Documentation
¶
Overview ¶
Package identity abstracts external identity providers behind a subject-keyed Directory, an issuer-aware Linkage over user_identities, and a Service that routes user-keyed operations to the directory registered for each linked issuer.
Index ¶
- Variables
- func CreatorContextFromIdentity(id Identity) *sharedteamprovision.CreatorContextV1
- func ResolveOryIssuer(sdkURL string, jwtConfigs []sharedauth.JWTConfig) (string, error)
- type DeleteUserHandle
- type Directory
- type Identity
- type Linkage
- type LinkedIdentity
- type OryConfig
- type Profile
- type Service
Constants ¶
This section is empty.
Variables ¶
var ErrUnknownIssuer = errors.New("no identity directory registered for issuer")
var ErrUserNotFound = errors.New("user not found")
Functions ¶
func CreatorContextFromIdentity ¶
func CreatorContextFromIdentity(id Identity) *sharedteamprovision.CreatorContextV1
func ResolveOryIssuer ¶
func ResolveOryIssuer(sdkURL string, jwtConfigs []sharedauth.JWTConfig) (string, error)
ResolveOryIssuer picks the Ory issuer URL from the auth provider's JWT configurations by matching the host of sdkURL against each issuer URL. When exactly one JWT entry is configured, its issuer is used without requiring a host match. When no JWT entries are configured, it falls back to the SDK URL.
Types ¶
type DeleteUserHandle ¶
type Directory ¶
type Directory interface {
GetIdentity(ctx context.Context, subject string) (Identity, error)
ListIdentities(ctx context.Context, subjects []string) ([]Identity, error)
SearchByEmail(ctx context.Context, email string) ([]Identity, error)
SetExternalID(ctx context.Context, subject string, externalID uuid.UUID) error
DeleteIdentity(ctx context.Context, subject string) error
}
Directory is the subject-keyed admin API of a single identity provider (e.g. one Ory project). It never touches the database; issuer routing is the Service's concern.
func NewOryDirectory ¶
type Linkage ¶
type Linkage interface {
IdentitiesForUsers(ctx context.Context, issuers []string, userIDs []uuid.UUID) ([]LinkedIdentity, error)
UsersForSubjects(ctx context.Context, issuer string, subjects []string) ([]LinkedIdentity, error)
}
Linkage resolves the user_id <-> (issuer, subject) mapping. It is the only layer that knows about oidc_iss.
func NewQueriesLinkage ¶
func NewQueriesLinkage(queries linkageQueries) Linkage
type Profile ¶
type Service ¶
type Service interface {
IdentityOrganizationID(ctx context.Context, issuer, subject string) (uuid.UUID, error)
SetIdentityExternalID(ctx context.Context, issuer, subject string, externalID uuid.UUID) error
ProfilesByUserID(ctx context.Context, userIDs []uuid.UUID) (map[uuid.UUID]Profile, error)
UserOrganizationID(ctx context.Context, userID uuid.UUID) (uuid.UUID, error)
TeamCreatorContext(ctx context.Context, userID uuid.UUID) (*sharedteamprovision.CreatorContextV1, error)
FindProfilesByEmail(ctx context.Context, email string) ([]Profile, error)
PrepareDeleteUser(ctx context.Context, userID uuid.UUID) (DeleteUserHandle, error)
}