auth

package
v0.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 16, 2026 License: MIT Imports: 10 Imported by: 0

Documentation

Overview

Package auth resolves OpenObserve credentials from configuration or secure storage. The pure credential model (header construction, validation, account keying) lives in the public pkg/auth; this package keeps the config/keychain-coupled resolution and re-exports the moved symbols so existing callers keep working unchanged.

Index

Constants

View Source 
const (
	SchemeBasic   = pkgauth.SchemeBasic
	SchemeToken   = pkgauth.SchemeToken
	SchemeSession = pkgauth.SchemeSession
)

Auth scheme identifiers, re-exported from pkg/auth.

View Source 
const (
	BackendKeychain = "keychain"
	BackendFile     = "file"
)

Backend names reported by Save.

Variables

View Source 
var ErrSecretNotFound = errors.New("secret not found")

ErrSecretNotFound is returned by a Store when no secret exists for an account.

Functions

func AccountKey 

func AccountKey(baseURL, scheme string) string

AccountKey is re-exported from pkg/auth.

func Forget 

func Forget(baseURL, scheme string, store *Store) error

Forget removes any stored secret for the base URL and scheme.

func Save 

func Save(baseURL string, cred Credential, store *Store) (string, error)

Save stores a credential's secret for later resolution and returns the backend ("keychain" or "file") that accepted it.

Types

type Credential 

type Credential = pkgauth.Credential

Credential is re-exported from pkg/auth. Its methods (Header, Decorator, Validate, Redacted) come with the aliased type.

func Resolve 

func Resolve(cfg config.Config, secrets config.Secrets, store *Store) (Credential, error)

Resolve produces a Credential from configuration. A secret supplied via flags/env/.env (carried in secrets) takes precedence; otherwise the secret is loaded from the Store. The returned credential is validated.

type Store 

type Store struct {
	// contains filtered or unexported fields
}

Store persists secrets. It prefers the OS keychain and transparently falls back to a protected file under the config directory when the keychain is unavailable. Windows encrypts the fallback with per-user DPAPI; other platforms retain the existing 0600 file behavior.

func NewStore 

func NewStore(dir string) *Store

NewStore returns a Store whose file fallback lives in dir.

func (*Store) Delete 

func (s *Store) Delete(account string) error

Delete removes the secret for account from both backends. Missing entries are not an error.

func (*Store) Load 

func (s *Store) Load(account string) (string, error)

Load retrieves the secret for account, trying the keychain then the file. It returns ErrSecretNotFound when neither holds a value.

func (*Store) Save 

func (s *Store) Save(account, secret string) (string, error)

Save stores secret for account and returns the backend that accepted it.

type StoreAccessError added in v0.7.0 

type StoreAccessError struct {
	Backend string
	Err     error
}

StoreAccessError means the credential store could not be inspected. It is intentionally distinct from ErrSecretNotFound: a caller must not tell the user to reconfigure credentials when a sandbox merely hid the keychain.

func (*StoreAccessError) Error added in v0.7.0 

func (e *StoreAccessError) Error() string

func (*StoreAccessError) Unwrap added in v0.7.0 

func (e *StoreAccessError) Unwrap() error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.