Documentation
¶
Index ¶
- Constants
- func AddAdminScope(scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddCodeFlowOCMShareScope(share *ocmv1beta1.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddLightweightAccountScope(role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddMachineScope(scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddOCMShareScope(share *ocmv1beta1.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddOwnerScope(scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddPublicShareScope(share *link.PublicShare, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddReceivedShareScope(share *collaboration.ReceivedShare, role authpb.Role, ...) (map[string]*authpb.Scope, error)
- func AddResourceInfoScope(r *provider.ResourceInfo, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func AddShareScope(share *collaboration.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
- func ContextWithMachineScope(ctx context.Context) (context.Context, error)
- func FormatScope(scopeType string, scope *authpb.Scope) (string, error)
- func GetOCMSharesFromScopes(scopes map[string]*authpb.Scope) ([]*ocmv1beta1.Share, error)
- func GetPublicSharesFromScopes(scopes map[string]*authpb.Scope) ([]*link.PublicShare, error)
- func HasAdminScope(scopes map[string]*authpb.Scope) bool
- func IsAdminMethod(method string) bool
- func VerifyScope(ctx context.Context, scopeMap map[string]*authpb.Scope, resource any) (bool, error)
- type MethodResource
- type Verifier
Constants ¶
const MachineScope = "machine"
MachineScope marks a token minted through machine authentication. Machine auth is otherwise indistinguishable from a normal owner-scoped user token, so this marker lets privileged internal RPCs (for example gateway PublishEvent) verify that the caller is a reva daemon holding the machine secret.
Variables ¶
This section is empty.
Functions ¶
func AddAdminScope ¶ added in v3.13.0
AddAdminScope adds the admin scope: a short-lived privilege satisfying Admin API requests and nothing else. The scope map carries "admin" and no "user" key, so the token cannot act on any user's data.
func AddCodeFlowOCMShareScope ¶ added in v3.9.0
func AddCodeFlowOCMShareScope(share *ocmv1beta1.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddCodeFlowOCMShareScope adds a shareId/resource-only scope used by code-flow exchanged JWTs. Unlike AddOCMShareScope, it deliberately omits Token so the long-lived shared secret is never embedded in exchanged-token scopes.
func AddLightweightAccountScope ¶
func AddLightweightAccountScope(role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddLightweightAccountScope adds the scope to allow access to lightweight user.
func AddMachineScope ¶ added in v3.12.0
AddMachineScope adds the machine-auth marker scope. It only records that the token was issued via machine auth; resource access still comes from the other scopes on the token.
func AddOCMShareScope ¶
func AddOCMShareScope(share *ocmv1beta1.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddOCMShareScope adds the scope to allow access to an OCM share and the share resource. It carries the share metadata needed to resolve authenticated DAV requests without a second repository lookup, including Token for backward compatibility with legacy direct-secret flows.
func AddOwnerScope ¶
AddOwnerScope adds the default owner scope with access to all resources.
func AddPublicShareScope ¶
func AddPublicShareScope(share *link.PublicShare, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddPublicShareScope adds the scope to allow access to a public share and the shared resource.
func AddReceivedShareScope ¶
func AddReceivedShareScope(share *collaboration.ReceivedShare, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddReceivedShareScope adds the scope to allow access to a received user/group share and the shared resource.
func AddResourceInfoScope ¶
func AddResourceInfoScope(r *provider.ResourceInfo, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddResourceInfoScope adds the scope to allow access to a resource info object.
func AddShareScope ¶
func AddShareScope(share *collaboration.Share, role authpb.Role, scopes map[string]*authpb.Scope) (map[string]*authpb.Scope, error)
AddShareScope adds the scope to allow access to a user/group share and the shared resource.
func ContextWithMachineScope ¶ added in v3.12.0
ContextWithMachineScope re-signs the caller's token with the machine (reva daemon) scope added, keeping the acting user and any existing scopes unchanged. It lets a reva service call daemon-only RPCs as the real user in the context, without impersonating anyone. The new token is signed with the shared JWT secret, which only reva services hold, so an end user cannot mint one themselves. Returns a context carrying the re-signed token.
func FormatScope ¶
FormatScope create a pretty print of the scope.
func GetOCMSharesFromScopes ¶
GetOCMSharesFromScopes returns all OCM shares in the given scope.
func GetPublicSharesFromScopes ¶
GetPublicSharesFromScopes returns all public shares in the given scope.
func HasAdminScope ¶ added in v3.13.0
HasAdminScope reports whether a token's scopes include the admin scope. Such a token authorizes admin/control resources by capability alone (isAdminResource) and never by the caller's group membership — so its bearer, which may be a synthetic local-root identity unknown to any user provider, must not be subjected to a user-group lookup during token validation.
func IsAdminMethod ¶ added in v3.13.0
IsAdminMethod reports whether a full gRPC method belongs to the Admin API or the control channel. Callers that must exclude these operational RPCs from per-request accounting (e.g. request-activity tracking) use it too.
Types ¶
type MethodResource ¶ added in v3.13.0
type MethodResource string
MethodResource identifies a gRPC call by its full method name. The auth interceptor passes it for a server-streaming call, whose request message is not yet available to type-switch on.
Source Files