wire

type AuthConfig ¶

type AuthConfig struct {
	Issuer       string `json:"issuer"`
	ClientID     string `json:"client_id"`
	ClientSecret string `json:"client_secret,omitempty"`
}

AuthConfig tells a client how to authenticate: OIDC issuer and client credentials. This is the only auth mechanism epithet supports, so there is no type discriminator.

type Authentication ¶ added in v0.35.0

type Authentication struct {
	ID        string    `json:"id"`
	ExpiresAt time.Time `json:"expiresAt"`
}

Authentication contains inventory's verified identity and session bound. It deliberately contains no bearer credentials or provider-specific claims.

func (a Authentication) Validate() error

type Connection ¶ added in v0.35.0

type Connection struct {
	RemoteHost string         `json:"remoteHost"`
	RemoteUser string         `json:"remoteUser"`
	Port       uint           `json:"port"`
	ProxyJump  string         `json:"proxyJump"`
	Hash       ConnectionHash `json:"hash"` // %C - hash of connection tuple
}

Connection represents the SSH connection parameters epithet actually uses. These come from OpenSSH's Match exec via %h/%p/%r/%j; local hostname (%l) was transmitted here too but never read anywhere downstream, so it was dropped (spec §13) along with the os.Hostname() call that populated it. The Hash field contains the %C hash value computed by OpenSSH from the full connection tuple (including local host), so it still uniquely identifies the connection even without LocalHost as a separate field.

type ConnectionHash ¶ added in v0.35.0

type ConnectionHash string

ConnectionHash is the OpenSSH %C hash value that uniquely identifies a connection. This is computed by OpenSSH from the connection parameters (local host, remote host, port, user, ProxyJump).

type CreateCertRequest ¶ added in v0.35.0

type CreateCertRequest struct {
	PublicKey  sshcert.RawPublicKey `json:"publicKey"`
	Connection Connection           `json:"connection"`
}

CreateCertRequest asks the CA for a signed cert. Both fields are required.

type CreateCertResponse ¶ added in v0.35.0

type CreateCertResponse struct {
	Certificate sshcert.RawCertificate `json:"certificate"`
}

CreateCertResponse is the CA's response to a CreateCertRequest.

type DirectorySnapshot ¶ added in v0.35.0

type DirectorySnapshot struct {
	Revision string `json:"revision"`
	User     *User  `json:"user"`
}

func (d *DirectorySnapshot) UnmarshalJSON(data []byte) error

type Discovery ¶

type Discovery struct {
	Auth *AuthConfig `json:"auth,omitempty"`

	// CacheControl carries the upstream Cache-Control header; never serialized.
	CacheControl string `json:"-"`
}

Discovery is the discovery document: the anonymous bootstrap endpoint's entire payload. It carries only auth config — no server-advertised match patterns, since gating on those was removed.

type Host ¶ added in v0.35.0

type Host struct {
	HostResource
	Principal Principal `json:"principal"`
}

Host is one resolved inventory host: the policy-facing resource plus the principal metadata the CA needs and policy never sees.

func (h *Host) UnmarshalJSON(data []byte) error

type HostResource ¶ added in v0.35.0

type HostResource struct {
	Names  []string          `json:"names"`
	Labels map[string]string `json:"labels"`
	// Nil means ungrounded; a non-nil slice restricts accounts to its members.
	// An empty slice permits no accounts. JSON decoding rejects omission.
	Accounts []string `json:"accounts"`
}

func (h *HostResource) UnmarshalJSON(data []byte) error

func (h HostResource) Validate() error

type HostSnapshot ¶ added in v0.35.0

type HostSnapshot struct {
	Revision string `json:"revision"`
	Host     *Host  `json:"host"`
}

func (h *HostSnapshot) UnmarshalJSON(data []byte) error

type PolicyError ¶

type PolicyError struct {
	StatusCode int
	Message    string
}

PolicyError is a policy-server error with its HTTP status.

func (e *PolicyError) Error() string

type PolicyFacts ¶ added in v0.30.0

type PolicyFacts struct {
	Authentication Authentication `json:"authentication"`
	Target         string         `json:"target"`
	User           *User          `json:"user"`
	Host           *HostResource  `json:"host"`
}

PolicyFacts is CA's normalized input for one requested target. CA validates the inventory's host/domain binding before projecting Host. Host.Names lists the equivalent host names or the shared principal domain; Target binds the request. Principal construction data, revisions, and protocol versions remain at CA.

func (f *PolicyFacts) UnmarshalJSON(data []byte) error

func (f *PolicyFacts) Validate(requestedHost string) error

type PolicyRequest ¶

type PolicyRequest struct {
	Facts      *PolicyFacts `json:"facts"`
	Connection Connection   `json:"connection"`
}

PolicyRequest is the CA→policy-server cert evaluation request body.

type PolicyResponse ¶

type PolicyResponse struct {
	// TTLSeconds is a positive whole-second lifetime, measured from CA signing.
	TTLSeconds int64             `json:"ttlSeconds"`
	Extensions map[string]string `json:"extensions"`
	// NotAfter is an optional absolute policy deadline. Zero means TTL alone
	// determines expiry. Policies that bound certificates to authentication
	// expiry must return that bound here.
	NotAfter time.Time `json:"notAfter,omitzero"`
	PolicyID string    `json:"policyId,omitempty"`
}

PolicyResponse grants this one connection with policy-owned limits. HTTP 200 means authorized; other outcomes use PolicyError. CA constructs the certificate identity and principal from its original inventory facts. Policy owns active-user and account restrictions and whether certificate lifetime is bounded by authentication expiry; CA does not impose them.

type Principal ¶ added in v0.35.0

type Principal struct {
	Mode   string `json:"mode"`
	Domain string `json:"domain,omitempty"`
}

Principal tells the CA how the resolved host expects its certificate principal to be constructed.

type Resolution ¶ added in v0.35.0

type Resolution struct {
	Version        int               `json:"version"`
	Authentication Authentication    `json:"authentication"`
	Target         string            `json:"target"`
	Directory      DirectorySnapshot `json:"directory"`
	Inventory      HostSnapshot      `json:"inventory"`
}

func (r *Resolution) Validate(host string) error

type ResolveRequest ¶ added in v0.35.0

type ResolveRequest struct {
	Token string `json:"token"`
	Host  string `json:"host"`
}

ResolveRequest asks inventory for the facts bound to one authenticated identity (the bearer token) and one normalized target host.

type User ¶ added in v0.35.0

type User struct {
	ID           string   `json:"id"`
	UserName     string   `json:"userName"`
	Active       *bool    `json:"active"`
	Groups       []string `json:"groups"`
	UserType     string   `json:"userType,omitempty"`
	Department   string   `json:"department,omitempty"`
	Organization string   `json:"organization,omitempty"`
}

User contains the directory attributes used by policy. External directory protocols are translated into these facts at the inventory boundary.

func (u *User) Validate(authenticatedID string) error