auth

package
v0.0.0-...-0186d81 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 10, 2026 License: AGPL-3.0 Imports: 23 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	CallerHeader       = "x-beta9-caller"
	AgentSessionHeader = "x-beta9-agent-session"
)

Variables

View Source 
var (
	ErrWorkerTokenRequired  = status.Error(codes.PermissionDenied, "worker token is required")
	ErrContainerNotAssigned = status.Error(codes.PermissionDenied, "container is not assigned to this worker")
)
View Source 
var EnsureWorkspaceStorage func(ctx context.Context, workspace *types.Workspace) error

EnsureWorkspaceStorage gives a workspace that still has no storage row its bucket and row, and attaches them to the workspace in place. Workspaces created before per-workspace storage existed reach the gateway without one; new workspaces are created with it. The gateway installs the implementation at startup; until then, and in tests, workspaces pass through unchanged.

Functions

func AuthMiddleware 

func AuthMiddleware(backendRepo repository.BackendRepository, workspaceRepo repository.WorkspaceRepository) echo.MiddlewareFunc

func ContextWithAuthInfo 

func ContextWithAuthInfo(ctx context.Context, authInfo *AuthInfo) context.Context

func HasInteractivePermission 

func HasInteractivePermission(authInfo *AuthInfo) bool

HasInteractivePermission limits user-controlled interactive sessions to user and administrator credentials. Worker, machine, and workload tokens must never be able to turn their infrastructure access into an interactive root shell.

func HasPermission 

func HasPermission(authInfo *AuthInfo) bool

func NewServiceCredential 

func NewServiceCredential(workspaceID, appID, consumerID string) (string, string, error)

NewServiceCredential issues an invocation-only bearer credential. Its full value must be saved under the returned secret name; deleting or rotating that secret revokes it immediately. No workspace token is embedded in the value.

func WithAssumedStubAuth 

func WithAssumedStubAuth(next func(ctx echo.Context) error, isPublic func(stubId string) (*types.Workspace, error)) func(ctx echo.Context) error

func WithAuth 

func WithAuth(next func(ctx echo.Context) error) func(ctx echo.Context) error

func WithClusterAdminAuth 

func WithClusterAdminAuth(next func(ctx echo.Context) error) func(ctx echo.Context) error

func WithCredentialAuth 

func WithCredentialAuth(next func(ctx echo.Context) error) func(ctx echo.Context) error

WithCredentialAuth guards routes that reveal or manage credentials, which deploy tokens never need.

func WithStrictWorkspaceAuth 

func WithStrictWorkspaceAuth(next func(ctx echo.Context) error) func(ctx echo.Context) error

This prevents users with restricted tokens from accessing an api endpoint even if they have access to the workspace.

func WithWorkspaceAuth 

func WithWorkspaceAuth(next func(ctx echo.Context) error) func(ctx echo.Context) error

Types

type AuthInfo 

type AuthInfo struct {
	Workspace *types.Workspace
	Token     *types.Token
	// OAuth is present only after resource-server introspection. The backing
	// workspace token never leaves the server; scopes constrain MCP dispatch.
	OAuth *OAuthGrant
	// Request attribution.
	Actor types.EventActor
}

func AuthInfoFromContext 

func AuthInfoFromContext(ctx context.Context) (*AuthInfo, bool)

func (*AuthInfo) TokenId 

func (ai *AuthInfo) TokenId() uint

TokenId is zero for requests without a token.

type AuthInterceptor 

type AuthInterceptor struct {
	// contains filtered or unexported fields
}

func NewAuthInterceptor 

func NewAuthInterceptor(config types.AppConfig, backendRepo repository.BackendRepository, workspaceRepo repository.WorkspaceRepository) *AuthInterceptor

func (*AuthInterceptor) Stream 

func (ai *AuthInterceptor) Stream() grpc.StreamServerInterceptor

func (*AuthInterceptor) Unary 

func (ai *AuthInterceptor) Unary() grpc.UnaryServerInterceptor

type HttpAuthContext 

type HttpAuthContext struct {
	echo.Context
	AuthInfo *AuthInfo
}

type OAuthGrant 

type OAuthGrant struct {
	ClientID string
	Subject  string
	Resource string
	Scopes   []string
}

type RequestAuthorizer 

type RequestAuthorizer interface {
	AuthorizeRequest(context.Context, interface{}) error
}

RequestAuthorizer lets a service enforce resource permissions after token authentication, before either a unary handler or a stream receives a request.

type Signature 

type Signature struct {
	Key       string
	Timestamp int64
}

func SignPayload 

func SignPayload(payload []byte, secretKey string) Signature

type TokenChangeError 

type TokenChangeError string

TokenChangeError is why a caller can't toggle or delete a token. 

const (
	ErrTokenNotFound  TokenChangeError = "invalid token ID"
	ErrPrimaryToken   TokenChangeError = "only a cluster admin can change the primary token"
	ErrProtectedToken TokenChangeError = "worker and cluster admin tokens can't be changed"
)

func (TokenChangeError) Error 

func (e TokenChangeError) Error() string

type Tokens 

type Tokens struct {
	// contains filtered or unexported fields
}

Tokens authenticates API tokens and changes them. Every change also evicts the token from the authorization cache, so it applies to the next request rather than when the cached authorization expires.

func NewTokens 

func NewTokens(backendRepo repository.BackendRepository, workspaceRepo repository.WorkspaceRepository) Tokens

func (Tokens) Authenticate 

func (t Tokens) Authenticate(ctx context.Context, key string) (*types.Token, *types.Workspace, error)

Authenticate returns the active token with this key and its workspace.

func (Tokens) AuthenticateUser 

func (t Tokens) AuthenticateUser(ctx context.Context, key string) (*types.Token, *types.Workspace, error)

AuthenticateUser is Authenticate for APIs that worker tokens can't call. It rejects them before preparing their workspace.

func (Tokens) Delete 

func (t Tokens) Delete(ctx context.Context, caller *types.Token, workspaceID uint, externalID string) error

Delete deletes a token the caller may change.

func (Tokens) Revoke 

func (t Tokens) Revoke(ctx context.Context, externalID string) error

Revoke deactivates a token by its external ID.

func (Tokens) SetDisabledByClusterAdmin 

func (t Tokens) SetDisabledByClusterAdmin(ctx context.Context, workspaceID uint, disabled bool) error

SetDisabledByClusterAdmin disables or re-enables every token in a workspace except cluster admin and cluster worker tokens.

func (Tokens) Toggle 

func (t Tokens) Toggle(ctx context.Context, caller *types.Token, workspaceID uint, externalID string) (types.Token, error)

Toggle activates or deactivates a token the caller may change.

type Worker 

type Worker struct {
	ID        string
	Trusted   bool
	Token     *types.Token
	Workspace *types.Workspace
}

Worker is a caller holding a worker token. Cluster workers are trusted infrastructure that serves every workspace. Private and provider workers run on hardware the platform doesn't control, so they act only in the workspace their token belongs to.

func WorkerFromAuthInfo 

func WorkerFromAuthInfo(authInfo *AuthInfo) (*Worker, error)

func WorkerFromContext 

func WorkerFromContext(ctx context.Context) (*Worker, error)

WorkerFromContext returns the caller when it holds a worker token bound to a worker.

func (*Worker) Container 

func (w *Worker) Container(repo repository.ContainerRepository, containerID string) (*types.ContainerState, error)

Container returns the state of a container assigned to this worker. The error for a missing state is returned as is.

func (*Worker) Containers 

func (w *Worker) Containers(repo repository.ContainerRepository, stubID string) []types.ContainerState

Containers returns the worker's active containers, only those of stubID when it is set.

func (*Worker) InWorkspace 

func (w *Worker) InWorkspace(externalID string) bool

InWorkspace reports whether the worker may act in the workspace with this external ID.

func (*Worker) InWorkspaceID 

func (w *Worker) InWorkspaceID(id uint) bool

InWorkspaceID is InWorkspace for an internal workspace ID.

func (*Worker) Owns 

func (w *Worker) Owns(state *types.ContainerState) bool

Owns reports whether the scheduler assigned the container to this worker. An untrusted worker's containers must also be in its workspace.

func (*Worker) RunsStub 

func (w *Worker) RunsStub(repo repository.ContainerRepository, stubID string) bool

RunsStub reports whether the worker has an active container of the stub.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.