Help us shape the future of Go! Take the 2026 Go Developer Survey

auth

package
v0.17.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 19, 2026 License: AGPL-3.0 Imports: 44 Imported by: 0

Documentation

Overview

Package auth resolves and reports catalog-acquisition credentials.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func InspectFilePolicyStore added in v0.17.0 

func InspectFilePolicyStore(ctx context.Context, path string, owner PolicyOwner, current EnvironmentPolicy) (resultErr error)

InspectFilePolicyStore validates retained selection policy without writes or credential access. The caller must fence writers and verify the complete inventory before and after inspection. Inspection refuses pending publications. It does not approve replica reuse or acquisition.

func InspectPolicyPublications added in v0.17.0 

func InspectPolicyPublications(ctx context.Context, owner PolicyOwner, current EnvironmentPolicy, files map[string]privatefiles.RetainedFile, read privatefiles.RetainedRecordReader) ([]string, error)

InspectPolicyPublications selects verified staging evidence for inactive retention. The caller preserves these bytes and validates the remaining policy through its owner. Complete legacy stages require the configured owner and policy family. No stage becomes accepted policy.

Types

type Checker 

type Checker struct {
	// contains filtered or unexported fields
}

Checker checks authentication status for providers.

func NewChecker 

func NewChecker(options ...CheckerOption) *Checker

NewChecker creates a new authentication checker.

func (*Checker) CheckProvider 

func (c *Checker) CheckProvider(
	provider *catalogs.Provider,
	supportedMap map[string]bool,
) *Status

CheckProvider checks local catalog-acquisition authentication state.

type CheckerOption added in v0.3.0 

type CheckerOption func(*Checker)

CheckerOption configures a Checker.

func WithCredentialResolver added in v0.3.0 

func WithCredentialResolver(resolver sources.ProviderCredentialResolver) CheckerOption

WithCredentialResolver replaces catalog credential resolution.

type CredentialFieldKey added in v0.4.0 

type CredentialFieldKey struct {
	ProviderID catalogs.ProviderID
	FieldID    catalogs.ProviderCredentialFieldID
}

CredentialFieldKey identifies one deployment-owned provider field policy.

type EnvironmentPolicy added in v0.17.0 

type EnvironmentPolicy string

EnvironmentPolicy identifies the catalog credential selection order. 

const (
	// EnvironmentPolicyLegacy preserves conventional-first lookup for migration checks.
	EnvironmentPolicyLegacy EnvironmentPolicy = "starmap-catalog-v1"
	// EnvironmentPolicyCurrent selects product names before conventional names.
	EnvironmentPolicyCurrent EnvironmentPolicy = "starmap-catalog-v2"
	// EnvironmentPolicyStarportLegacy preserves the original gateway acquisition order.
	EnvironmentPolicyStarportLegacy EnvironmentPolicy = "starport-catalog-v1"
	// EnvironmentPolicyStarportCurrent selects catalog-role names before shared deployment names.
	EnvironmentPolicyStarportCurrent EnvironmentPolicy = "starport-catalog-v2"
)

type FilePolicyStore added in v0.17.0 

type FilePolicyStore struct {
	// contains filtered or unexported fields
}

FilePolicyStore stores immutable default and per-provider policy decisions.

func OpenFilePolicyStore added in v0.17.0 

func OpenFilePolicyStore(ctx context.Context, path string, owner PolicyOwner, initial EnvironmentPolicy) (*FilePolicyStore, error)

OpenFilePolicyStore initializes explicit private storage without reading provider credentials. Existing default policy takes precedence over the initial policy hint.

func (*FilePolicyStore) Accept added in v0.17.0 

func (s *FilePolicyStore) Accept(ctx context.Context, provider catalogs.ProviderID) error

Accept records a provider migration after complete material comparison succeeds.

func (*FilePolicyStore) Policy added in v0.17.0 

func (s *FilePolicyStore) Policy(ctx context.Context, provider catalogs.ProviderID) (EnvironmentPolicy, error)

Policy reads the current default and any accepted provider migration.

type MigrationResolver added in v0.17.0 

type MigrationResolver struct {
	// contains filtered or unexported fields
}

MigrationResolver refuses changed material until the operator resolves the conflicting selection.

func NewMigrationResolver added in v0.17.0 

func NewMigrationResolver(resolver *Resolver, store PolicyStore) (*MigrationResolver, error)

NewMigrationResolver adds persistent selection policy to catalog credential resolution.

func (*MigrationResolver) ResolveCatalog added in v0.17.0 

func (m *MigrationResolver) ResolveCatalog(ctx context.Context, provider *catalogs.Provider) (sources.ProviderCredentialMaterial, error)

ResolveCatalog compares complete handles before recording a legacy provider migration.

type PolicyOwner added in v0.17.0 

type PolicyOwner struct {
	Product    string `json:"product"`
	Deployment string `json:"deployment"`
	Instance   string `json:"instance"`
}

PolicyOwner binds a local policy store to one product deployment and instance.

type PolicyStore added in v0.17.0 

type PolicyStore interface {
	Policy(context.Context, catalogs.ProviderID) (EnvironmentPolicy, error)
	Accept(context.Context, catalogs.ProviderID) error
}

PolicyStore retains the accepted selection policy without credential material.

type ProfileDetails added in v0.4.0 

type ProfileDetails struct {
	ID               catalogs.ProviderCredentialProfileID
	Primitive        catalogs.ProviderAuthenticationPrimitive
	Origins          []sources.ProviderCredentialOrigin
	ResolutionPolicy string
}

ProfileDetails identifies the selected secret-free authentication profile.

type Reference added in v0.4.0 

type Reference struct {
	// contains filtered or unexported fields
}

Reference identifies one operator-selected credential source without containing source authentication values.

func ParseReference added in v0.4.0 

func ParseReference(value string) (Reference, error)

ParseReference parses backend:resource?version=VERSION#field syntax.

type ReferenceBackend added in v0.4.0 

type ReferenceBackend string

ReferenceBackend identifies one credential source primitive.

type ReferencePolicy added in v0.4.0 

type ReferencePolicy struct {
	Reference       Reference
	FallbackAmbient bool
}

ReferencePolicy selects an explicit source and an optional not-configured fallback to ambient discovery.

type Resolver added in v0.4.0 

type Resolver struct {
	// contains filtered or unexported fields
}

Resolver selects catalog-declared authentication primitives and resolves deployment-owned credential sources. It contains no provider roster.

func NewResolver added in v0.4.0 

func NewResolver(options ...ResolverOption) *Resolver

NewResolver creates the built-in catalog credential resolver.

func (*Resolver) ResolveCatalog added in v0.4.0 

func (r *Resolver) ResolveCatalog(
	ctx context.Context,
	provider *catalogs.Provider,
) (sources.ProviderCredentialMaterial, error)

ResolveCatalog resolves the first configured catalog-acquisition profile. A malformed or unavailable selected explicit source is terminal unless its policy permits a not-configured ambient fallback.

type ResolverOption added in v0.4.0 

type ResolverOption func(*Resolver)

ResolverOption configures credential resolution.

func WithEnvironmentLookup added in v0.17.0 

func WithEnvironmentLookup(lookup func(string) (string, bool)) ResolverOption

WithEnvironmentLookup supplies the host environment without reading it during construction.

func WithEnvironmentPolicy added in v0.17.0 

func WithEnvironmentPolicy(policy EnvironmentPolicy) ResolverOption

WithEnvironmentPolicy selects the policy that a migration guard must compare.

func WithReferencePolicies added in v0.4.0 

func WithReferencePolicies(policies map[CredentialFieldKey]ReferencePolicy) ResolverOption

WithReferencePolicies configures deployment-owned field references.

type SourceErrorKind added in v0.4.0 

type SourceErrorKind string

SourceErrorKind classifies a secret-free credential source failure. 

const (
	// SourceErrorNotConfigured means that the selected source has no material.
	SourceErrorNotConfigured SourceErrorKind = "not_configured"
	// SourceErrorDenied means that policy or access controls rejected the request.
	SourceErrorDenied SourceErrorKind = "denied"
	// SourceErrorInvalid means that the source reference or material is invalid.
	SourceErrorInvalid SourceErrorKind = "invalid"
	// SourceErrorUnavailable means that a configured source could not complete.
	SourceErrorUnavailable SourceErrorKind = "unavailable"
)

type State 

type State int

State represents the authentication state of a provider. 

const (
	// StateConfigured means the provider has credentials configured.
	StateConfigured State = iota
	// StateMissing means the provider requires credentials but has none.
	StateMissing
	// StateInvalid means the configured credentials failed validation.
	StateInvalid
	// StateOptional means the provider has optional or no auth requirements.
	StateOptional
	// StateUnsupported means the provider has no client implementation.
	StateUnsupported
)

type Status 

type Status struct {
	State   State
	Summary string
	Profile *ProfileDetails
}

Status represents catalog-acquisition authentication status.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.