Documentation
¶
Index ¶
- Constants
- func AddCodeFlowOCMShareScope(share *ocmv1beta1.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddLightweightAccountScope(role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddMachineScope(scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddOCMShareScope(share *ocmv1beta1.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddOwnerScope(scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddPublicShareScope(share *link.PublicShare, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddReceivedShareScope(share *collaboration.ReceivedShare, role authpb.Role, ...) (map[string]*authpb.Scope, error)
- func AddResourceInfoScope(r *provider.ResourceInfo, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddShareScope(share *collaboration.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func ContextWithMachineScope(ctx context.Context) (context.Context, error)
- func FormatScope(scopeType string, scope *authpb.Scope) (string, error)
- func GetOCMSharesFromScopes(scopes map[string]*authpb.Scope) ([]*ocmv1beta1.Share, error)
- func GetPublicSharesFromScopes(scopes map[string]*authpb.Scope) ([]*link.PublicShare, error)
- func VerifyScope(ctx context.Context, scopeMap map[string]*authpb.Scope, resource any) (bool, error)
- type Verifier
Constants ¶
const MachineScope = "machine"
MachineScope marks a token minted through machine authentication. Machine auth is otherwise indistinguishable from a normal owner-scoped user token, so this marker lets privileged internal RPCs (for example gateway PublishEvent) verify that the caller is a reva daemon holding the machine secret.
Variables ¶
This section is empty.
Functions ¶
func AddCodeFlowOCMShareScope ¶ added in v3.9.0
func AddCodeFlowOCMShareScope(share *ocmv1beta1.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddCodeFlowOCMShareScope adds a shareId/resource-only scope used by code-flow exchanged JWTs. Unlike AddOCMShareScope, it deliberately omits Token so the long-lived shared secret is never embedded in exchanged-token scopes.
func AddLightweightAccountScope ¶
func AddLightweightAccountScope(role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddLightweightAccountScope adds the scope to allow access to lightweight user.
func AddMachineScope ¶ added in v3.12.0
AddMachineScope adds the machine-auth marker scope. It only records that the token was issued via machine auth; resource access still comes from the other scopes on the token.
func AddOCMShareScope ¶
func AddOCMShareScope(share *ocmv1beta1.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddOCMShareScope adds the scope to allow access to an OCM share and the share resource. It carries the share metadata needed to resolve authenticated DAV requests without a second repository lookup, including Token for backward compatibility with legacy direct-secret flows.
func AddOwnerScope ¶
AddOwnerScope adds the default owner scope with access to all resources.
func AddPublicShareScope ¶
func AddPublicShareScope(share *link.PublicShare, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddPublicShareScope adds the scope to allow access to a public share and the shared resource.
func AddReceivedShareScope ¶
func AddReceivedShareScope(share *collaboration.ReceivedShare, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddReceivedShareScope adds the scope to allow access to a received user/group share and the shared resource.
func AddResourceInfoScope ¶
func AddResourceInfoScope(r *provider.ResourceInfo, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddResourceInfoScope adds the scope to allow access to a resource info object.
func AddShareScope ¶
func AddShareScope(share *collaboration.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddShareScope adds the scope to allow access to a user/group share and the shared resource.
func ContextWithMachineScope ¶ added in v3.12.0
ContextWithMachineScope re-signs the caller's token with the machine (reva daemon) scope added, keeping the acting user and any existing scopes unchanged. It lets a reva service call daemon-only RPCs as the real user in the context, without impersonating anyone. The new token is signed with the shared JWT secret, which only reva services hold, so an end user cannot mint one themselves. Returns a context carrying the re-signed token.
func FormatScope ¶
FormatScope create a pretty print of the scope.
func GetOCMSharesFromScopes ¶
GetOCMSharesFromScopes returns all OCM shares in the given scope.
func GetPublicSharesFromScopes ¶
GetPublicSharesFromScopes returns all public shares in the given scope.
Source Files