Documentation
¶
Overview ¶
Package auth models OpenObserve credentials, resolves them from configuration or secure storage, and applies them to outgoing HTTP requests.
Index ¶
Constants ¶
const ( // SchemeBasic is HTTP Basic auth: email (username) + password. SchemeBasic = "basic" // SchemeToken is a pre-generated credential sent verbatim in the // Authorization header (the base64 portion of a Basic token, or a full // "Basic …" / "Bearer …" value). SchemeToken = "token" )
Scheme identifies an authentication scheme.
const ( BackendKeychain = "keychain" BackendFile = "file" )
Backend names reported by Save.
Variables ¶
var ErrSecretNotFound = errors.New("secret not found")
ErrSecretNotFound is returned by a Store when no secret exists for an account.
Functions ¶
func AccountKey ¶
AccountKey derives the keychain account identifier for a base URL and scheme. It is stable across runs so credentials can be located later.
Types ¶
type Credential ¶
type Credential struct {
Scheme string
Username string // basic only (the account email)
Secret string // password (basic) or token value (token)
}
Credential is a fully resolved credential ready to authenticate requests.
func Resolve ¶
Resolve produces a Credential from configuration. A secret supplied via flags/env/.env (carried in secrets) takes precedence; otherwise the secret is loaded from the Store. The returned credential is validated.
func (Credential) Decorator ¶
func (c Credential) Decorator() transport.Decorator
Decorator returns a transport.Decorator that authenticates every request.
func (Credential) Header ¶
func (c Credential) Header() string
Header returns the Authorization header value for the credential.
OpenObserve authenticates API requests with HTTP Basic auth. For the basic scheme we encode email:password; for the token scheme the user supplies a pre-generated credential — either the already-base64-encoded basic token, or a full "Basic …" / "Bearer …" header value, which we pass through verbatim.
func (Credential) Redacted ¶
func (c Credential) Redacted() Credential
Redacted returns a copy safe for logging: the secret is masked.
func (Credential) Validate ¶
func (c Credential) Validate() error
Validate reports whether the credential is internally consistent.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store persists secrets. It prefers the OS keychain and transparently falls back to a 0600 file under the config directory when the keychain is unavailable (headless Linux, CI, locked keychain).
func (*Store) Delete ¶
Delete removes the secret for account from both backends. Missing entries are not an error.
Source Files