Documentation
¶
Index ¶
- Constants
- Variables
- type API
- type AuthMiddleware
- type AuthorizerInterface
- type ClientInterface
- type DatabaseInterface
- type HookContext
- type Service
- func (s *Service) AuthorizeRequest(ctx context.Context, user User, req oauth2.TokenHookRequest, ...) (bool, error)
- func (s *Service) FetchUserGroups(ctx context.Context, user User) ([]*types.Group, error)
- func (s *Service) ProcessRequest(ctx context.Context, user User, req oauth2.TokenHookRequest) (*HookContext, error)
- type ServiceInterface
- type StorageHookGroupsClient
- type TenantValidatorInterface
- type User
Constants ¶
const ( GrantTypeClientCredentials string = "client_credentials" GrantTypeJWTBearer string = "urn:ietf:params:oauth:grant-type:jwt-bearer" )
Variables ¶
var ErrTooBusy = errors.New("worker pool is full")
ErrTooBusy is returned by ProcessRequest when the worker pool queue is full.
Functions ¶
This section is empty.
Types ¶
type API ¶
type API struct {
// contains filtered or unexported fields
}
func NewAPI ¶
func NewAPI( service ServiceInterface, middleware *AuthMiddleware, tracer tracing.TracingInterface, monitor monitoring.MonitorInterface, logger logging.LoggerInterface, ) *API
NewAPI creates a new API handler for the Hydra token hook endpoint.
func (*API) RegisterEndpoints ¶
RegisterEndpoints registers the Hydra token hook endpoint on the given router.
type AuthMiddleware ¶
type AuthMiddleware struct {
// contains filtered or unexported fields
}
func NewAuthMiddleware ¶
func NewAuthMiddleware(token string, tracer tracing.TracingInterface, logger logging.LoggerInterface) *AuthMiddleware
func (*AuthMiddleware) AuthMiddleware ¶
func (m *AuthMiddleware) AuthMiddleware(next http.Handler) http.Handler
type AuthorizerInterface ¶ added in v1.0.2
type ClientInterface ¶
type DatabaseInterface ¶ added in v1.0.2
type HookContext ¶ added in v1.3.0
type HookContext struct {
// Groups is the list of groups the user belongs to.
Groups []*types.Group
// TenantID is the tenant the request is scoped to, or empty if none.
TenantID string
}
HookContext contains the enriched result of processing an OAuth token hook request. It is returned by ProcessRequest on success.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func NewService ¶
func NewService( clients []ClientInterface, authz AuthorizerInterface, tenantValidator TenantValidatorInterface, wpool pool.WorkerPoolInterface, tracer tracing.TracingInterface, monitor monitoring.MonitorInterface, logger logging.LoggerInterface, ) *Service
func (*Service) AuthorizeRequest ¶ added in v1.0.2
func (s *Service) AuthorizeRequest( ctx context.Context, user User, req oauth2.TokenHookRequest, groups []*types.Group, ) (bool, error)
This implements deny by default TODO: we should make this configurable
func (*Service) FetchUserGroups ¶
func (*Service) ProcessRequest ¶ added in v1.3.0
func (s *Service) ProcessRequest(ctx context.Context, user User, req oauth2.TokenHookRequest) (*HookContext, error)
ProcessRequest orchestrates an OAuth token hook request. FetchUserGroups and (when a tenant is present) ValidateMembership are dispatched to the worker pool concurrently. AuthorizeRequest is gated only on FetchUserGroups, so tenant validation proceeds in parallel with authorization. Returns ErrTooBusy when the pool queue is full; all other errors indicate an authorization failure.
type ServiceInterface ¶
type ServiceInterface interface {
ProcessRequest(context.Context, User, oauth2.TokenHookRequest) (*HookContext, error)
}
type StorageHookGroupsClient ¶ added in v1.0.2
type StorageHookGroupsClient struct {
// contains filtered or unexported fields
}
func NewLocalStorageClient ¶ added in v1.0.2
func NewLocalStorageClient(db DatabaseInterface, tracer tracing.TracingInterface, monitor monitoring.MonitorInterface, logger logging.LoggerInterface) *StorageHookGroupsClient
NewLocalStorageClient creates a new StorageHookGroupsClient.
func (*StorageHookGroupsClient) FetchUserGroups ¶ added in v1.0.2
func (c *StorageHookGroupsClient) FetchUserGroups(ctx context.Context, user User) ([]*types.Group, error)
FetchUserGroups retrieves user groups from the local storage database.
type TenantValidatorInterface ¶ added in v1.3.0
type TenantValidatorInterface interface {
ValidateMembership(ctx context.Context, identityID, tenantID string) error
}
TenantValidatorInterface validates that a user is an active member of a tenant. See internal/tenants for the real and noop implementations.
Source Files