server

type Conn struct {
	// Stream is the CEDAR stream for the connection. For authenticated
	// commands it is authenticated (and possibly encrypted) by the time the
	// handler runs; for raw commands it is plaintext.
	Stream *stream.Stream

	// Command is the real HTCondor command being dispatched.
	Command int

	// Negotiation is the result of the security handshake, or nil for raw
	// commands.
	Negotiation *security.SecurityNegotiation

	// Message is the inbound Message the leading command integer was read
	// from. Raw-command handlers read their payload (e.g. a ClassAd) from
	// this message; authenticated handlers normally start a fresh message.
	Message *message.Message

	// RemoteAddr is the peer's network address.
	RemoteAddr string
}

type HandlerFunc func(ctx context.Context, c *Conn) error

type Server struct {
	// SecurityConfig is used for the server side of the security handshake on
	// authenticated commands. It must be non-nil if any authenticated handler
	// is registered.
	SecurityConfig *security.SecurityConfig

	// Authorizer, if set, reports whether an authenticated peer is allowed at a
	// given authorization level. perm is an HTCondor DCpermission name (e.g.
	// "READ", "DAEMON"); peerAddr is the peer's "host:port"; user is the mapped
	// FQU. The server consults it — for every registered authenticated command's
	// levels — to compute the session's ValidCommands after authentication, so a
	// peer can reuse the session for any command it is authorized for. Leaving it
	// nil advertises only the negotiated command (no authorization table applied).
	Authorizer func(perm, peerAddr, user string) bool

	// FQUMapper, if set, maps an authenticated identity to the fully-qualified
	// user to advertise and authorize as (e.g. via a mapfile). Returning "" keeps
	// the authenticated identity. Optional.
	FQUMapper func(authUser, peerAddr string) string
	// contains filtered or unexported fields
}