auth

package
v0.20.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 6, 2026 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// LabelAgentTask is the metadata label identifying the associated AgentTask.
	LabelAgentTask = "divergedev.com/agent-task"
	// LabelRevoked is the metadata label marking a token secret as revoked.
	LabelRevoked = "divergedev.com/revoked"
	// ManagedByLabel is the standard Kubernetes management label.
	ManagedByLabel = "app.kubernetes.io/managed-by"
	// TokenIndexSecretName is the fixed Secret name per namespace used to index active
	// AgentTask capability tokens so diverge-server RBAC can restrict Secret reads via resourceNames.
	TokenIndexSecretName = "diverge-agenttask-tokens"
)
View Source 
const MinMacaroonRootKeyLen = 32

MinMacaroonRootKeyLen is the minimum required length in bytes for a Macaroon HMAC root key.

Variables

View Source 
var (
	ErrInvalidSignature = errors.New("invalid token signature")
	ErrTokenExpired     = errors.New("token has expired")
	ErrCaveatFailed     = errors.New("caveat check failed")
	ErrInvalidCaveat    = ErrCaveatFailed
	ErrMalformedToken   = errors.New("malformed token")
)
View Source 
var (
	// ErrTokenNotFound is returned when a requested capability token does not exist in the store.
	ErrTokenNotFound = errors.New("token not found")
	// ErrTokenRevoked is returned when attempting to retrieve or verify a revoked capability token.
	ErrTokenRevoked = errors.New("token has been revoked")
)
View Source 
var ModelTiers = map[string][]string{
	"smart": {
		"gemini-2.5-pro",
		"claude-3-7-sonnet",
	},
	"fast": {
		"gemini-2.5-flash",
		"gpt-4o-mini",
	},
	"lite": {
		"gemini-flash-lite",
	},
}

ModelTiers maps capability tier names to recommended underlying model identifiers.

Functions

func MatchesAllowedModel added in v0.19.0 

func MatchesAllowedModel(pattern, model string) bool

MatchesAllowedModel reports whether model is permitted by pattern (exact match, capability tier alias, trailing '*' prefix match, or glob).

func ResolveModelTier 

func ResolveModelTier(tier string) []string

ResolveModelTier looks up default model names for a capability tier.

func SecretName 

func SecretName(taskID string) string

SecretName returns the deterministic Kubernetes Secret name for an AgentTask capability token.

func TaskLabelValue 

func TaskLabelValue(taskID string) string

TaskLabelValue returns a Kubernetes-valid label value (<= 63 chars) for an AgentTask identifier.

Types

type Attenuator 

type Attenuator interface {
	Attenuate(ctx context.Context, token Token, caveats ...Caveat) (Token, error)
}

Attenuator appends restrictive caveats to an existing token without re-contacting the issuer.

type AuthEvent 

type AuthEvent struct {
	Type      AuthEventType `json:"type"`
	TaskID    string        `json:"task_id"`
	Namespace string        `json:"namespace"`
	Principal string        `json:"principal"`
	Success   bool          `json:"success"`
	Reason    string        `json:"reason,omitempty"`
	Timestamp time.Time     `json:"timestamp"`
}

AuthEvent records a security-sensitive capability event for auditing and compliance.

type AuthEventType 

type AuthEventType string

AuthEventType defines the category of security/capability events. 

const (
	EventMint      AuthEventType = "mint"
	EventAttenuate AuthEventType = "attenuate"
	EventVerify    AuthEventType = "verify"
	EventRevoke    AuthEventType = "revoke"
)

type Caveat 

type Caveat struct {
	Key   string   `json:"key"`
	Op    CaveatOp `json:"op"`
	Value string   `json:"value"`
}

Caveat represents a restriction appended to a token.

type CaveatOp 

type CaveatOp string

CaveatOp defines operators for checking caveats. 

const (
	OpEqual    CaveatOp = "="
	OpIn       CaveatOp = "in"
	OpLessThan CaveatOp = "<"
	OpBefore   CaveatOp = "before"
	OpGlob     CaveatOp = "glob"
)

type CaveatValidator 

type CaveatValidator interface {
	Validate(ctx context.Context, caveat Caveat, claims Claims) error
}

CaveatValidator evaluates caveats against token claims with strict fail-closed typing.

type Claims 

type Claims struct {
	TaskID         string    `json:"task_id"`
	Namespace      string    `json:"namespace,omitempty"`
	RepoURL        string    `json:"repo_url"`
	Branch         string    `json:"branch"`
	AllowedTools   []string  `json:"allowed_tools,omitempty"`
	AllowedModels  []string  `json:"allowed_models,omitempty"`
	MaxCostUSD     float64   `json:"max_cost_usd,omitempty"`
	MaxTokens      int64     `json:"max_tokens,omitempty"`
	TokensConsumed int64     `json:"tokens_consumed,omitempty"`
	ExpiresAt      time.Time `json:"expires_at"`
}

Claims encapsulates the authorized attributes of an AgentTask token.

type CredentialBroker 

type CredentialBroker interface {
	BrokerCredentials(ctx context.Context, repoURL string) (*VCSCredentials, error)
}

CredentialBroker supplies short-lived VCS credentials for git clone operations.

type InMemoryTokenStore 

type InMemoryTokenStore struct {
	// contains filtered or unexported fields
}

InMemoryTokenStore provides an in-memory, thread-safe implementation of TokenStore. Ideal for unit tests, local CLI mock mode, and standalone testing.

func NewInMemoryTokenStore 

func NewInMemoryTokenStore() *InMemoryTokenStore

NewInMemoryTokenStore initializes a thread-safe InMemoryTokenStore.

func (*InMemoryTokenStore) DeleteToken 

func (s *InMemoryTokenStore) DeleteToken(_ context.Context, taskID, namespace string) error

DeleteToken removes the token from storage.

func (*InMemoryTokenStore) GetToken 

func (s *InMemoryTokenStore) GetToken(_ context.Context, taskID, namespace string) ([]byte, error)

GetToken retrieves the token or returns ErrTokenNotFound/ErrTokenRevoked.

func (*InMemoryTokenStore) IsRevoked 

func (s *InMemoryTokenStore) IsRevoked(_ context.Context, taskID, namespace string) bool

IsRevoked checks if the token has been marked revoked.

func (*InMemoryTokenStore) RevokeToken 

func (s *InMemoryTokenStore) RevokeToken(_ context.Context, taskID, namespace string) error

RevokeToken marks the token as revoked.

func (*InMemoryTokenStore) SaveToken 

func (s *InMemoryTokenStore) SaveToken(_ context.Context, taskID, namespace string, token []byte) error

SaveToken persists the raw token bytes.

type KubernetesSecretTokenStore 

type KubernetesSecretTokenStore struct {
	// contains filtered or unexported fields
}

KubernetesSecretTokenStore implements TokenStore using Kubernetes corev1.Secret resources.

func NewKubernetesSecretTokenStore 

func NewKubernetesSecretTokenStore(c client.Client, scheme *runtime.Scheme) *KubernetesSecretTokenStore

NewKubernetesSecretTokenStore initializes a KubernetesSecretTokenStore.

func (*KubernetesSecretTokenStore) CheckRevoked added in v0.19.0 

func (s *KubernetesSecretTokenStore) CheckRevoked(ctx context.Context, taskID, namespace string) (bool, error)

CheckRevoked inspects whether the token Secret (or TokenIndexSecretName when indexOnly is enabled) is marked revoked, returning any underlying storage read error rather than treating read errors as unrevoked.

func (*KubernetesSecretTokenStore) DeleteToken 

func (s *KubernetesSecretTokenStore) DeleteToken(ctx context.Context, taskID, namespace string) error

DeleteToken removes the token Secret and clears its entry in TokenIndexSecretName.

func (*KubernetesSecretTokenStore) GetToken 

func (s *KubernetesSecretTokenStore) GetToken(ctx context.Context, taskID, namespace string) ([]byte, error)

GetToken reads the token from the Kubernetes Secret (or from TokenIndexSecretName when indexOnly is enabled).

func (*KubernetesSecretTokenStore) IsRevoked 

func (s *KubernetesSecretTokenStore) IsRevoked(ctx context.Context, taskID, namespace string) bool

IsRevoked inspects whether the token Secret (or TokenIndexSecretName when indexOnly is enabled) is marked revoked.

func (*KubernetesSecretTokenStore) RevokeToken 

func (s *KubernetesSecretTokenStore) RevokeToken(ctx context.Context, taskID, namespace string) error

RevokeToken marks the token Secret and TokenIndexSecretName entry as revoked.

func (*KubernetesSecretTokenStore) SaveToken 

func (s *KubernetesSecretTokenStore) SaveToken(ctx context.Context, taskID, namespace string, token []byte) error

SaveToken creates or updates the <task-name>-token Kubernetes Secret and syncs the namespace token index.

func (*KubernetesSecretTokenStore) WithIndexOnly 

func (s *KubernetesSecretTokenStore) WithIndexOnly() *KubernetesSecretTokenStore

WithIndexOnly configures the store to read token state exclusively from the namespace-scoped TokenIndexSecretName ("diverge-agenttask-tokens") Secret, allowing callers like diverge-server to operate with RBAC restricted via resourceNames.

type LoggerTokenAuditor 

type LoggerTokenAuditor struct {
	// contains filtered or unexported fields
}

LoggerTokenAuditor logs audit events to structured logger.

func NewLoggerTokenAuditor 

func NewLoggerTokenAuditor(logger *slog.Logger) *LoggerTokenAuditor

NewLoggerTokenAuditor constructs a LoggerTokenAuditor.

func (*LoggerTokenAuditor) RecordEvent 

func (a *LoggerTokenAuditor) RecordEvent(_ context.Context, event AuthEvent) error

RecordEvent logs an AuthEvent.

type Macaroon 

type Macaroon struct {
	TokenID   string   `json:"id"`
	Location  string   `json:"location"`
	CaveatSeq []Caveat `json:"caveats"`
	Signature string   `json:"signature"` // hex-encoded
}

Macaroon implements Token using HMAC-SHA256 caveat chaining.

func (*Macaroon) Caveats 

func (m *Macaroon) Caveats() []Caveat

Caveats returns the ordered caveat chain embedded in the Macaroon.

func (*Macaroon) ID 

func (m *Macaroon) ID() string

ID returns the Macaroon's task identifier.

func (*Macaroon) Serialize 

func (m *Macaroon) Serialize() ([]byte, error)

Serialize encodes the Macaroon as JSON bytes.

type MacaroonProvider 

type MacaroonProvider struct {
	// contains filtered or unexported fields
}

MacaroonProvider implements Minter, Attenuator, and Verifier.

func NewMacaroonProvider 

func NewMacaroonProvider(rootKey []byte) *MacaroonProvider

NewMacaroonProvider initializes a provider with a 32-byte secret root key.

func (*MacaroonProvider) Attenuate 

func (p *MacaroonProvider) Attenuate(_ context.Context, token Token, caveats ...Caveat) (Token, error)

Attenuate appends additional caveats to an existing token.

func (*MacaroonProvider) Mint 

func (p *MacaroonProvider) Mint(_ context.Context, claims Claims) (Token, error)

Mint creates a fresh root Macaroon.

func (*MacaroonProvider) Verify 

func (p *MacaroonProvider) Verify(_ context.Context, raw []byte, required Claims) error

Verify validates that the signature chain is intact and all caveats hold true.

func (*MacaroonProvider) VerifyAndExtract 

func (p *MacaroonProvider) VerifyAndExtract(_ context.Context, raw []byte) (*Macaroon, Claims, error)

VerifyAndExtract validates the cryptographic HMAC chain, expiration, and caveat syntax of a serialized Macaroon and extracts the effective Claims embedded in its caveat sequence.

type Minter 

type Minter interface {
	Mint(ctx context.Context, claims Claims) (Token, error)
}

Minter creates root authorization tokens for AgentTasks.

type NoopTokenAuditor 

type NoopTokenAuditor struct{}

NoopTokenAuditor discards audit events.

func (*NoopTokenAuditor) RecordEvent 

func (a *NoopTokenAuditor) RecordEvent(_ context.Context, _ AuthEvent) error

RecordEvent discards the provided AuthEvent and returns nil.

type Provider 

type Provider interface {
	Minter
	Attenuator
	Verifier
}

Provider combines token issuance, attenuation, and verification capabilities.

type Token 

type Token interface {
	ID() string
	Serialize() ([]byte, error)
	Caveats() []Caveat
}

Token represents a cryptographic credential that can be serialized and attenuated.

type TokenAuditor 

type TokenAuditor interface {
	RecordEvent(ctx context.Context, event AuthEvent) error
}

TokenAuditor is an interface for streaming authentication/authorization events to an audit sink.

type TokenStore 

type TokenStore interface {
	SaveToken(ctx context.Context, taskID, namespace string, token []byte) error
	GetToken(ctx context.Context, taskID, namespace string) ([]byte, error)
	DeleteToken(ctx context.Context, taskID, namespace string) error
	RevokeToken(ctx context.Context, taskID, namespace string) error
	IsRevoked(ctx context.Context, taskID, namespace string) bool
}

TokenStore manages persistence, lookup, and revocation of capability tokens.

type VCSCredentials 

type VCSCredentials struct {
	Username string
	Token    string
	AuthType string // "bearer", "basic", "ssh"
}

VCSCredentials encapsulates short-lived repository access credentials.

type Verifier 

type Verifier interface {
	Verify(ctx context.Context, raw []byte, required Claims) error
}

Verifier checks token validity, signature chain, and required caveats.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.