access

package

v0.3.1 Latest Latest Go to latest Published: Aug 2, 2026 License: MIT Imports: 9 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/curefatih/afi

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func Hash(raw string) string
func NormalizeKind(kind string) string
func NormalizeSigningKeyAlgorithm(v string) string
func NormalizeSigningKeyStatus(v string) string
func ParseEd25519PublicKeyPEM(publicKeyPEM string) (ed25519.PublicKey, error)
func Prefix(raw string) string
func ValidateKindRules(kind, ownerUserID, projectID, environmentID string) error
func ValidateSigningKeyAlgorithmAndMaterial(algorithm, publicKeyPEM string) error
func ValidateSigningKeyStatus(v string) error
type APIKey
- func CreateAPIKey(ctx context.Context, repo APIKeyRepository, projects ProjectOrgChecker, ...) (*APIKey, error)
- func NewAPIKey(id, orgID, kind, ownerUserID, projectID, environmentID, name, rawKey string, ...) (*APIKey, error)
type APIKeyRepository
type EnvironmentProjectChecker
type KeyKind
- func ParseKeyKind(kind string) (KeyKind, error)
- func (k KeyKind) IsPersonal() bool
- func (k KeyKind) String() string
type ProjectOrgChecker
type SigningKey
- func CreateSigningKey(ctx context.Context, repo SigningKeyRepository, projects ProjectOrgChecker, ...) (*SigningKey, error)
- func NewSigningKey(...) (*SigningKey, error)
- func RotateSigningKey(ctx context.Context, repo SigningKeyRepository, id, publicKeyPEM string) (*SigningKey, error)
- func UpdateSigningKey(ctx context.Context, repo SigningKeyRepository, id, name, status string) (*SigningKey, error)
type SigningKeyRepository

Constants ¶

View Source

const (
	SigningKeyAlgorithmEd25519 = "ed25519"
	SigningKeyStatusActive     = "active"
	SigningKeyStatusDisabled   = "disabled"
)

Variables ¶

This section is empty.

Functions ¶

func Hash ¶

func Hash(raw string) string

Hash returns the persisted key hash.

func NormalizeKind ¶

func NormalizeKind(kind string) string

NormalizeKind defaults empty kind to service_account.

func NormalizeSigningKeyAlgorithm ¶ added in v0.3.0

func NormalizeSigningKeyAlgorithm(v string) string

func NormalizeSigningKeyStatus ¶ added in v0.3.0

func NormalizeSigningKeyStatus(v string) string

func ParseEd25519PublicKeyPEM ¶ added in v0.3.0

func ParseEd25519PublicKeyPEM(publicKeyPEM string) (ed25519.PublicKey, error)

func Prefix ¶

func Prefix(raw string) string

Prefix returns a short display prefix for an API key.

func ValidateKindRules ¶

func ValidateKindRules(kind, ownerUserID, projectID, environmentID string) error

ValidateKindRules enforces personal vs service_account invariants.

func ValidateSigningKeyAlgorithmAndMaterial ¶ added in v0.3.0

func ValidateSigningKeyAlgorithmAndMaterial(algorithm, publicKeyPEM string) error

func ValidateSigningKeyStatus ¶ added in v0.3.0

func ValidateSigningKeyStatus(v string) error

Types ¶

type APIKey ¶

type APIKey struct {
	ID             string    `json:"id"`
	ProjectID      string    `json:"project_id,omitempty"`
	OrganizationID string    `json:"organization_id"`
	EnvironmentID  string    `json:"environment_id,omitempty"`
	Name           string    `json:"name"`
	Kind           string    `json:"kind"`
	OwnerUserID    string    `json:"owner_user_id,omitempty"`
	KeyPrefix      string    `json:"key_prefix"`
	Key            string    `json:"key,omitempty"` // plaintext only on create
	CreatedAt      time.Time `json:"created_at"`
}

APIKey is the write-model virtual API key.

func CreateAPIKey ¶

func CreateAPIKey(
	ctx context.Context,
	repo APIKeyRepository,
	projects ProjectOrgChecker,
	envs EnvironmentProjectChecker,
	id, orgID, kind, ownerUserID, projectID, environmentID, name, rawKey string,
) (*APIKey, error)

CreateAPIKey validates kind/project rules and persists the key.

func NewAPIKey ¶

func NewAPIKey(id, orgID, kind, ownerUserID, projectID, environmentID, name, rawKey string, now time.Time) (*APIKey, error)

NewAPIKey builds a validated key entity (does not check project membership).

type APIKeyRepository ¶

type APIKeyRepository interface {
	ListByProject(ctx context.Context, projectID string) ([]APIKey, error)
	ListByOrg(ctx context.Context, orgID string) ([]APIKey, error)
	Get(ctx context.Context, keyID string) (*APIKey, error)
	Insert(ctx context.Context, key APIKey, keyHash string) error
	Delete(ctx context.Context, keyID string) error
	OrgID(ctx context.Context, keyID string) (string, error)
}

APIKeyRepository persists write-model API keys.

type EnvironmentProjectChecker ¶

type EnvironmentProjectChecker interface {
	EnvironmentBelongsToProject(ctx context.Context, environmentID, projectID, orgID string) error
}

EnvironmentProjectChecker verifies an environment belongs to a project in an org.

type KeyKind ¶

type KeyKind string

KeyKind is a typed API key kind.

const (
	KeyKindPersonal       KeyKind = snapshot.KeyKindPersonal
	KeyKindServiceAccount KeyKind = snapshot.KeyKindServiceAccount
)

func ParseKeyKind ¶

func ParseKeyKind(kind string) (KeyKind, error)

ParseKeyKind validates and returns a KeyKind. Empty defaults to service_account.

func (KeyKind) IsPersonal ¶

func (k KeyKind) IsPersonal() bool

IsPersonal reports whether the kind is personal.

func (KeyKind) String ¶

func (k KeyKind) String() string

type ProjectOrgChecker ¶

type ProjectOrgChecker interface {
	ProjectBelongsToOrg(ctx context.Context, projectID, orgID string) error
}

ProjectOrgChecker verifies a project belongs to an organization.

type SigningKey ¶ added in v0.3.0

type SigningKey struct {
	ID             string    `json:"id"`
	KeyID          string    `json:"key_id"`
	ProjectID      string    `json:"project_id,omitempty"`
	OrganizationID string    `json:"organization_id"`
	EnvironmentID  string    `json:"environment_id,omitempty"`
	Name           string    `json:"name"`
	Algorithm      string    `json:"algorithm"`
	PublicKeyPEM   string    `json:"public_key_pem"`
	Status         string    `json:"status"`
	CreatedAt      time.Time `json:"created_at"`
	UpdatedAt      time.Time `json:"updated_at"`
}

SigningKey is the write-model public verification key for service auth.

func CreateSigningKey ¶ added in v0.3.0

func CreateSigningKey(
	ctx context.Context,
	repo SigningKeyRepository,
	projects ProjectOrgChecker,
	envs EnvironmentProjectChecker,
	id, keyID, orgID, projectID, environmentID, name, algorithm, publicKeyPEM string,
) (*SigningKey, error)

func NewSigningKey ¶ added in v0.3.0

func NewSigningKey(
	id, keyID, orgID, projectID, environmentID, name, algorithm, publicKeyPEM string,
	now time.Time,
) (*SigningKey, error)

func RotateSigningKey ¶ added in v0.3.0

func RotateSigningKey(ctx context.Context, repo SigningKeyRepository, id, publicKeyPEM string) (*SigningKey, error)

func UpdateSigningKey ¶ added in v0.3.0

func UpdateSigningKey(ctx context.Context, repo SigningKeyRepository, id, name, status string) (*SigningKey, error)

type SigningKeyRepository ¶ added in v0.3.0

type SigningKeyRepository interface {
	ListByOrg(ctx context.Context, orgID string) ([]SigningKey, error)
	Get(ctx context.Context, id string) (*SigningKey, error)
	Insert(ctx context.Context, key SigningKey) error
	UpdateMeta(ctx context.Context, id, name, status string) (*SigningKey, error)
	UpdatePublicKey(ctx context.Context, id, publicKeyPEM string) (*SigningKey, error)
	Delete(ctx context.Context, id string) error
	OrgID(ctx context.Context, id string) (string, error)
}

SigningKeyRepository persists service signing keys backed by public keys.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL