Documentation
¶
Overview ¶
Package accesspolicy merges per-team session rules into one effective set and answers the questions the API middleware asks on every request.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrInvalidEntry = errors.New("accesspolicy: invalid allowlist entry")
ErrInvalidEntry is returned for an allowlist entry that is neither an IP nor a CIDR.
Functions ¶
func ClientAddr ¶
ClientAddr resolves the caller's address: the TCP peer, or when the peer is a trusted proxy, the rightmost X-Forwarded-For hop that is not one.
Types ¶
type Policy ¶
type Policy struct {
IdleTimeout time.Duration
MaxLifetime time.Duration
IPAllowlist []string
RequireMFA bool
// MaxSessions is the per-user cap on concurrent full sessions; 0 means none.
MaxSessions int
// RejectOnLimit refuses new sessions over the cap instead of evicting the oldest.
RejectOnLimit bool
}
Policy is one team's rules as stored.
type Rules ¶
type Rules struct {
IdleTimeout time.Duration
MaxLifetime time.Duration
// AllowLists holds one list per team that set one; an address must be in every list.
AllowLists [][]netip.Prefix
RequireMFA bool
// MaxSessions is the smallest cap any team sets; 0 means no cap.
MaxSessions int
// RejectOnLimit is true when any team that sets a cap chooses reject.
RejectOnLimit bool
}
Rules is the strictest combination of every policy that applies to a user.
func Merge ¶
Merge combines policies: the shortest non-zero timeouts, MFA if any team requires it, the smallest session cap, and every non-empty allowlist. A bad entry fails the merge.
func (Rules) IPAllowed ¶
IPAllowed reports whether addr satisfies every allowlist. An invalid address never passes a non-empty allowlist.
type Verdict ¶
type Verdict string
Verdict names why a session is refused; empty means allowed.
const ( Allowed Verdict = "" ExpiredIdle Verdict = "session_idle_timeout" ExpiredLifetime Verdict = "session_max_lifetime" AddressNotAllowed Verdict = "ip_not_allowed" MFAEnrollmentNeeds Verdict = "mfa_enrollment_required" SessionEvicted Verdict = "session_evicted" SessionLimit Verdict = "session_limit" )
Refusal reasons, also used as API error codes.
Source Files