Affected by GO-2024-3228 and 1 other vulnerabilities

GO-2024-3228: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

license

package

v2.9.4 Latest Latest Go to latest Published: Apr 22, 2024 License: AGPL-3.0 Imports: 13 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/coder/coder

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func Entitlements(ctx context.Context, db database.Store, logger slog.Logger, replicaCount int, ...) (codersdk.Entitlements, error)
func ParseRaw(l string, keys map[string]ed25519.PublicKey) (jwt.MapClaims, error)
type Claims
- func ParseClaims(rawJWT string, keys map[string]ed25519.PublicKey) (*Claims, error)
type Features
type MetricsCollector
- func (mc *MetricsCollector) Collect(metricsCh chan<- prometheus.Metric)
- func (*MetricsCollector) Describe(descCh chan<- *prometheus.Desc)

Constants ¶

View Source

const (
	CurrentVersion        = 3
	HeaderKeyID           = "kid"
	AccountTypeSalesforce = "salesforce"
	VersionClaim          = "version"
)

Variables ¶

View Source

var (
	ValidMethods = []string{"EdDSA"}

	ErrInvalidVersion        = xerrors.New("license must be version 3")
	ErrMissingKeyID          = xerrors.Errorf("JOSE header must contain %s", HeaderKeyID)
	ErrMissingLicenseExpires = xerrors.New("license missing license_expires")
)

Functions ¶

func Entitlements ¶

func Entitlements(
	ctx context.Context,
	db database.Store,
	logger slog.Logger,
	replicaCount int,
	externalAuthCount int,
	keys map[string]ed25519.PublicKey,
	enablements map[codersdk.FeatureName]bool,
) (codersdk.Entitlements, error)

Entitlements processes licenses to return whether features are enabled or not.

func ParseRaw ¶

func ParseRaw(l string, keys map[string]ed25519.PublicKey) (jwt.MapClaims, error)

ParseRaw consumes a license and returns the claims.

Types ¶

type Claims ¶

type Claims struct {
	jwt.RegisteredClaims
	// LicenseExpires is the end of the legit license term, and the start of the grace period, if
	// there is one.  The standard JWT claim "exp" (ExpiresAt in jwt.RegisteredClaims, above) is
	// the end of the grace period (identical to LicenseExpires if there is no grace period).
	// The reason we use the standard claim for the end of the grace period is that we want JWT
	// processing libraries to consider the token "valid" until then.
	LicenseExpires   *jwt.NumericDate `json:"license_expires,omitempty"`
	AccountType      string           `json:"account_type,omitempty"`
	AccountID        string           `json:"account_id,omitempty"`
	Trial            bool             `json:"trial"`
	AllFeatures      bool             `json:"all_features"`
	Version          uint64           `json:"version"`
	Features         Features         `json:"features"`
	RequireTelemetry bool             `json:"require_telemetry,omitempty"`
}

func ParseClaims ¶

func ParseClaims(rawJWT string, keys map[string]ed25519.PublicKey) (*Claims, error)

ParseClaims validates a database.License record, and if valid, returns the claims. If unparsable or invalid, it returns an error

type Features ¶

type Features map[codersdk.FeatureName]int64

type MetricsCollector ¶ added in v2.3.1

type MetricsCollector struct {
	Entitlements atomic.Pointer[codersdk.Entitlements]
}

func (*MetricsCollector) Collect ¶ added in v2.3.1

func (mc *MetricsCollector) Collect(metricsCh chan<- prometheus.Metric)

func (*MetricsCollector) Describe ¶ added in v2.3.1

func (*MetricsCollector) Describe(descCh chan<- *prometheus.Desc)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL