Documentation
¶
Index ¶
Constants ¶
const JWTAudience = "artifact-cas.chainloop"
Variables ¶
var SigningMethod = jwt.SigningMethodES512
Functions ¶
This section is empty.
Types ¶
type Builder ¶
type Builder struct {
// contains filtered or unexported fields
}
func NewBuilder ¶
func (*Builder) GenerateJWT ¶
func (ra *Builder) GenerateJWT(backendType, secretID, audience string, role Role, maxBytes int64, orgID string, opts ...GenerateOpt) (string, error)
GenerateJWT mints a CAS token. All fields are required, including orgID — managed providers (e.g. AWS-S3-ACCESS-POINT) need it to scope per-tenant STS sessions and other providers still record it for audit. The token always carries the CAS audience and a short expiry window.
type Claims ¶
type Claims struct {
jwt.RegisteredClaims
Role Role `json:"role"` // either downloader or uploader
StoredSecretID string `json:"secret-id"` // path to the OCI secret in the vault
BackendType string `json:"backend"` // backend to use, i.e OCI
MaxBytes int64 `json:"maxbytes"` // max bytes to upload
// OrgID identifies the authenticated org this token was minted for.
// Managed providers (e.g. AWS-S3-ACCESS-POINT) require it to scope
// per-tenant STS sessions; the non-managed providers ignore it but
// it is still carried for audit traceability.
OrgID string `json:"org-id"`
// SourceInternal is true when the token was minted for the control plane's
// own CAS client (e.g. attestation storage, policy material reads).
// The CAS skips audit event emission for this traffic so it doesn't
// pollute per-org usage numbers. The zero value (false) means client traffic.
SourceInternal bool `json:"source-internal,omitempty"`
// Digest, when set, scopes the token to a single artifact, i.e sha256:[hex].
// The CAS rejects reads and writes of any other digest. An empty value keeps the
// token valid for every artifact in the backend.
Digest string `json:"digest,omitempty"`
}
func InfoFromAuth ¶ added in v1.98.0
InfoFromAuth extracts the JWT claims from the context, note that the JWT verification has happened in the middleware
func (*Claims) CheckDigest ¶ added in v1.128.0
CheckDigest verifies that the token can read or write the given digest. The digest can be in its full form, i.e sha256:[hex], or only the hex part. Tokens without a digest claim can access any digest.
type GenerateOpt ¶ added in v1.100.4
type GenerateOpt func(c *Claims)
GenerateOpt tweaks optional claims of the minted token
func WithDigest ¶ added in v1.128.0
func WithDigest(digest string) GenerateOpt
WithDigest scopes the token to a single artifact digest
func WithSourceInternal ¶ added in v1.100.4
func WithSourceInternal() GenerateOpt
WithSourceInternal flags the token as minted for the control plane's own CAS client, so the CAS can tell internal traffic apart from client traffic
Source Files