Documentation
¶
Overview ¶
Package replicationauth provides shared identity primitives for trusted server-to-server replication transports.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrTLSUnverified = errors.New("replication peer TLS connection is not verified")
ErrTLSUnverified means a replication receiver did not obtain a verified TLS 1.2-or-newer peer chain. It deliberately rejects clients configured with InsecureSkipVerify: encryption without authenticated peer identity is not a safe replication transport.
Functions ¶
func RequireVerifiedTLS ¶
func RequireVerifiedTLS(state *tls.ConnectionState) error
RequireVerifiedTLS validates the receiver-side transport state shared by HTTPS bootstrap and WSS tail clients. Server-side adapters retain an Authorize callback because deployments may use this package's strict mTLS authorizer or an equivalent private identity system.
Types ¶
type Authorize ¶
Authorize authenticates a server-to-server request and returns its stable durable-consumer name. Transport adapters must never take that name from an untrusted frame, URL, or request header.
func NewMTLSAuthorizer ¶
func NewMTLSAuthorizer(config MTLSConfig) (Authorize, error)
NewMTLSAuthorizer returns an Authorize callback for a net/http server whose TLS configuration requires and verifies client certificates. This function intentionally does not configure TLS itself: callers must set ClientAuth and trusted roots before a request reaches a replication handler.
type MTLSConfig ¶
MTLSConfig maps lowercase SHA-256 fingerprints of already verified peer leaf certificates (over certificate.Raw) to stable durable-consumer names. Fingerprints avoid ambiguous subject/SAN matching and make rotation an explicit configuration change.
Source Files