Documentation
¶
Index ¶
- func AllowedAuthenticSources(engine *SafeEngine, subject string) []string
- func AllowedScopes(engine *SafeEngine, subject string) []string
- func BuildSPOCPQuery(service, method, path, subject, authenticSource, scope string) sexp.Element
- func StatusCode(ctx context.Context, err error) int
- type Client
- type DefaultValidator
- type JWKSCache
- type KeySetProvider
- type RateLimiter
- type ResourcePair
- type SafeEngine
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AllowedAuthenticSources ¶ added in v0.5.7
func AllowedAuthenticSources(engine *SafeEngine, subject string) []string
AllowedAuthenticSources returns the distinct authentic_source values the subject is permitted to access. Returns nil for unrestricted access (wildcard rule or no resource rules).
func AllowedScopes ¶ added in v0.5.7
func AllowedScopes(engine *SafeEngine, subject string) []string
AllowedScopes returns the distinct scope values the subject is permitted to access. Returns nil for unrestricted access (wildcard rule or no resource rules).
func BuildSPOCPQuery ¶ added in v0.5.7
BuildSPOCPQuery constructs a SPOCP query S-expression over all six dimensions rules can match on: the service name, the HTTP method and path, the JWT subject, and the requested authentic_source and scope:
(vc (service apigw)(method POST)(path /api/v1/upload)(subject alice@sunet.se)(authentic_source SUNET)(scope eduid))
The service dimension ensures that rules written for one service do not accidentally grant access to another service sharing the same endpoints.
Types ¶
type Client ¶
type Client struct {
Binding *bindingHandler
Middleware *middlewareHandler
Rendering *renderingHandler
TLS *tlsHandler
Server *serverHandler
Validator *validatorHandler
// contains filtered or unexported fields
}
Client is the client object for httphelpers
type DefaultValidator ¶
DefaultValidator is the default validator for httphelpers
func (*DefaultValidator) Engine ¶
func (v *DefaultValidator) Engine() any
Engine satisfy the binding.Validator interface
func (*DefaultValidator) ValidateStruct ¶
func (v *DefaultValidator) ValidateStruct(obj any) error
ValidateStruct satisfies the binding.StructValidator interface
type JWKSCache ¶
type JWKSCache interface {
Get(ctx context.Context, key string) ([]byte, bool)
Set(ctx context.Context, key string, value []byte)
}
JWKSCache is the generic cache interface used to store raw JWKS JSON. It is satisfied by both MemoryCache and MongoCache from pkg/cache.
type KeySetProvider ¶ added in v0.5.10
KeySetProvider provides a parsed JWKS keyset. Implementations handle caching, refresh, and the underlying source (URL or file) transparently.
type RateLimiter ¶
type RateLimiter struct {
// contains filtered or unexported fields
}
RateLimiter implements a fixed-window rate limiter backed by a RateLimitCounter. The counter provides atomic increment, so concurrent requests within the same instance (or across HA instances when backed by MongoDB) are correctly counted.
func NewRateLimiter ¶ added in v0.7.0
func NewRateLimiter(counter cache.RateLimitCounter, requestsPerMinute int) *RateLimiter
NewRateLimiter creates a rate limiter that uses the provided counter for atomic per-IP request counting. Keys are namespaced by route path automatically.
func (*RateLimiter) Middleware ¶
func (rl *RateLimiter) Middleware() gin.HandlerFunc
Middleware returns a Gin middleware handler that enforces rate limiting by client IP.
type ResourcePair ¶ added in v0.5.7
ResourcePair represents an allowed (authentic_source, scope) combination.
func ResolveAllowedResources ¶ added in v0.5.7
func ResolveAllowedResources(engine *SafeEngine, subject string) []ResourcePair
ResolveAllowedResources returns all (authentic_source, scope) pairs that the given subject is authorized for, by inspecting the SPOCP rules directly. A wildcard in the rule position means "any value" — represented as "*" in the result. Returns nil when engine is nil (no authorization configured).
type SafeEngine ¶
SafeEngine is the endpoint-access SPOCP engine type. It is an alias for spocputil.Engine -- the same engine type pkg/issuance uses for credential-issuance policy rules -- so both rule sets are built, validated, and queried through one shared implementation instead of each package maintaining its own copy. Kept as a named alias (rather than updating every call site to spocputil.Engine) since *SafeEngine is threaded through handler signatures across internal/apigw and internal/verifier.
func BuildSPOCPEngine ¶ added in v0.5.7
func BuildSPOCPEngine(cfg model.APIAuth) (*SafeEngine, error)
BuildSPOCPEngine creates a SPOCP engine from the APIAuth rules. Returns nil when no rules are configured (authentication-only mode).
Source Files