inventory

type Inventory ¶

type Inventory interface {
	// LookupUser resolves the mapped ID within the configured provider/tenant.
	// The caller must validate the OIDC token before extracting this ID.
	// Compare IDs byte-for-byte, never falling back to userName or email.
	// The resolved ID is immutable and non-reassignable; UserName is mutable.
	LookupUser(ctx context.Context, id string) (*eval.User, error)

	// LookupHost resolves a requested host name. Callers must pass the
	// name through il.HostName first; implementations may synthesize a
	// host for names they can derive attributes for.
	LookupHost(ctx context.Context, name string) (*ResolvedHost, error)
}

Inventory looks up users and hosts at evaluation time.

A (nil, nil) return means "no such entity" — a structural non-match that the evaluator turns into a 403, not an error. A non-nil error means the lookup itself failed and the evaluation must fail closed (500).

type PrincipalMode ¶ added in v0.23.0

type PrincipalMode string

PrincipalMode selects how an allowed account@host tuple is represented in an issued SSH certificate.

const (
	// AccountNamePrincipals places the literal requested account name in the
	// certificate. It is compatible with ordinary OpenSSH CA configuration but
	// is not destination-bound.
	AccountNamePrincipals PrincipalMode = "account-name"

	// EpithetPrincipalV1 derives a destination-bound v1 principal from the
	// principal domain and requested account name.
	EpithetPrincipalV1 PrincipalMode = principal.SchemeV1
)

func (m PrincipalMode) Effective() PrincipalMode

func (m PrincipalMode) Validate() error

type ResolvedHost ¶ added in v0.23.0

type ResolvedHost struct {
	Policy        eval.Host
	PrincipalMode PrincipalMode
	Domain        principal.Domain
}

ResolvedHost carries both the authorization resource consumed by Writ and issuance metadata that must remain outside the pure policy model. For a shared named domain, Policy.Name is the domain rather than the requested hostname because the resulting credential is portable across every member.

type Static ¶

type Static struct {
	// contains filtered or unexported fields
}

Static is a file-backed inventory: SCIM-shaped users and hosts loaded once at startup. Reload is a process restart, like the policy itself.

Host entries come in two forms. An exact entry (`name:`) is one registered host. A pattern entry (`pattern:`) uses the same DNS-label-aware hostname patterns as Writ host selectors. Account-name entries adopt the requested name; destination-bound named domains expose that domain as the Writ resource so policy cannot claim per-member isolation. Patterns are the escape hatch for fleets of short-lived hosts (VM pools, CI runners) that follow a naming pattern but cannot be enumerated in a file.

func NewStatic(paths []string, options ...StaticOption) (*Static, error)

func (s *Static) LookupHost(_ context.Context, name string) (*ResolvedHost, error)

func (s *Static) LookupUser(_ context.Context, id string) (*eval.User, error)

type StaticOption ¶ added in v0.23.0

type StaticOption func(*staticOptions) error

StaticOption configures static inventory loading.

func WithDefaultPrincipalMode(mode PrincipalMode) StaticOption