Documentation
¶
Overview ¶
Package inmem implements an in-memory adminauth.Store for tests and development.
Design ¶
Principals, token digests and policies follow the shared adminauthtest contract. Data lasts only for the process lifetime and is not sealed. The reference server selects this backend when configured without persistent storage; deployments requiring persistent credentials and policy use server/adminauth/sqlstore.
References ¶
- Decision record: https://github.com/deploymenttheory/go-apple-dm/blob/main/docs/research/decisions/0034-admin-api-and-authorization.md
- Contract suite: adminauth/adminauthtest
Index ¶
- type Store
- func (s *Store) ApplyPrincipal(_ context.Context, name string, change adminauth.PrincipalChange, ...) (adminauth.Principal, error)
- func (s *Store) BootstrapPrincipal(_ context.Context, p adminauth.Principal, digest string, now time.Time) (adminauth.Principal, error)
- func (s *Store) CountRoot(_ context.Context) (int, error)
- func (s *Store) CreatePrincipal(_ context.Context, p adminauth.Principal, digest string, now time.Time) (adminauth.Principal, error)
- func (s *Store) DeletePolicy(_ context.Context, name string) error
- func (s *Store) DeletePrincipal(_ context.Context, name string) error
- func (s *Store) DeleteRole(_ context.Context, name string) error
- func (s *Store) GetPolicy(_ context.Context, name string) (adminauth.Policy, error)
- func (s *Store) Initialized(_ context.Context) (bool, error)
- func (s *Store) Policies(_ context.Context) ([]adminauth.Policy, error)
- func (s *Store) PolicyVersion(_ context.Context) (int64, error)
- func (s *Store) Principal(_ context.Context, name string) (adminauth.Principal, error)
- func (s *Store) PrincipalByDigest(_ context.Context, digest string) (adminauth.Principal, error)
- func (s *Store) Principals(_ context.Context, p adminauth.Page) (adminauth.Result[adminauth.Principal], error)
- func (s *Store) PutPolicy(_ context.Context, p adminauth.Policy, now time.Time) (adminauth.Policy, error)
- func (s *Store) PutRole(_ context.Context, role adminauth.Role, now time.Time) (adminauth.Role, error)
- func (s *Store) RevokeToken(_ context.Context, name string, now time.Time) error
- func (s *Store) Role(_ context.Context, name string) (adminauth.Role, error)
- func (s *Store) Roles(_ context.Context, p adminauth.Page) (adminauth.Result[adminauth.Role], error)
- func (s *Store) SetToken(_ context.Context, name, digest, tokenID string, expires, now time.Time) (adminauth.Principal, error)
- func (s *Store) UpdatePrincipal(_ context.Context, name string, roles []string, root bool, now time.Time) (adminauth.Principal, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store keeps principals and policies in memory. It is safe for concurrent use.
func (*Store) ApplyPrincipal ¶
func (s *Store) ApplyPrincipal(_ context.Context, name string, change adminauth.PrincipalChange, now time.Time) (adminauth.Principal, error)
ApplyPrincipal commits a mutation and the last-active-root check under one lock.
func (*Store) BootstrapPrincipal ¶ added in v0.10.0
func (s *Store) BootstrapPrincipal(_ context.Context, p adminauth.Principal, digest string, now time.Time) (adminauth.Principal, error)
BootstrapPrincipal atomically installs the first active root credential and closes bootstrap. It requires an empty, uninitialized principal store and receives only the credential digest.
func (*Store) CreatePrincipal ¶
func (s *Store) CreatePrincipal(_ context.Context, p adminauth.Principal, digest string, now time.Time) (adminauth.Principal, error)
CreatePrincipal implements adminauth.Store.
func (*Store) DeletePolicy ¶
DeletePolicy implements adminauth.Store.
func (*Store) DeletePrincipal ¶
DeletePrincipal implements adminauth.Store.
func (*Store) DeleteRole ¶ added in v0.10.0
DeleteRole removes an unreferenced role. Principal membership or a policy reference returns ErrConflict; an absent role returns ErrNotFound.
func (*Store) Initialized ¶ added in v0.10.0
Initialized reports whether principal initialization has permanently consumed the bootstrap opportunity.
func (*Store) PolicyVersion ¶
PolicyVersion implements adminauth.Store.
func (*Store) PrincipalByDigest ¶
PrincipalByDigest implements adminauth.Store.
func (*Store) Principals ¶
func (s *Store) Principals(_ context.Context, p adminauth.Page) (adminauth.Result[adminauth.Principal], error)
Principals implements adminauth.Store, paging by name.
func (*Store) PutPolicy ¶
func (s *Store) PutPolicy(_ context.Context, p adminauth.Policy, now time.Time) (adminauth.Policy, error)
PutPolicy implements adminauth.Store.
func (*Store) PutRole ¶ added in v0.10.0
func (s *Store) PutRole(_ context.Context, role adminauth.Role, now time.Time) (adminauth.Role, error)
PutRole creates or updates a named role, preserving its creation time and advancing the policy version. Role membership alone grants no operational permission.
func (*Store) RevokeToken ¶
RevokeToken implements adminauth.Store.
func (*Store) Role ¶ added in v0.10.0
Role returns the named managed role, or ErrNotFound when no such role exists.
func (*Store) Roles ¶ added in v0.10.0
func (s *Store) Roles(_ context.Context, p adminauth.Page) (adminauth.Result[adminauth.Role], error)
Roles returns a page of managed roles in name order using an exclusive cursor.
Source Files