Documentation
¶
Overview ¶
Package authmode owns whether the gateway requires a gateway API key.
The mode is one decision with three ways to state it — a configuration value, a command-line flag, and a console switch — and one rule about when it is safe to disable. Every one of those needs the same vocabulary, so the vocabulary lives here rather than being spelled once per package: a mode a reader fails to recognize is merely wrong, but a mode it recognizes when it should not is an open gateway.
Index ¶
Constants ¶
const ( // StorageSchemaVersion identifies the only authentication-mode schema. StorageSchemaVersion = 1 // StoragePrefix is the authentication-mode v1 namespace. StoragePrefix = "authmode:v1:" // StorageKey holds the one stored setting. The mode is deployment-wide, so // there is one record and not a keyed collection. StorageKey = StoragePrefix + "current" )
Variables ¶
var ( // ErrRepositoryRequired reports an absent authentication-mode storage adapter. ErrRepositoryRequired = errors.New("authentication mode storage is required") // ErrNotFound reports that no mode has been stored. ErrNotFound = errors.New("stored authentication mode not found") // ErrConflict reports an authentication-mode revision conflict. ErrConflict = errors.New("authentication mode revision conflict") // ErrCorruptRecord reports invalid durable authentication-mode data. ErrCorruptRecord = errors.New("authentication mode record is invalid") // ErrInvalidMode reports a mode the gateway cannot run in. ErrInvalidMode = errors.New("authentication mode is invalid") )
Functions ¶
func AllowsDisabled ¶
AllowsDisabled reports whether authentication may be off for a gateway bound to bindHost.
An unauthenticated gateway on a reachable address is an open inference endpoint, and the bind address is the only evidence anything has about who can reach it. Turning it off there takes two deliberate acts, so the acknowledgment is a separate argument rather than a wider reading of the address.
This is the one place the rule lives. Startup validation and the runtime switch both call it, because a rule enforced at startup and restated at runtime is a rule with two versions.
func LoopbackAddr ¶
LoopbackAddr reports whether an address in host:port form, such as an http.Request RemoteAddr, reaches only this machine. An address without a port is read as a bare host.
func LoopbackHost ¶
LoopbackHost reports whether a bind address reaches only this machine.
An empty host is not loopback: an empty address binds every interface, which is the exposure the caller is asking about. A name other than localhost is not loopback either, because deciding otherwise would need a DNS lookup whose answer can change after startup, and a resolver is the wrong thing to trust with this question.
func LoopbackOrigin ¶
LoopbackOrigin reports whether a browser Origin header names this machine.
An absent origin is loopback: a request from curl or an SDK carries none, and refusing those would make the header a requirement rather than a check. What the check catches is the origin that is present and names somewhere else, which is a page on another site driving a browser that can reach the gateway.
Types ¶
type Mode ¶
type Mode string
Mode selects whether a request must carry a gateway API key.
const ( // Required refuses every request that carries no valid gateway API key. Required Mode = "required" // Disabled serves every request without checking for a key. The gateway // still meters, governs, and attributes the request; it just has no // caller-supplied name for it. Disabled Mode = "disabled" )
type Policy ¶
type Policy struct {
// contains filtered or unexported fields
}
Policy is the mode the gateway is running under right now.
It exists because the console can change the mode without a restart, and every request has to see the change. Reading a value that was captured when the router was built would make "disabled" mean "disabled at boot", so the authentication middleware reads the policy per request instead.
The zero value and a nil pointer both report Required. A server that never bound a policy authenticates, which is the direction this has to fail in.
type Repository ¶
type Repository interface {
Get(context.Context) (Record, error)
Put(context.Context, Setting, uint64) (Record, error)
}
Repository is the durable authentication-mode contract. A stored mode is what makes a console change outlive the process that accepted it.
type Setting ¶
type Setting struct {
Mode Mode `json:"mode"`
Source Source `json:"source"`
UpdatedAt time.Time `json:"updated_at,omitzero"`
}
Setting is one stated mode and the place it was stated.
func Resolve ¶
Resolve returns the setting the gateway starts under.
A configuration value or a flag is the operator speaking about this process, and it wins: a stored value that silently overrode an explicit STARPORT_SECURITY_AUTH_MODE=required would turn a deployment's own statement into a suggestion, and a stored value that overrode --no-auth would leave an operator with no way to open a gateway whose stored mode they cannot reach to change. The stored value applies exactly when nobody stated anything, which is the case a console change exists to serve.
type Source ¶
type Source string
Source names where the running mode came from. An operator who wants to change the mode has to change the thing that set it, and the four sources are changed in four different places.
const ( // SourceUnset means nobody stated a mode. It is the input to Resolve and // never the answer it returns. SourceUnset Source = "" // SourceDefault means no configuration, flag, or stored value existed. SourceDefault Source = "default" // SourceConfig means a configuration value or environment variable stated it. SourceConfig Source = "config" // SourceFlag means a command-line flag stated it for this process only. SourceFlag Source = "flag" // SourceConsole means an operator changed it at runtime and it was stored. SourceConsole Source = "console" )
Source Files