Documentation
¶
Overview ¶
Package statictoken holds what the hub, the CLI and `cloop hub doctor` must agree on about the static admin token (Task 20406): how it is named without being stored, and when retiring it would leave a hub with no way in.
The static --token / CLOOP_UI_TOKEN is the deployment's own secret: a request presenting it is an administrator outside RBAC, and it never expires. Since Task 20406 it can be retired at runtime — every hub member refuses it within seconds, and nothing it opened stays open — and its last use is reported. Both are keyed by its fingerprint, which is what this package computes.
The comparison of a presented value against the token is not here. It is one function in pkg/ui (Server.checkStaticToken), the only code that holds the value, and tests/arch keeps it the only one.
Index ¶
- Constants
- Variables
- func ActiveAdminTokens(tokens []apitoken.Token, now time.Time) int
- func CheckRetire(sso bool, adminTokens int, force bool) error
- func Fingerprint(value string) string
- func Held(heldAt, now time.Time) bool
- func Instead(sso bool) string
- func Short(fp string) string
- func Valid(fp string) bool
Constants ¶
const HeldWithin = 3 * time.Minute
HeldWithin is how recently a hub process must have reported a token for it to count as held by a running hub: several reports, so one slow flush does not make a running hub's token look abandoned.
const ReportInterval = 30 * time.Second
ReportInterval is how often a hub process holding a static token reports it, with its last use, and re-reads the retirements.
const ShortLen = 12
ShortLen is how many hex characters of a fingerprint are shown to people: 48 bits, enough to tell two tokens apart on one hub.
Variables ¶
var ErrWouldStrand = errors.New("retiring the static token would leave this hub with no way in")
ErrWouldStrand is CheckRetire's refusal: retiring the static token would leave the hub with no way in.
Functions ¶
func ActiveAdminTokens ¶
ActiveAdminTokens counts the API tokens that can administer a hub on their own: active, ordinary (a display-glasses link is confined to the glasses views), carrying the admin role, and bound to no owner — an owner-bound token's authority is intersected with its owner's, which a hub without single sign-on cannot vouch for.
func CheckRetire ¶
CheckRetire refuses a retirement that would strand the hub: one with no single sign-on and no active admin API token, where the static token is the only credential that can administer anything. force overrides it — the operator at the hub's shell can always mint an admin token afterwards with `cloop hub token create --role admin`, and sometimes locking the door first is the point.
func Fingerprint ¶
Fingerprint names a static token without being it: the hex SHA-256 of the value under this package's domain. Deterministic, so a retirement written by one process names the token every other process holds.
Types ¶
This section is empty.
Source Files