utils

package

v1.1.0 Latest Latest Go to latest Published: May 6, 2026 License: Apache-2.0 Imports: 35 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Shyntr/shyntr

Links

Documentation ¶

Index ¶

Constants
func FetchAndParseMetadata(ctx context.Context, tenantID string, metadataURL string, ...) (*saml.EntityDescriptor, string, error)
func FormatCertificate(rawCert string) string
func MapClaims(subject string, contextMap map[string]interface{}, ...) map[string]interface{}
func ProjectNormalizedIdentityClaims(loginReq *model.LoginRequest) (map[string]interface{}, bool)
func ProjectNormalizedSAMLAttributes(loginReq *model.LoginRequest) (map[string]interface{}, bool)
func SeedSystemScopesForTenant(ctx context.Context, repo port.ScopeRepository, tenantID string) error
type DefaultKeyManager
type JWKSCache
- func NewJWKSCache(opts ...JWKSCacheOption) *JWKSCache
- func (c *JWKSCache) GetEncryptionKey(ctx context.Context, jwksURI string, alg string) (interface{}, error)
type JWKSCacheOption
type KeyManager
- func NewKeyManager(repo port.CryptoKeyRepository, cfg *config.Config) KeyManager
type Provider
- func NewProvider(db *gorm.DB, baseConfig *fosite.Config, km KeyManager, ...) *Provider
- func (p *Provider) GetFosite(tenantID string) fosite.OAuth2Provider

Constants ¶

View Source

const (
	RotationActiveTTL  = 30 * 24 * time.Hour
	RotationPendingTTL = 1 * time.Hour
	RotationPassiveTTL = 24 * time.Hour
)

View Source

const (
	ContextKeyAllowPrivateJWKSIPs jwksContextKey = "allow_private_jwks_ips"
)

View Source

const SAMLNameIDSubjectAttribute = "__shyntr_saml_nameid_subject"

Variables ¶

This section is empty.

Functions ¶

func FetchAndParseMetadata ¶

func FetchAndParseMetadata(
	ctx context.Context,
	tenantID string,
	metadataURL string,
	outbound port.OutboundGuard,
) (*saml.EntityDescriptor, string, error)

func FormatCertificate ¶

func FormatCertificate(rawCert string) string

func MapClaims ¶

func MapClaims(subject string, contextMap map[string]interface{}, grantedScopes []*model.Scope) map[string]interface{}

MapClaims filters the raw context map based on requested scopes and tenant context.

func ProjectNormalizedIdentityClaims ¶ added in v1.1.0

func ProjectNormalizedIdentityClaims(loginReq *model.LoginRequest) (map[string]interface{}, bool)

func ProjectNormalizedSAMLAttributes ¶ added in v1.1.0

func ProjectNormalizedSAMLAttributes(loginReq *model.LoginRequest) (map[string]interface{}, bool)

ProjectNormalizedSAMLAttributes returns the conservative SAML projection for a persisted normalized login context.

func SeedSystemScopesForTenant ¶

func SeedSystemScopesForTenant(ctx context.Context, repo port.ScopeRepository, tenantID string) error

Types ¶

type DefaultKeyManager ¶

type DefaultKeyManager struct {
	// contains filtered or unexported fields
}

func (*DefaultKeyManager) GetActiveKeys ¶

func (km *DefaultKeyManager) GetActiveKeys(ctx context.Context, use string) (*rsa.PrivateKey, *x509.Certificate, string, error)

func (*DefaultKeyManager) GetActivePrivateKey ¶

func (km *DefaultKeyManager) GetActivePrivateKey(ctx context.Context, use string) (*rsa.PrivateKey, string, error)

func (*DefaultKeyManager) GetDecryptionKeys ¶

func (km *DefaultKeyManager) GetDecryptionKeys(ctx context.Context) (map[string]*rsa.PrivateKey, error)

func (*DefaultKeyManager) GetPublicJWKS ¶

func (km *DefaultKeyManager) GetPublicJWKS(ctx context.Context) (*jose.JSONWebKeySet, error)

func (*DefaultKeyManager) ImportKey ¶

func (km *DefaultKeyManager) ImportKey(ctx context.Context, use string, privKey *rsa.PrivateKey, certPEM []byte) (*model.CryptoKey, error)

func (*DefaultKeyManager) RotateKeys ¶

func (km *DefaultKeyManager) RotateKeys(ctx context.Context) error

type JWKSCache ¶

type JWKSCache struct {
	// contains filtered or unexported fields
}

func NewJWKSCache ¶

func NewJWKSCache(opts ...JWKSCacheOption) *JWKSCache

func (*JWKSCache) GetEncryptionKey ¶

func (c *JWKSCache) GetEncryptionKey(ctx context.Context, jwksURI string, alg string) (interface{}, error)

GetEncryptionKey fetches or retrieves a cached key matching the algorithm.

type JWKSCacheOption ¶

type JWKSCacheOption func(*JWKSCache)

func WithClock ¶

func WithClock(clock func() time.Time) JWKSCacheOption

func WithGracePeriod ¶

func WithGracePeriod(grace time.Duration) JWKSCacheOption

func WithHTTPClient ¶

func WithHTTPClient(client *http.Client) JWKSCacheOption

func WithJWKSURIValidator ¶

func WithJWKSURIValidator(validator func(context.Context, string) error) JWKSCacheOption

func WithTTL ¶

func WithTTL(ttl time.Duration) JWKSCacheOption

type KeyManager ¶

type KeyManager interface {
	GetActivePrivateKey(ctx context.Context, use string) (*rsa.PrivateKey, string, error)
	GetDecryptionKeys(ctx context.Context) (map[string]*rsa.PrivateKey, error)
	GetPublicJWKS(ctx context.Context) (*jose.JSONWebKeySet, error)
	GetActiveKeys(ctx context.Context, use string) (*rsa.PrivateKey, *x509.Certificate, string, error)
	RotateKeys(ctx context.Context) error
	ImportKey(ctx context.Context, use string, privKey *rsa.PrivateKey, certPEM []byte) (*model.CryptoKey, error)
}

func NewKeyManager ¶

func NewKeyManager(repo port.CryptoKeyRepository, cfg *config.Config) KeyManager

type Provider ¶

type Provider struct {
	// contains filtered or unexported fields
}

func NewProvider ¶

func NewProvider(db *gorm.DB, baseConfig *fosite.Config, km KeyManager, clientRepo port.OAuth2ClientRepository, jtiRepo port.BlacklistedJTIRepository) *Provider

func (*Provider) GetFosite ¶

func (p *Provider) GetFosite(tenantID string) fosite.OAuth2Provider

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL