Documentation
¶
Index ¶
- Constants
- func Auth(d AuthDeps) echo.MiddlewareFunc
- func EnforceSessionCSRF(c *echo.Context, expected string) error
- func GetAllowedJobAliases(c *echo.Context) []string
- func GetAuthKey(c *echo.Context) *models.APIKey
- func GetCSRFToken(c *echo.Context) string
- func GetPrincipal(c *echo.Context) *auth.Principal
- func IsPublicAuthPath(path string) bool
- func NormalizeRoutePath(path string) string
- func ParseTrustedProxyRanges(raw string) []*net.IPNet
- func ParseTrustedProxyRangesStrict(raw string) ([]*net.IPNet, error)
- func RequestIsSecure(r *http.Request, trustedProxies []*net.IPNet) bool
- type AuthDeps
- type IPRateLimitConfig
- type IPRateLimiters
Constants ¶
const AgentRoutePrefix = "/v1/agent/"
AgentRoutePrefix is the only route prefix an agent-session credential may reach. Everything outside it is denied outright for agent tokens.
const AgentScopeDenyMessage = "agent session token is scoped to its own incident's /v1/agent/* tool surface"
AgentScopeDenyMessage is the 403 reason returned when an agent-session token is used on any route outside its incident's /v1/agent/* tool surface (a non-agent route, or a different incident's agent route). Exported so the auth and integration tests assert against the single source of truth.
const ApprovalAgentTokenDenyMessage = "agent session tokens may not approve or reject remediation actions"
ApprovalAgentTokenDenyMessage is the 403 reason returned when a per-session agent token (Stream C1) attempts to approve or reject a tier-3 remediation action. An agent may NEVER approve its own proposed action — tier 3 always terminates at a human. Exported so the auth and integration tests assert against the single source of truth.
const ContextKeyAllowedJobAliases = "auth.allowed_job_aliases"
ContextKeyAllowedJobAliases stores the scoped job aliases available to list endpoints.
const ContextKeyAuth = "auth"
ContextKeyAuth is the key used to store the authenticated API key in the Echo context.
const ContextKeyCSRFToken = "auth.csrf_token"
ContextKeyCSRFToken stores the resolved session's CSRF token for handlers.
const ContextKeyPrincipal = "auth.principal"
ContextKeyPrincipal stores the unified authenticated identity for the request.
const ContractsGraphScopedDenyMessage = "contracts graph is a global cross-job query and requires an unscoped principal"
ContractsGraphScopedDenyMessage is the 403 reason returned to a scoped principal on the global, cross-job /v1/contracts/graph route.
const EventsScopedDenyMessage = "event stream requires an in-scope run_id for scoped principals"
EventsScopedDenyMessage is returned when a scoped principal attempts to open the global event stream without a run_id filter. Scoped event subscriptions must resolve to one run owner before any events are streamed.
const LineageImpactScopedDenyMessage = "lineage impact is a global cross-job query and requires an unscoped principal"
LineageImpactScopedDenyMessage is the 403 reason returned to a scoped principal on the global, cross-job /v1/lineage/impact route. Exported so the auth and integration tests assert against the single source of truth.
Variables ¶
This section is empty.
Functions ¶
func Auth ¶
func Auth(d AuthDeps) echo.MiddlewareFunc
Auth returns Echo middleware that enforces API-key or session-cookie authentication and RBAC.
func EnforceSessionCSRF ¶
EnforceSessionCSRF validates the synchronizer CSRF token for cookie-authenticated unsafe requests. Bearer/API-key requests are exempt at the auth middleware call site because they are not ambient browser credentials.
func GetAllowedJobAliases ¶
GetAllowedJobAliases returns the scoped aliases injected by the auth middleware.
func GetAuthKey ¶
GetAuthKey extracts the authenticated API key from the Echo context. Returns nil if no key is present (e.g. unauthenticated endpoints).
func GetCSRFToken ¶
GetCSRFToken returns the session CSRF token stashed by auth middleware, or "".
func GetPrincipal ¶
GetPrincipal returns the unified authenticated identity, or nil if unauthenticated.
func IsPublicAuthPath ¶
IsPublicAuthPath reports whether path is intentionally reachable without the Auth middleware enforcing credentials. Keep RBAC completeness tests on this helper so their public-route exclusions match the middleware.
func NormalizeRoutePath ¶
NormalizeRoutePath returns the policy lookup path used by RBAC for Echo route patterns or raw request paths.
func ParseTrustedProxyRanges ¶
ParseTrustedProxyRanges parses a comma-separated proxy allowlist into IP ranges. Entries may be CIDR ranges or individual IP addresses.
func ParseTrustedProxyRangesStrict ¶
ParseTrustedProxyRangesStrict parses a proxy allowlist and rejects invalid entries. Use it when a proxy list is part of startup security validation.
Types ¶
type AuthDeps ¶
type AuthDeps struct {
Service *auth.Service
Auditor *auth.AuditLogger
Limiter *auth.RateLimiter
Sessions *auth.SessionStore
CookieName string
}
AuthDeps bundles the dependencies the auth middleware needs.
type IPRateLimitConfig ¶
IPRateLimitConfig returns the per-minute rate and burst limit.
type IPRateLimiters ¶
type IPRateLimiters struct {
// contains filtered or unexported fields
}
IPRateLimiters tracks token buckets by source IP.
func NewIPRateLimiters ¶
func NewIPRateLimiters(staleAge time.Duration, config IPRateLimitConfig) *IPRateLimiters
func (*IPRateLimiters) Allow ¶
func (l *IPRateLimiters) Allow(ip string) bool
Source Files