elevator

type Broker ¶

type Broker struct {
	// contains filtered or unexported fields
}

Broker orchestrates the token-provider drivers (WORKING NAME — it resolves the `ElevationProvider` collision with §6's privileged-process executor). It registers drivers, instantiates the enabled providers from a EnvironmentConfig, and mints on request. STUB.

func NewBroker() *Broker

func (b *Broker) InitializeFromConfig(environment EnvironmentConfig) error

func (b *Broker) RegisterDriver(driverType string, factory func() TokenProvider)

func (b *Broker) RequestElevation(ctx context.Context, providerName string, ttl time.Duration) (*SecurityToken, error)

type Config ¶

type Config struct {

	// Environments maps an environment name ("dev" / "test" / "stage" / "prod") to its provisioning.
	Environments map[string]EnvironmentConfig `json:"environments" yaml:"environments"`
}

Config is the elevator provider's configuration — the **environment-keyed provisioning** of named offers (WORKING NAME; the devconfig-section integration and the final shape are to be settled — see 6.1's config outline).

PLACEHOLDER SHAPE. The split it encodes: a Requirement (plan-time, saved in the graph) carries a named offer; at run time the named offer is resolved against `Config.Environments[<env>].Offers`; and each environment configures the TokenProviderConfig entries its offers reference. The graph holds *what*; this holds *how*, per environment.

type EnvironmentConfig ¶

type EnvironmentConfig struct {

	// Offers maps a named offer (the graph's `offer_reference_id`) to its realization in THIS environment.
	Offers map[string]Offer `json:"offers" yaml:"offers"`

	// TokenProviders are the provider definitions the offers reference — provider setup, NOT raw long-lived secrets.
	TokenProviders []TokenProviderConfig `json:"token_providers" yaml:"token_providers"`
}

EnvironmentConfig is one environment's offer realizations plus the token-provider definitions they reference. PLACEHOLDER SHAPE.

type Lease ¶

type Lease struct {

	// Provider is the token-provider that granted the elevation.
	Provider string

	// Handle is the lease / JTI handle used to revoke the grant.
	Handle string

	// ExpiresAt is when the grant lapses on its own.
	ExpiresAt time.Time
}

Lease is the compensation state for an acquired elevation — what Provider.CompensateElevate revokes on undo. PLACEHOLDER SHAPE (the "model leases, not just TTL" lesson — see 6.1's prior art).

type Offer ¶

type Offer struct {

	// Strategy selects the elevation mechanism ("host_escalation" | "identity_assumption" | ...).
	Strategy string `json:"strategy" yaml:"strategy"`

	// TokenProvider names the [TokenProviderConfig] that mints this offer's token (empty for `host_escalation`).
	TokenProvider string `json:"token_provider,omitempty" yaml:"token_provider,omitempty"`
}

Offer is the realization of a named offer in an environment: which strategy, and (for `identity_assumption`) which token provider satisfies it. PLACEHOLDER SHAPE.

type Provider ¶

type Provider struct {
	op.ProviderBase
}

Provider is the privilege-elevation provider (WORKING NAME).

It fulfills the elevation policy via two strategies — `ProcessSpawn` (a privileged worker) and `IdentityAssumption` (just-in-time token minting through the Broker). STUB: the methods are unimplemented and the provider is not yet announced.

func NewProvider(runtimeEnvironment *op.RuntimeEnvironment) *Provider

func (p *Provider) CompensateElevate(lease *Lease) error

func (p *Provider) Elevate(requirement Requirement) (token *SecurityToken, lease *Lease, err error)

type Requirement ¶

type Requirement struct {
	OfferReferenceID         string        `json:"offer_reference_id"          yaml:"offer_reference_id"`
	RequestedTTL             time.Duration `json:"requested_ttl"               yaml:"requested_ttl"`
	RequiredContextAssertion []string      `json:"required_context_assertions" yaml:"required_context_assertions"`
}

Requirement is the **plan-time** elevation ask carried on a graph unit/node and saved into the signed graph: a named offer plus its TTL and context assertions. It is environment-agnostic — the same `OfferReferenceID` resolves to a different realization per environment. PLACEHOLDER SHAPE (the home of these fields on the unit/node is to be settled).

type SecurityToken ¶

type SecurityToken struct {

	// Value is the raw secret or signed JWT payload.
	Value string

	// Mechanism names the credential shape ("BEARER" / "AWS_CREDS" / "KUBECONFIG").
	Mechanism string

	// ExpiresAt is the strict clock limit, for fail-fast node evaluation.
	ExpiresAt time.Time

	// MaskedVars are env vars to inject into the target node, masked in logs.
	MaskedVars map[string]string
}

SecurityToken is the unified, pass-by-value token bridged down graph edges into consumer input slots. PLACEHOLDER SHAPE (see 6.1's token bridge).

func (t *SecurityToken) IsExpired() bool

type TokenProvider ¶

type TokenProvider interface {

	// Configure initializes the driver from untyped config properties.
	Configure(properties map[string]any) error

	// MintToken creates an environment-specific token for the requested TTL.
	MintToken(ctx context.Context, ttl time.Duration) (*SecurityToken, error)

	// Type returns the unique driver key (e.g. "aws_sts_assume_role").
	Type() string
}

TokenProvider is the pluggable minting-driver contract every concrete provider (AWS STS, Kubernetes, Vault, SPIFFE/SPIRE, OIDC) implements. STUB.

type TokenProviderConfig ¶

type TokenProviderConfig struct {
	Name                     string         `json:"name"                       yaml:"name"`
	Type                     string         `json:"type"                       yaml:"type"`
	IsEnabled                bool           `json:"is_enabled"                 yaml:"is_enabled"`
	ConnectionTimeoutSeconds int            `json:"connection_timeout_seconds" yaml:"connection_timeout_seconds"`
	ConfigProperties         map[string]any `json:"config_properties"          yaml:"config_properties"`
}

TokenProviderConfig is a token-provider **driver definition** (`aws_sts_assume_role` / `k8s_token_request` / `hashicorp_vault` / ...). `ConfigProperties` carry provider setup (role ARNs, addresses, mount paths) — NOT raw long-lived credentials; the actual credentials come from the host's credential chain. PLACEHOLDER SHAPE.