Documentation
¶
Index ¶
Constants ¶
const DefaultSessionCookieName = "console_session"
DefaultSessionCookieName names the HttpOnly cookie holding the session JWT.
Variables ¶
var ( ErrJWTExpirationInvalid = errors.New("config: auth.jwtExpiration must be at least 1 minute (e.g. 24h) — very short expirations render tokens unusable") ErrRedirectionJWTExpirationInvalid = errors.New("config: auth.redirectionJWTExpiration must be at least 1 minute (e.g. 5m) — very short expirations render redirection tokens unusable") ErrJWTKeyMissing = errors.New("config: auth.jwtKey is required — set AUTH_JWT_KEY environment variable or jwtKey in config.yml to a strong secret") )
var ( ErrPortNotNumeric = errors.New("HTTP port (HTTP_PORT) must be a decimal integer") ErrPortOutOfRange = errors.New("HTTP port (HTTP_PORT) must be in range 1-65535") )
Sentinel errors for port validation.
var ( // ErrEncryptionKeyLength means crypto/aes cannot use the key at all — every // credential write would fail at runtime with "invalid key size". ErrEncryptionKeyLength = errors.New("encryption key must be 16, 24 or 32 characters long (AES-128, AES-192 or AES-256)") // ErrEncryptionKeyWeak means the key is the right size but so predictable // that it contributes little to the strength of the encryption. ErrEncryptionKeyWeak = errors.New("encryption key is too weak") )
Errors returned by ValidateEncryptionKey.
var TrayMode bool
TrayMode indicates whether to run with system tray UI.
Functions ¶
func SaveAdminPassword ¶ added in v1.28.0
SaveAdminPassword persists adminPassword to auth.adminPassword in config.yml without touching any other field. It re-reads the file directly (bypassing the env-var overlay applied by cleanenv) so env-only secrets like APP_ENCRYPTION_KEY, SECRETS_TOKEN, DB_URL, EA_PASSWORD, and AUTH_JWT_KEY cannot leak to disk.
func ValidateEncryptionKey ¶ added in v1.41.0
ValidateEncryptionKey reports whether key can be used as the AES-GCM key that protects device credentials. It enforces the size crypto/aes requires plus a minimum strength, so a key with no entropy ("aaaaaaaaaaaaaaaa") cannot silently negate the encryption.
Callers are responsible for skipping the empty key, which means "no key supplied" rather than "invalid key" — see handleEncryptionKey in cmd/app.
Types ¶
type App ¶
type App struct {
Name string `env-required:"true" yaml:"name" env:"APP_NAME"`
Repo string `env-required:"true" yaml:"repo" env:"APP_REPO"`
Version string `env-required:"true"`
CommonName string `env-required:"true" yaml:"common_name" env:"APP_COMMON_NAME"`
EncryptionKey string `yaml:"encryption_key" env:"APP_ENCRYPTION_KEY"`
AllowInsecureCiphers bool `yaml:"allow_insecure_ciphers" env:"APP_ALLOW_INSECURE_CIPHERS"`
DisableCIRA bool `yaml:"disable_cira" env:"APP_DISABLE_CIRA"`
}
App -.
type Auth ¶
type Auth struct {
Disabled bool `yaml:"disabled" env:"AUTH_DISABLED"`
AdminUsername string `yaml:"adminUsername" env:"AUTH_ADMIN_USERNAME"`
AdminPassword string `yaml:"adminPassword" env:"AUTH_ADMIN_PASSWORD"`
JWTKey string `yaml:"jwtKey" env:"AUTH_JWT_KEY"`
JWTExpiration time.Duration `yaml:"jwtExpiration" env:"AUTH_JWT_EXPIRATION"`
RedirectionJWTExpiration time.Duration `yaml:"redirectionJWTExpiration" env:"AUTH_REDIRECTION_JWT_EXPIRATION"`
ClientID string `yaml:"clientId" env:"AUTH_CLIENT_ID"`
Issuer string `yaml:"issuer" env:"AUTH_ISSUER"`
TLSSkipVerify bool `yaml:"tlsSkipVerify" env:"AUTH_TLS_SKIP_VERIFY"`
CookieEnabled bool `yaml:"cookieEnabled" env:"AUTH_COOKIE_ENABLED"`
CookieName string `yaml:"cookieName" env:"AUTH_COOKIE_NAME"`
CookieSecure bool `yaml:"cookieSecure" env:"AUTH_COOKIE_SECURE"`
CookieSameSite string `yaml:"cookieSameSite" env:"AUTH_COOKIE_SAME_SITE"`
UI UIAuthConfig `yaml:"ui"`
}
Auth -.
The Cookie* fields govern the HttpOnly session cookie the browser uses in place of Web Storage. Additive only: /authorize still returns the token in the body and the Authorization header still wins, so REST clients are unaffected.
func (Auth) CookieAuthEnabled ¶ added in v1.40.1
CookieAuthEnabled reports whether the HttpOnly session cookie is in use. Off under OIDC, where the IdP owns the token. Read by the middleware and the spec.
type Config ¶
type Config struct {
App `yaml:"app"`
HTTP `yaml:"http"`
Log `yaml:"logger"`
Secrets `yaml:"secrets"`
DB `yaml:"postgres"`
EA `yaml:"ea"`
Auth `yaml:"auth"`
UI `yaml:"ui"`
}
Config -.
var ConsoleConfig *Config
type DB ¶
type DB struct {
Provider string `yaml:"provider" env:"DB_PROVIDER"`
PoolMax int `env-required:"true" yaml:"pool_max" env:"DB_POOL_MAX"`
URL string `env:"DB_URL"`
}
DB -.
Provider selects the backend: "postgres", "sqlite" (default), or "mongo". See internal/app/repos.go for the per-provider rules around DB_URL.
type EA ¶
type EA struct {
URL string `yaml:"url" env:"EA_URL"`
Username string `yaml:"username" env:"EA_USERNAME"`
Password string `yaml:"password" env:"EA_PASSWORD"`
}
EA -.
type HTTP ¶
type HTTP struct {
Host string `yaml:"host" env:"HTTP_HOST"`
Port string `env-required:"true" yaml:"port" env:"HTTP_PORT"`
AllowedOrigins []string `env-required:"true" yaml:"allowed_origins" env:"HTTP_ALLOWED_ORIGINS"`
AllowedHeaders []string `env-required:"true" yaml:"allowed_headers" env:"HTTP_ALLOWED_HEADERS"`
AllowCredentials bool `yaml:"allow_credentials" env:"HTTP_ALLOW_CREDENTIALS"`
WSCompression bool `yaml:"ws_compression" env:"WS_COMPRESSION"`
TLS TLS `yaml:"tls"`
}
HTTP -.
type Log ¶
type Log struct {
Level string `env-required:"true" yaml:"log_level" env:"LOG_LEVEL"`
}
Log -.
type Secrets ¶ added in v1.15.0
type Secrets struct {
Address string `yaml:"address" env:"SECRETS_ADDR"`
Token string `yaml:"token" env:"SECRETS_TOKEN"`
Path string `yaml:"path" env:"SECRETS_PATH"`
}
Secrets -.
type TLS ¶ added in v1.13.0
type TLS struct {
Enabled bool `yaml:"enabled" env:"HTTP_TLS_ENABLED"`
CertFile string `yaml:"certFile" env:"HTTP_TLS_CERT_FILE"`
KeyFile string `yaml:"keyFile" env:"HTTP_TLS_KEY_FILE"`
}
TLS -.
type UI ¶ added in v1.18.0
type UI struct {
ExternalURL string `yaml:"externalUrl" env:"UI_EXTERNAL_URL"`
}
UI -.
type UIAuthConfig ¶
type UIAuthConfig struct {
ClientID string `yaml:"clientId" env:"AUTH_UI_CLIENT_ID"`
Issuer string `yaml:"issuer" env:"AUTH_UI_ISSUER"`
RedirectURI string `yaml:"redirectUri" env:"AUTH_UI_REDIRECT_URI"`
Scope string `yaml:"scope" env:"AUTH_UI_SCOPE"`
ResponseType string `yaml:"responseType" env:"AUTH_UI_RESPONSE_TYPE"`
RequireHTTPS bool `yaml:"requireHttps" env:"AUTH_UI_REQUIRE_HTTPS"`
StrictDiscoveryDocumentValidation bool `yaml:"strictDiscoveryDocumentValidation" env:"AUTH_UI_STRICT_DISCOVERY"`
}
UIAuthConfig -.
Source Files