auth

package
v1.19.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 8, 2026 License: MIT Imports: 15 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var ErrBearerTokenNotConfigured = errors.New("cloud bearer token is not configured")
View Source 
var ErrInvalidDashboardSessionToken = errors.New("invalid dashboard session token")
View Source 
var ErrInvalidPrincipal = errors.New("invalid principal")
View Source 
var ErrManagedTokenRequired = errors.New("managed token is required")
View Source 
var ErrPrincipalDisabled = errors.New("principal is disabled")
View Source 
var ErrProjectNotAllowed = errors.New("project is not allowed for this token")
View Source 
var ErrSecretTooShort = errors.New("jwt secret must be at least 32 bytes")
View Source 
var ErrTokenPepperRequired = errors.New("dedicated cloud token pepper is required")
View Source 
var ErrTokenPepperTooShort = fmt.Errorf("dedicated cloud token pepper must be at least %d bytes", managedTokenPepperMinBytes)
View Source 
var ErrTokenRevoked = errors.New("token is revoked")
View Source 
var ErrUnknownToken = errors.New("unknown token")

Functions

This section is empty.

Types

type LegacyCredentials added in v1.18.0 

type LegacyCredentials struct {
	SyncToken  string
	AdminToken string
}

type ManagedToken added in v1.18.0 

type ManagedToken struct {
	Raw    string
	Prefix string
	Secret string
}

func GenerateManagedToken added in v1.18.0 

func GenerateManagedToken(environment string) (ManagedToken, error)

type ManagedTokenHasher added in v1.18.0 

type ManagedTokenHasher struct {
	// contains filtered or unexported fields
}

func NewManagedTokenHasher added in v1.18.0 

func NewManagedTokenHasher(pepper []byte) (*ManagedTokenHasher, error)

func (*ManagedTokenHasher) Hash added in v1.18.0 

func (h *ManagedTokenHasher) Hash(rawToken string) (string, error)

func (*ManagedTokenHasher) Verify added in v1.18.0 

func (h *ManagedTokenHasher) Verify(rawToken string, verifier string) bool

type ManagedTokenLookup added in v1.18.0 

type ManagedTokenLookup interface {
	FindManagedTokenByHash(ctx context.Context, hash string) (ManagedTokenRecord, Principal, error)
}

type ManagedTokenRecord added in v1.18.0 

type ManagedTokenRecord struct {
	ID          string
	PrincipalID string
	Hash        string
	RevokedAt   *time.Time
}

type Principal added in v1.18.0 

type Principal struct {
	ID          string
	Kind        PrincipalKind
	DisplayName string
	Role        Role
	Enabled     bool
	Source      PrincipalSource
	TokenID     string
}

func (Principal) Validate added in v1.18.0 

func (p Principal) Validate() error

type PrincipalKind added in v1.18.0 

type PrincipalKind string
const (
	PrincipalKindHuman          PrincipalKind = "human"
	PrincipalKindServiceAccount PrincipalKind = "service_account"
	PrincipalKindLegacy         PrincipalKind = "legacy"
)

func (PrincipalKind) String added in v1.18.0 

func (k PrincipalKind) String() string

func (PrincipalKind) Valid added in v1.18.0 

func (k PrincipalKind) Valid() bool

type PrincipalResolver added in v1.18.0 

type PrincipalResolver struct {
	// contains filtered or unexported fields
}

func NewPrincipalResolver added in v1.18.0 

func NewPrincipalResolver(config ResolverConfig) *PrincipalResolver

func (*PrincipalResolver) ResolveBearerToken added in v1.18.0 

func (r *PrincipalResolver) ResolveBearerToken(ctx context.Context, token string) (Principal, error)

type PrincipalSource added in v1.18.0 

type PrincipalSource string
const (
	PrincipalSourceManagedToken   PrincipalSource = "managed_token"
	PrincipalSourceLegacyEnvSync  PrincipalSource = "legacy_env_sync"
	PrincipalSourceLegacyEnvAdmin PrincipalSource = "legacy_env_admin"
	PrincipalSourceBootstrapCLI   PrincipalSource = "bootstrap_cli"
	PrincipalSourceInsecureDev    PrincipalSource = "insecure_dev"
)

func (PrincipalSource) String added in v1.18.0 

func (s PrincipalSource) String() string

func (PrincipalSource) Valid added in v1.18.0 

func (s PrincipalSource) Valid() bool

type ProjectScopeAuthorizer added in v1.13.0 

type ProjectScopeAuthorizer struct {
	// contains filtered or unexported fields
}

func NewProjectScopeAuthorizer added in v1.13.0 

func NewProjectScopeAuthorizer(projects []string) *ProjectScopeAuthorizer

func (*ProjectScopeAuthorizer) AuthorizeProject added in v1.13.0 

func (a *ProjectScopeAuthorizer) AuthorizeProject(project string) error

func (*ProjectScopeAuthorizer) EnrolledProjects added in v1.13.0 

func (a *ProjectScopeAuthorizer) EnrolledProjects() []string

EnrolledProjects returns the sorted list of projects this authorizer allows. Matches the cloudserver.EnrolledProjectsProvider contract so mutation pull can filter server-side by the caller's enrolled projects (REQ-202) rather than fail-closing to an empty result set.

When the wildcard "*" is configured, nil is returned to signal "no project filter" (matching the ListMutationsSince nil-means-all contract).

func (*ProjectScopeAuthorizer) SetAllowedProjects added in v1.13.0 

func (a *ProjectScopeAuthorizer) SetAllowedProjects(projects []string)

type ResolverConfig added in v1.18.0 

type ResolverConfig struct {
	Hasher        *ManagedTokenHasher
	ManagedTokens ManagedTokenLookup
	Legacy        LegacyCredentials
}

type Role added in v1.18.0 

type Role string
const (
	RoleAdmin  Role = "admin"
	RoleMember Role = "member"
)

func (Role) String added in v1.18.0 

func (r Role) String() string

func (Role) Valid added in v1.18.0 

func (r Role) Valid() bool

type Service 

type Service struct {
	// contains filtered or unexported fields
}

func NewService 

func NewService(store *cloudstore.CloudStore, jwtSecret string) (*Service, error)

func (*Service) Authorize added in v1.13.0 

func (s *Service) Authorize(r *http.Request) error

func (*Service) AuthorizeProject added in v1.13.0 

func (s *Service) AuthorizeProject(project string) error

func (*Service) EnrolledProjects added in v1.13.0 

func (s *Service) EnrolledProjects() []string

EnrolledProjects returns the sorted list of projects that this Service is authorized to serve. Used by cloudserver's mutation pull to filter mutations to the caller's enrolled projects (REQ-202).

When the wildcard "*" is configured, nil is returned to signal "no project filter" — callers must treat nil as "allow all" (matching the ListMutationsSince nil-means-all contract).

The interface is cloudserver.EnrolledProjectsProvider; this method makes *Service satisfy it without importing cloudserver (structural assertion).

func (*Service) MintDashboardSession added in v1.13.0 

func (s *Service) MintDashboardSession(bearerToken string) (string, error)

MintDashboardSession returns a signed dashboard session token. The token is opaque to clients and validated by ParseDashboardSession.

func (*Service) ParseDashboardSession added in v1.13.0 

func (s *Service) ParseDashboardSession(sessionToken string) (string, error)

ParseDashboardSession verifies and decodes a signed dashboard session token.

func (*Service) ResolveBearerToken added in v1.18.0 

func (s *Service) ResolveBearerToken(_ context.Context, token string) (Principal, error)

func (*Service) SetAllowedProjects added in v1.13.0 

func (s *Service) SetAllowedProjects(projects []string)

func (*Service) SetBearerToken added in v1.13.0 

func (s *Service) SetBearerToken(token string)

func (*Service) SetDashboardSessionTokens added in v1.13.0 

func (s *Service) SetDashboardSessionTokens(tokens []string)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.