Documentation
¶
Overview ¶
Package auth is the identity port: who is making this request, and may they do what they are asking. The engine never sees a credential; it sees a Principal, which the HTTP layer puts on the context after an Authenticator has produced one. Authorization is a second port, so a deployment can plug in a policy without touching authentication.
The shape follows Kubernetes: an authenticator chain turns a request into a subject with groups (here Roles), and an authorizer decides on (subject, verb, resource). Cartograph ships the no-identity adapters an unauthenticated single-operator deployment needs; a deployment that puts Cartograph behind an authenticating proxy, or wires an OIDC provider, adds an Authenticator and keeps everything else.
Index ¶
- Constants
- Variables
- func Authorize(z Authorizer, next http.Handler) http.Handler
- func Middleware(a Authenticator, next http.Handler) http.Handler
- func WithPrincipal(ctx context.Context, p Principal) context.Context
- type Action
- type AllowAll
- type Authenticator
- type Authorizer
- type Change
- type Grants
- type NoAuthentication
- type Principal
- type Scope
- type Scoper
Constants ¶
const ( VerbRead = identity.VerbRead VerbWrite = identity.VerbWrite ResourceAccess = identity.ResourceAccess ResourceVault = identity.ResourceVault ResourceSession = identity.ResourceSession ResourceAgent = identity.ResourceAgent RoleReader = identity.RoleReader RoleContributor = identity.RoleContributor RoleStrategyEditor = identity.RoleStrategyEditor RoleAdministrator = identity.RoleAdministrator ScopeNone = identity.ScopeNone ScopeTeams = identity.ScopeTeams ScopeAll = identity.ScopeAll )
Verbs, resources, roles and scopes, as identity names them.
Variables ¶
var Anonymous = identity.Anonymous
Anonymous is the principal of a request nobody identified.
var ErrAgentProposes = identity.ErrAgentProposes
ErrAgentProposes refuses an agent what its person must confirm.
var ErrForbidden = identity.ErrForbidden
ErrForbidden is returned by an Authorizer that refuses an action.
var ErrUnauthenticated = errors.New("unauthenticated")
ErrUnauthenticated is returned by an Authenticator that requires a credential and found none, or a bad one.
var Roles = identity.Roles
Roles is every role, from the least to the most a role may do.
Functions ¶
func Authorize ¶
func Authorize(z Authorizer, next http.Handler) http.Handler
Authorize is the one enforcement point: every request through the API is classified and put to the Authorizer, after the Authenticator has put a principal on the context. A refusal is 403 with the contract's problem shape; the handler never runs.
func Middleware ¶
func Middleware(a Authenticator, next http.Handler) http.Handler
Middleware runs a on every request and puts the principal on the context. A request the authenticator refuses gets 401 and never reaches the handler.
Types ¶
type Action ¶
The identity types live in internal/identity, which the engine may import; auth re-exports them so the HTTP side keeps one vocabulary.
func ActionFor ¶
ActionFor classifies a request: its verb from the method, and the manifest it concerns from the path when the path names one (/manifests/{kind}/{id}...). Everything else (the goal tree, the snapshots list, the state manifest) is an action with no kind; the access list, the vault and the session are named as resources.
type Authenticator ¶
Authenticator turns a request into a Principal. Return Anonymous for a request that carries no identity when that is allowed; return ErrUnauthenticated to refuse it.
type Authorizer ¶
type Authorizer = identity.Authorizer
The identity types live in internal/identity, which the engine may import; auth re-exports them so the HTTP side keeps one vocabulary.
type Change ¶ added in v2.2.0
The identity types live in internal/identity, which the engine may import; auth re-exports them so the HTTP side keeps one vocabulary.
type Grants ¶ added in v2.2.0
The identity types live in internal/identity, which the engine may import; auth re-exports them so the HTTP side keeps one vocabulary.
type NoAuthentication ¶
type NoAuthentication struct{}
NoAuthentication identifies nobody: every request is Anonymous. The default for a single-operator deployment on a trusted network.
func (NoAuthentication) Authenticate ¶
func (NoAuthentication) Authenticate(*http.Request) (Principal, error)
Authenticate returns Anonymous.
type Principal ¶
The identity types live in internal/identity, which the engine may import; auth re-exports them so the HTTP side keeps one vocabulary.
func PrincipalFrom ¶
PrincipalFrom returns the principal on ctx, or Anonymous.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package access is the Authorizer for an access list (docs/adr/0011, TAXONOMY.md D27): four roles, each a bundle of permissions, and teams that scope a contributor's work.
|
Package access is the Authorizer for an access list (docs/adr/0011, TAXONOMY.md D27): four roles, each a bundle of permissions, and teams that scope a contributor's work. |
|
Package proxy is the Authenticator for a deployment behind an authenticating reverse proxy (oauth2-proxy, Pomerium, Authelia, an ingress with OIDC): the proxy verifies the person and forwards their identity in a header, and this adapter trusts that header.
|
Package proxy is the Authenticator for a deployment behind an authenticating reverse proxy (oauth2-proxy, Pomerium, Authelia, an ingress with OIDC): the proxy verifies the person and forwards their identity in a header, and this adapter trusts that header. |
|
Package roles is a role-based Authorizer: principals in a write role may read and write, principals in a read role may read, everyone else is refused.
|
Package roles is a role-based Authorizer: principals in a write role may read and write, principals in a read role may read, everyone else is refused. |