Documentation
¶
Overview ¶
Package auth models OpenObserve credentials and applies them to outgoing HTTP requests. It is the pure, dependency-light core shared by the CLI and the desktop GUI; configuration and keychain wiring live in their callers.
Index ¶
Constants ¶
const ( // SchemeBasic is HTTP Basic auth: email (username) + password. SchemeBasic = "basic" // SchemeToken is a pre-generated credential sent verbatim in the // Authorization header (the base64 portion of a Basic token, or a full // "Basic ..." / "Bearer ..." value). SchemeToken = "token" // SchemeSession is a browser-captured session: the Secret is a session // envelope (see session.go) carrying the instance cookies replayed on every // request, plus an optional Authorization fallback. Established via o3's // browser sign-in; no service account required. SchemeSession = "session" )
Scheme identifies an authentication scheme.
Variables ¶
This section is empty.
Functions ¶
func AccountKey ¶
AccountKey derives the keychain account identifier for a base URL and scheme. It is stable across runs so credentials can be located later.
func EncodeSession ¶ added in v0.6.0
EncodeSession serializes a Session to the JSON envelope stored as Credential.Secret (and, via the shared keychain, reused by the CLI).
Types ¶
type Credential ¶
type Credential struct {
Scheme string
Username string // basic only (the account email)
Secret string // password (basic), token value (token), or session envelope/cookies (session)
}
Credential is a fully resolved credential ready to authenticate requests.
func (Credential) Decorator ¶
func (c Credential) Decorator() transport.Decorator
Decorator returns a transport.Decorator that authenticates every request.
The basic and token schemes set an Authorization header. The session scheme replays a browser-captured session: it sets the Cookie header (the primary authenticator) and, when the envelope carries one, an Authorization fallback for instances whose REST API expects the header the web SPA sends.
func (Credential) Header ¶
func (c Credential) Header() string
Header returns the Authorization header value for the credential.
OpenObserve authenticates API requests with HTTP Basic auth. For the basic scheme we encode email:password; for the token scheme the user supplies a pre-generated credential — either the already-base64-encoded basic token, or a full "Basic ..." / "Bearer ..." header value, which we pass through verbatim.
func (Credential) Redacted ¶
func (c Credential) Redacted() Credential
Redacted returns a copy safe for logging: the secret is masked.
func (Credential) Validate ¶
func (c Credential) Validate() error
Validate reports whether the credential is internally consistent.
type Session ¶ added in v0.6.0
type Session struct {
Cookies string `json:"cookies"` // "k1=v1; k2=v2"
Authorization string `json:"authorization,omitempty"` // e.g. "Basic ..." / "Bearer ..."
Email string `json:"email,omitempty"`
ExpiresAt time.Time `json:"expiresAt,omitempty"`
}
Session is the decoded form of a SchemeSession credential Secret. It is captured when a user signs in through their instance's own web login page (o3's browser sign-in) and replayed on every request. Cookies is the primary authenticator; Authorization is a fallback for instances whose REST API rejects the browser cookie and expects the header the SPA sends. Email and ExpiresAt are display-only metadata for the connection UI.
func DecodeSession ¶ added in v0.6.0
DecodeSession parses a SchemeSession Secret. Invalid input produces an empty Session; callers that need the parse error should use ParseSession.
func ParseSession ¶ added in v0.6.0
ParseSession parses and validates a SchemeSession Secret. It accepts either the JSON envelope produced by EncodeSession or a bare "k1=v1; k2=v2" cookie string. A captured session must carry at least one replayable credential — cookies, an Authorization header, or both. Requiring cookies specifically was wrong: an instance using native (email + password) login authenticates its own web app with an Authorization header and sets no cookies at all, so a valid capture from one was rejected and browser sign-in could never complete.
Source Files