authkeys

package
v0.1.67 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 1, 2026 License: MIT Imports: 22 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// TokenPrefix is the managed API key prefix returned to clients.
	TokenPrefix = "sk_gom_"
)

Variables

View Source 
var (
	// ErrNotFound indicates a requested auth key record does not exist.
	ErrNotFound = errors.New("auth key not found")
	// ErrInvalidToken indicates the presented token does not match a known key.
	ErrInvalidToken = errors.New("invalid API key")
	// ErrInactive indicates the presented token belongs to an inactive key.
	ErrInactive = errors.New("API key is inactive")
	// ErrExpired indicates the presented token belongs to an expired key.
	ErrExpired = errors.New("API key expired")
)

Functions

func IsValidationError 

func IsValidationError(err error) bool

IsValidationError reports whether err is a validation error.

Types

type AuthKey 

type AuthKey struct {
	ID          string   `json:"id" bson:"_id"`
	Name        string   `json:"name" bson:"name"`
	Description string   `json:"description,omitempty" bson:"description,omitempty"`
	UserPath    string   `json:"user_path,omitempty" bson:"user_path,omitempty"`
	Labels      []string `json:"labels,omitempty" bson:"labels,omitempty"`
	// DashboardAccess grants the key access to the admin API and dashboard.
	// Keys without it can still call every model endpoint and /v1/usage.
	DashboardAccess bool       `json:"dashboard_access" bson:"dashboard_access,omitempty"`
	RedactedValue   string     `json:"redacted_value" bson:"redacted_value"`
	SecretHash      string     `json:"-" bson:"secret_hash"`
	Enabled         bool       `json:"enabled" bson:"enabled"`
	ExpiresAt       *time.Time `json:"expires_at,omitempty" bson:"expires_at,omitempty"`
	DeactivatedAt   *time.Time `json:"deactivated_at,omitempty" bson:"deactivated_at,omitempty"`
	CreatedAt       time.Time  `json:"created_at" bson:"created_at"`
	UpdatedAt       time.Time  `json:"updated_at" bson:"updated_at"`
}

AuthKey is the persisted auth key record.

func (AuthKey) Active 

func (k AuthKey) Active(now time.Time) bool

Active reports whether the key can currently authenticate requests.

type AuthenticationResult 

type AuthenticationResult struct {
	ID              string
	UserPath        string
	Labels          []string
	DashboardAccess bool
}

AuthenticationResult describes one successful managed auth key lookup.

type CreateInput 

type CreateInput struct {
	Name            string
	Description     string
	UserPath        string
	Labels          []string
	DashboardAccess bool
	ExpiresAt       *time.Time
}

CreateInput captures the admin request for issuing a new auth key.

type IssuedKey 

type IssuedKey struct {
	View
	Value string `json:"value"`
}

IssuedKey is returned once on create and includes the plaintext token value.

type MongoDBStore 

type MongoDBStore struct {
	// contains filtered or unexported fields
}

MongoDBStore stores auth keys in MongoDB.

func NewMongoDBStore 

func NewMongoDBStore(database *mongo.Database) (*MongoDBStore, error)

NewMongoDBStore creates collection indexes if needed.

func (*MongoDBStore) Close 

func (s *MongoDBStore) Close() error

func (*MongoDBStore) Create 

func (s *MongoDBStore) Create(ctx context.Context, key AuthKey) error

func (*MongoDBStore) Deactivate 

func (s *MongoDBStore) Deactivate(ctx context.Context, id string, now time.Time) error

func (*MongoDBStore) List 

func (s *MongoDBStore) List(ctx context.Context) ([]AuthKey, error)

func (*MongoDBStore) UpdateDashboardAccess added in v0.1.59 

func (s *MongoDBStore) UpdateDashboardAccess(ctx context.Context, id string, allowed bool, now time.Time) error

func (*MongoDBStore) UpdateLabels 

func (s *MongoDBStore) UpdateLabels(ctx context.Context, id string, labels []string, now time.Time) error

type Result 

type Result struct {
	Service *Service
	Store   Store
	// contains filtered or unexported fields
}

Result holds the initialized auth key service and any owned resources.

func New 

func New(ctx context.Context, shared storage.Storage) (*Result, error)

New creates an auth key subsystem using an existing storage connection.

func (*Result) Close 

func (r *Result) Close() error

Close releases resources held by the auth key subsystem.

type SQLStore added in v0.1.60 

type SQLStore struct {
	// contains filtered or unexported fields
}

SQLStore stores auth keys in a SQL database.

func NewSQLStore added in v0.1.60 

func NewSQLStore(ctx context.Context, db sqlx.DB) (*SQLStore, error)

NewSQLStore creates the auth_keys table and indexes if needed.

func (*SQLStore) Close added in v0.1.60 

func (s *SQLStore) Close() error

func (*SQLStore) Create added in v0.1.60 

func (s *SQLStore) Create(ctx context.Context, key AuthKey) error

func (*SQLStore) Deactivate added in v0.1.60 

func (s *SQLStore) Deactivate(ctx context.Context, id string, now time.Time) error

func (*SQLStore) List added in v0.1.60 

func (s *SQLStore) List(ctx context.Context) ([]AuthKey, error)

func (*SQLStore) UpdateDashboardAccess added in v0.1.60 

func (s *SQLStore) UpdateDashboardAccess(ctx context.Context, id string, allowed bool, now time.Time) error

func (*SQLStore) UpdateLabels added in v0.1.60 

func (s *SQLStore) UpdateLabels(ctx context.Context, id string, labels []string, now time.Time) error

type Service 

type Service struct {
	// contains filtered or unexported fields
}

Service keeps managed auth keys cached in memory for request authentication.

func NewService 

func NewService(store Store) (*Service, error)

NewService creates a managed auth key service backed by storage.

func (*Service) ActiveCount 

func (s *Service) ActiveCount() int

ActiveCount returns the number of currently active auth keys.

func (*Service) Authenticate 

func (s *Service) Authenticate(_ context.Context, token string) (AuthenticationResult, error)

Authenticate validates a presented bearer token against the in-memory snapshot and returns the matched auth key metadata on success.

func (*Service) Create 

func (s *Service) Create(ctx context.Context, input CreateInput) (*IssuedKey, error)

Create issues a new managed auth key, persists it, updates the in-memory snapshot immediately, and then best-effort reconciles from storage.

func (*Service) Deactivate 

func (s *Service) Deactivate(ctx context.Context, id string) error

Deactivate marks a managed auth key inactive while preserving its record and best-effort reconciles the snapshot from storage afterward.

func (*Service) Enabled 

func (s *Service) Enabled() bool

Enabled reports whether managed auth keys should be enforced.

func (*Service) ListViews 

func (s *Service) ListViews() []View

ListViews returns all cached keys in admin-facing form.

func (*Service) Refresh 

func (s *Service) Refresh(ctx context.Context) error

Refresh reloads keys from storage and atomically swaps the in-memory snapshot.

func (*Service) StartBackgroundRefresh 

func (s *Service) StartBackgroundRefresh(interval time.Duration) func()

StartBackgroundRefresh periodically reloads auth keys from storage until stopped.

func (*Service) Total 

func (s *Service) Total() int

Total returns the number of persisted managed auth keys in the current snapshot.

func (*Service) UpdateDashboardAccess added in v0.1.59 

func (s *Service) UpdateDashboardAccess(ctx context.Context, id string, allowed bool) (*View, error)

UpdateDashboardAccess grants or revokes a managed auth key's admin API and dashboard access, updates the in-memory snapshot immediately, best-effort reconciles from storage, and returns the updated admin-facing view.

func (*Service) UpdateLabels 

func (s *Service) UpdateLabels(ctx context.Context, id string, labels []string) (*View, error)

UpdateLabels replaces a managed auth key's labels, updates the in-memory snapshot immediately, best-effort reconciles from storage, and returns the updated admin-facing view. Passing no labels clears them.

type Store 

type Store interface {
	List(ctx context.Context) ([]AuthKey, error)
	Create(ctx context.Context, key AuthKey) error
	UpdateLabels(ctx context.Context, id string, labels []string, now time.Time) error
	UpdateDashboardAccess(ctx context.Context, id string, allowed bool, now time.Time) error
	Deactivate(ctx context.Context, id string, now time.Time) error
	Close() error
}

Store defines persistence operations for managed auth keys.

type ValidationError 

type ValidationError = validation.Error

ValidationError indicates invalid auth key input or state.

type View 

type View struct {
	AuthKey
	Active bool `json:"active"`
}

View is the admin-facing representation of a managed auth key.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.