Help us shape the future of Go! Take the 2026 Go Developer Survey

signin

package
v1.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2026 License: MIT Imports: 30 Imported by: 0

README

Sign-In

Parity grade: B · SDK aws-sdk-go-v2/service/signin@v1.10.4 · last audited 2026-10-24 (7b35a020d)

Coverage

Metric Value
PARITY entries audited 11 (11 ok)
Known gaps 7
Structural gaps (can't be emulated) 1
Deferred items 0
Resource leaks clean
Known gaps
  • Policy evaluation: permission statements are stored and rendered by GetResourcePolicy but never evaluated; the emulator has no console sign-in path they could gate.
  • Statement rendering: Effect, Principal, Action and the condition operators (StringNotEquals, NotIpAddress, ArnNotLike, StringEquals) of the rendered policy are inferred; the SDK documents only the shape.
  • ConsoleAuthorizationConfiguration scope values (ACCOUNT, ORGANIZATION, ROOT) are inferred from the targetId forms; organization and root targets are not validated against the Organizations emulator.
  • ServiceQuotaExceededException, TooManyRequestsError and InternalServerException are never returned: no statement quota or rate limit is published.
  • DPoP key binding of refresh tokens (cnf.jkt) is not modelled; the CreateOAuth2Token SDK shape carries no proof header.
  • Lifetimes (code 10 min, credentials 15 min, refresh 12 h, JWT 1 h) and the error HTTP statuses (401 for expired tokens, 403 for other access denials) follow the SDK docs where stated and are otherwise inferred.
  • SDK endpoint rules ignore BaseEndpoint / AWS_ENDPOINT_URL for control-plane and OAuth operations; clients must set EndpointResolverV2 or resolve signin..api.aws to the emulator.
Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

  • No browser authorize flow or console session: /_gopherstack/signin/authorize is an emulator-only endpoint that mints a code for the calling identity in place of the interactive sign-in page.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrValidation is returned for malformed or out-of-range input.
	ErrValidation = awserr.New("ValidationException", awserr.ErrInvalidParameter)
	// ErrNotFound is returned when the requested resource does not exist.
	ErrNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrConflict is returned when the request conflicts with existing state.
	ErrConflict = awserr.New("ConflictException", awserr.ErrConflict)
	// ErrAccessDenied is returned when the caller or token may not perform the request.
	ErrAccessDenied = errors.New("AccessDeniedException")
)
View Source 
var ErrNilAppContext = errors.New("appContext must not be nil")

ErrNilAppContext is returned when Init is called with a nil application context.

Functions

This section is empty.

Types

type AccessToken 

type AccessToken struct {
	IssuedAt   time.Time `json:"issuedAt"`
	ExpiresAt  time.Time `json:"expiresAt"`
	JTI        string    `json:"jti"`
	Account    string    `json:"account"`
	Subject    string    `json:"subject"`
	UserID     string    `json:"userID"`
	Audience   string    `json:"audience"`
	SessionArn string    `json:"sessionArn"`
}

AccessToken is a JWT access token issued by CreateOAuth2TokenWithIAM.

type AuthCode 

type AuthCode struct {
	ExpiresAt    time.Time `json:"expiresAt"`
	Code         string    `json:"code"`
	ClientID     string    `json:"clientID"`
	RedirectURI  string    `json:"redirectURI"`
	Challenge    string    `json:"challenge"`
	Account      string    `json:"account"`
	PrincipalArn string    `json:"principalArn"`
	UserID       string    `json:"userID"`
	SessionKey   string    `json:"sessionKey,omitempty"`
	Used         bool      `json:"used"`
}

AuthCode is a single-use authorization code awaiting redemption.

type ConsoleAuthorization 

type ConsoleAuthorization struct {
	Scope    string
	TargetID string
	Enabled  bool
}

ConsoleAuthorization is the state returned by the console authorization operations.

type ConsoleConfig 

type ConsoleConfig struct {
	TargetID string `json:"targetID"`
	Scope    string `json:"scope"`
	Enabled  bool   `json:"enabled"`
}

ConsoleConfig is the console authorization configuration of an account or organization target.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
	// contains filtered or unexported fields
}

Handler is the Echo handler for the Sign-In REST-JSON API.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a handler over backend.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations lists the fault-injectable operations.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions lists the regions served.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase service name for fault rules.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name for the request.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(_ *echo.Context) string

ExtractResource returns the primary resource identifier (none for Sign-In).

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations lists the implemented SDK operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all backend state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher matches the Sign-In paths. They carry no service prefix and the token calls are sent unsigned, so the SigV4 signing name, the SDK user agent or the sign-in host is required.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable.

type IAMTokenResult 

type IAMTokenResult struct {
	AccessToken string
	ExpiresIn   int32
}

IAMTokenResult is the CreateOAuth2TokenWithIAM result.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory Sign-In backend. One coarse lock guards all tables.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates an empty backend with a fresh token signing key.

func (*InMemoryBackend) CreateOAuth2Token 

func (b *InMemoryBackend) CreateOAuth2Token(req TokenRequest) (*TokenResult, error)

CreateOAuth2Token redeems an authorization code or refreshes a session.

func (*InMemoryBackend) CreateOAuth2TokenWithIAM 

func (b *InMemoryBackend) CreateOAuth2TokenWithIAM(
	ctx context.Context,
	grantType, resource string,
) (*IAMTokenResult, error)

CreateOAuth2TokenWithIAM exchanges the caller's identity for a resource-scoped JWT access token.

func (*InMemoryBackend) DeleteConsoleAuthorizationConfiguration 

func (b *InMemoryBackend) DeleteConsoleAuthorizationConfiguration(
	ctx context.Context,
	targetID string,
) (*ConsoleAuthorization, error)

DeleteConsoleAuthorizationConfiguration removes the target's configuration.

func (*InMemoryBackend) DeleteResourcePermissionStatement 

func (b *InMemoryBackend) DeleteResourcePermissionStatement(ctx context.Context, sid string) error

DeleteResourcePermissionStatement removes a statement from the caller's policy.

func (*InMemoryBackend) GetConsoleAuthorizationConfiguration 

func (b *InMemoryBackend) GetConsoleAuthorizationConfiguration(
	ctx context.Context,
	targetID string,
) (*ConsoleAuthorization, error)

GetConsoleAuthorizationConfiguration returns the target's configuration.

func (*InMemoryBackend) GetResourcePolicy 

func (b *InMemoryBackend) GetResourcePolicy(ctx context.Context) ([]PolicyStatement, string, error)

GetResourcePolicy returns the caller's consolidated policy document.

func (*InMemoryBackend) IntrospectOAuth2Token 

func (b *InMemoryBackend) IntrospectOAuth2Token(ctx context.Context, token, hint string) (*Introspection, error)

IntrospectOAuth2Token reports the state of an access or refresh token owned by the caller's account.

func (*InMemoryBackend) IssueAuthorizationCode 

func (b *InMemoryBackend) IssueAuthorizationCode(
	ctx context.Context, clientID, redirectURI, challenge, method string,
) (string, error)

IssueAuthorizationCode mints a single-use code bound to the caller, client, redirect URI and PKCE challenge.

func (*InMemoryBackend) ListResourcePermissionStatements 

func (b *InMemoryBackend) ListResourcePermissionStatements(
	ctx context.Context, token string, maxResults int,
) (page.Page[PermissionStatement], error)

ListResourcePermissionStatements pages through the caller's statements.

func (*InMemoryBackend) PutConsoleAuthorizationConfiguration 

func (b *InMemoryBackend) PutConsoleAuthorizationConfiguration(
	ctx context.Context,
	targetID string,
) (*ConsoleAuthorization, error)

PutConsoleAuthorizationConfiguration enables console authorization for the target.

func (*InMemoryBackend) PutResourcePermissionStatement 

func (b *InMemoryBackend) PutResourcePermissionStatement(ctx context.Context, in StatementInput) (string, error)

PutResourcePermissionStatement adds a statement; replays of the same request return the same statement.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the default region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state; the signing key is kept so outstanding JWTs stay verifiable.

func (*InMemoryBackend) ResolvePrincipal 

func (b *InMemoryBackend) ResolvePrincipal(
	_ context.Context,
	accessKeyID, sessionToken string,
) (*awsmeta.Principal, bool)

ResolvePrincipal resolves credentials issued by CreateOAuth2Token to the principal that signed in.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads state produced by Snapshot.

func (*InMemoryBackend) RevokeOAuth2Token 

func (b *InMemoryBackend) RevokeOAuth2Token(ctx context.Context, token string) error

RevokeOAuth2Token revokes a refresh token; unknown, expired or foreign tokens succeed silently.

func (*InMemoryBackend) SetClock 

func (b *InMemoryBackend) SetClock(now func() time.Time)

SetClock replaces the time source (tests).

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON.

type Introspection 

type Introspection struct {
	Iss       string
	Session   string
	Aud       string
	ClientID  string
	UserID    string
	Jti       string
	Sub       string
	TokenType string
	Account   string
	Resource  string
	Nbf       int64
	Iat       int64
	Exp       int64
	Active    bool
}

Introspection is the RFC 7662 result; only Active is set for an inactive token.

type PermissionStatement 

type PermissionStatement struct {
	CreatedAt         time.Time                      `json:"createdAt"`
	Condition         map[string]map[string][]string `json:"condition"`
	Key               string                         `json:"key"`
	Account           string                         `json:"account"`
	SID               string                         `json:"sid"`
	ClientToken       string                         `json:"clientToken"`
	Fingerprint       string                         `json:"fingerprint"`
	ConsoleSourceVpce string                         `json:"consoleSourceVpce,omitempty"`
	ExcludedPrincipal string                         `json:"excludedPrincipal,omitempty"`
	RequestedRegion   string                         `json:"requestedRegion,omitempty"`
	SigninSourceVpce  string                         `json:"signinSourceVpce,omitempty"`
	SourceIP          string                         `json:"sourceIp,omitempty"`
	SourceVpc         string                         `json:"sourceVpc,omitempty"`
	VpcSourceIP       string                         `json:"vpcSourceIp,omitempty"`
}

PermissionStatement is one statement of an account's Sign-In resource-based policy.

type PolicyStatement 

type PolicyStatement struct {
	Condition map[string]map[string][]string
	Principal map[string]string
	Effect    string
	Resource  string
	Action    []string
}

PolicyStatement is one statement of the resource-based policy document.

type Provider 

type Provider struct{}

Provider implements service.Provider for AWS Sign-In.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init creates the backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type Session 

type Session struct {
	CreatedAt        time.Time `json:"createdAt"`
	RefreshExpiresAt time.Time `json:"refreshExpiresAt"`
	CredsExpireAt    time.Time `json:"credsExpireAt"`
	RefreshToken     string    `json:"refreshToken"`
	SessionID        string    `json:"sessionID"`
	Account          string    `json:"account"`
	Region           string    `json:"region"`
	PrincipalArn     string    `json:"principalArn"`
	UserID           string    `json:"userID"`
	ClientID         string    `json:"clientID"`
	AccessKeyID      string    `json:"accessKeyID"`
	SecretKey        string    `json:"secretKey"`
	SessionToken     string    `json:"sessionToken"`
	Revoked          bool      `json:"revoked"`
}

Session is a human OAuth session: a refresh token plus the credentials minted from it.

type StatementInput 

type StatementInput struct {
	ClientToken       string
	ConsoleSourceVpce string
	ExcludedPrincipal string
	RequestedRegion   string
	SigninSourceVpce  string
	SourceIP          string
	SourceVpc         string
	VpcSourceIP       string
}

StatementInput is the PutResourcePermissionStatement request.

type TokenRequest 

type TokenRequest struct {
	ClientID     string
	GrantType    string
	Code         string
	CodeVerifier string
	RedirectURI  string
	RefreshToken string
}

TokenRequest is the CreateOAuth2Token body.

type TokenResult 

type TokenResult struct {
	AccessKeyID  string
	SecretKey    string
	SessionToken string
	RefreshToken string
	IDToken      string
	ExpiresIn    int32
}

TokenResult is the CreateOAuth2Token result.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.