policyserver

Apr 12, 2026

Changes in this version

type Config

+ Discovery *DiscoveryResponse

+ type DiscoveryResponse struct

+ Auth *BootstrapAuth

+ DefaultExpiration string

+ MatchPatterns []string

Apr 12, 2026

Changes in this version

type Config

+ DiscoveryEnabled bool

Feb 16, 2026

Changes in this version

+ func ComputeAuthDiscoveryHash(auth BootstrapAuth, matchPatterns []string) string

+ func ComputeUnauthDiscoveryHash(auth BootstrapAuth) string

type Discovery

+ Auth *BootstrapAuth

type DiscoveryConfig

+ AuthHash string

+ UnauthHash string

Jan 31, 2026

Changes in this version

+ type LoaderProvider struct

+ func NewLoaderProvider(loader *PolicyLoader) *LoaderProvider

+ func (p *LoaderProvider) GetPolicy(ctx context.Context) (*PolicyConfig, error)

+ type PolicyConfig struct

+ Defaults *DefaultPolicy

+ Hosts map[string]*HostPolicy

+ Users map[string][]string

+ func (c *PolicyConfig) DiscoveryHash() string

+ func (c *PolicyConfig) HostPatterns() []string

+ func (c *PolicyConfig) Validate() error

+ type PolicyLoader struct

+ func NewPolicyLoader(url string) *PolicyLoader

+ func (l *PolicyLoader) Load(ctx context.Context) (*PolicyConfig, error)

+ type PolicyProvider interface

+ GetPolicy func(ctx context.Context) (*PolicyConfig, error)

type PolicyRulesConfig

+ func (c *PolicyRulesConfig) ExtractPolicyConfig() *PolicyConfig

+ func (c *PolicyRulesConfig) ExtractServerConfig() *ServerConfig

+ type ServerConfig struct

+ CAPublicKey string

+ OIDC OIDCConfig

+ PolicyURL string

+ func (c *ServerConfig) BootstrapAuth() BootstrapAuth

+ func (c *ServerConfig) BootstrapHash() string

+ func (c *ServerConfig) Validate() error

+ type StaticProvider struct

+ func NewStaticProvider(policy *PolicyConfig) *StaticProvider

+ func (p *StaticProvider) GetPolicy(ctx context.Context) (*PolicyConfig, error)

Jan 3, 2026

Changes in this version

type BootstrapAuth

+ ClientSecret string

type OIDCConfig

+ ClientSecret string

Jan 3, 2026

Changes in this version

+ func DefaultScopes() []string

+ func NewBootstrapRedirectHandler(hash string, baseURL string) http.HandlerFunc

+ type Bootstrap struct

+ Auth BootstrapAuth

+ type BootstrapAuth struct

+ ClientID string

+ Command string

+ Issuer string

+ Scopes []string

+ Type string

type Config

+ BootstrapHash string

type DiscoveryConfig

+ AuthConfig BootstrapAuth

+ BootstrapHash string

+ DiscoveryHash string

type OIDCConfig

+ ClientID string

+ Scopes []string

type PolicyRulesConfig

+ func (c *PolicyRulesConfig) BootstrapAuth() BootstrapAuth

+ func (c *PolicyRulesConfig) BootstrapHash() string

Dec 28, 2025

Changes in this version

type Config

+ DiscoveryBaseURL string

Dec 27, 2025

Changes in this version

+ func NewDiscoveryRedirectHandler(hash string) http.HandlerFunc

Dec 25, 2025

Changes in this version

+ var ErrNotHandled = &PolicyError

+ func NewDiscoveryHandler(config DiscoveryConfig) http.HandlerFunc

+ func NotHandled(message string) error

type Config

+ DiscoveryHash string

+ Validator TokenValidator

+ type Discovery struct

+ MatchPatterns []string

+ type DiscoveryConfig struct

+ Hash string

+ MatchPatterns []string

+ Validator TokenValidator

type PolicyRulesConfig

+ func (c *PolicyRulesConfig) DiscoveryHash() string

+ type TokenValidator interface

+ ValidateAndExtractIdentity func(token string) (identity string, err error)

Dec 2, 2025

Changes in this version

+ func DefaultExpiration() string

+ func DefaultExtensions() map[string]string

+ func ValidateDuration(d string) error

+ type DefaultPolicy struct

+ Allow map[string][]string

+ Expiration string

+ Extensions map[string]string

+ type HostPolicy struct

+ Allow map[string][]string

+ Expiration string

+ Extensions map[string]string

+ type OIDCConfig struct

+ Audience string

+ Issuer string

+ type PolicyRulesConfig struct

+ CAPublicKey string

+ Defaults *DefaultPolicy

+ Hosts map[string]*HostPolicy

+ OIDC OIDCConfig

+ Users map[string][]string

+ func (c *PolicyRulesConfig) Validate() error

Nov 21, 2025

Changes in this version

+ var ErrForbidden = &PolicyError

+ var ErrUnauthorized = &PolicyError

+ func Forbidden(message string) error

+ func InternalError(message string) error

+ func NewHandler(config Config) http.HandlerFunc

+ func Unauthorized(message string) error

+ type Config struct

+ CAPublicKey sshcert.RawPublicKey

+ Evaluator PolicyEvaluator

+ MaxRequestSize int64

+ type PolicyError struct

+ Message string

+ StatusCode int

+ func (e *PolicyError) Error() string

+ type PolicyEvaluator interface

+ Evaluate func(token string, conn policy.Connection) (*Response, error)

+ type Request struct

+ Connection policy.Connection

+ Signature string

+ Token string

+ type Response struct

+ CertParams ca.CertParams

+ Policy policy.Policy