Documentation
¶
Overview ¶
Package wire holds every type that crosses a process boundary (CA, policy server, CA client). Consolidating these shapes here means later changes to the wire format only need to happen in one place.
Index ¶
Constants ¶
const MaxBodySize = 64 * 1024
MaxBodySize is the maximum request body and trusted-peer response body size. Real OIDC ID tokens with group claims run 4-8 KiB; 64 KiB leaves an order of magnitude of headroom before truncation.
const MaxTTLSeconds int64 = (1<<63 - 1) / int64(time.Second)
MaxTTLSeconds is the largest whole-second lifetime representable by Go's time.Duration. CA validates before converting policy-controlled seconds.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuthConfig ¶
type AuthConfig struct {
Issuer string `json:"issuer"`
ClientID string `json:"client_id"`
ClientSecret string `json:"client_secret,omitempty"`
}
AuthConfig tells a client how to authenticate: OIDC issuer and client credentials. This is the only auth mechanism epithet supports, so there is no type discriminator.
type Discovery ¶
type Discovery struct {
Auth *AuthConfig `json:"auth,omitempty"`
// CacheControl carries the upstream Cache-Control header; never serialized.
CacheControl string `json:"-"`
}
Discovery is the discovery document: the anonymous bootstrap endpoint's entire payload. It carries only auth config — no server-advertised match patterns, since gating on those was removed.
type PolicyError ¶
PolicyError is a policy-server error with its HTTP status.
func (*PolicyError) Error ¶
func (e *PolicyError) Error() string
type PolicyFacts ¶ added in v0.30.0
type PolicyFacts struct {
Authentication facts.Authentication `json:"authentication"`
Target string `json:"target"`
User *facts.User `json:"user"`
Host *facts.HostResource `json:"host"`
}
PolicyFacts is CA's normalized input for one requested target. CA validates the inventory's host/domain binding before projecting Host. Host.Names lists the equivalent host names or the shared principal domain; Target binds the request. Principal construction data, revisions, and protocol versions remain at CA.
func (*PolicyFacts) UnmarshalJSON ¶ added in v0.30.0
func (f *PolicyFacts) UnmarshalJSON(data []byte) error
UnmarshalJSON distinguishes explicit absent records from omitted fields and retains strict decoding even though this type has custom unmarshalling.
func (*PolicyFacts) Validate ¶ added in v0.30.0
func (f *PolicyFacts) Validate(requestedHost string) error
Validate preserves identity, connection binding, and authentication lifetime. Explicit null records represent absence for policy's structural denial.
type PolicyRequest ¶
type PolicyRequest struct {
Facts *PolicyFacts `json:"facts"`
Connection policy.Connection `json:"connection"`
}
PolicyRequest is the CA→policy-server cert evaluation request body.
type PolicyResponse ¶
type PolicyResponse struct {
// TTLSeconds is a positive whole-second lifetime, measured from CA signing.
TTLSeconds int64 `json:"ttlSeconds"`
Extensions map[string]string `json:"extensions"`
// NotAfter is an optional absolute policy deadline. It may tighten, but
// never extend, the authentication expiry independently enforced by CA.
NotAfter time.Time `json:"notAfter,omitzero"`
PolicyID string `json:"policyId,omitempty"`
}
PolicyResponse grants this one connection with policy-owned limits. HTTP 200 means authorized; other outcomes use PolicyError. CA constructs the certificate identity and principal from its original inventory facts.
Source Files