); the console
	// still serves the policy.
	Hub *Hub
	// Withdrawn, in standalone mode, are the hub tickets the gate's last
	// hub mode left pending and this start withdrew (WithdrawStandalone):
	// the request of one is refused once, explicitly (E_WITHDRAWN).
	Withdrawn *Withdrawn
	// PolicyPoll is how often the policy is fetched (2 s by default).
	PolicyPoll time.Duration
	Now        func() time.Time
	// Log receives operational lines (not the audit).
	Log io.Writer
}

type Console interface {
	Policy(ctx context.Context) (wire.PolicyResult, error)
	// Approve returns nil when approved; a *Refusal when the human (or the
	// timeout) refused; ErrNoConsole when no console answers.
	Approve(ctx context.Context, p wire.ApproveParams) (wire.ApproveResult, error)
}

type Credentials struct {
	// contains filtered or unexported fields
}

type Gate struct {
	// contains filtered or unexported fields
}

type Grants struct {
	// contains filtered or unexported fields
}

type Hub struct {
	Client *hubclient.Client
	Plans  *plans.Store
	// Hosts are the names of the hub on its network and Nets its
	// addresses: the gate refuses them as targets, whatever internal_hosts
	// allows, so that an agent never reaches the hub through the gate.
	Hosts []string
	Nets  []netip.Prefix
	// Poll is how often a held ask looks for its decision (1 s by
	// default); the decisions arrive by the client's long poll.
	Poll time.Duration
	// contains filtered or unexported fields
}

type LockkitConsole struct {
	Profile string
	// Cwd is where the client looks for a project (none: "/").
	Cwd string
	// contains filtered or unexported fields
}

type Outcome struct {
	Approved bool
	Auto     bool
	Code     string
	Reason   string
	// Ticket is the hub ticket an E_PENDING ask waits on (hub mode).
	Ticket string
}

type Queue struct {
	// contains filtered or unexported fields
}

type Refusal struct {
	Code   string
	Reason string
	// Ticket is the hub ticket the refusal is about (hub mode), "" for
	// none.
	Ticket string
}

type Sources struct {
	// contains filtered or unexported fields
}

type Status struct {
	Version            int            `json:"version"`
	Console            string         `json:"console"`
	Pending            int            `json:"pending"`
	PendingByContainer map[string]int `json:"pending_by_container"`
	PolicyFP           string         `json:"policy_fp,omitempty"`
	Updated            string         `json:"updated"`
}

type Withdrawn struct {
	// contains filtered or unexported fields
}