wire

type AuthConfig ¶

type AuthConfig struct {
	Issuer       string `json:"issuer"`
	ClientID     string `json:"client_id"`
	ClientSecret string `json:"client_secret,omitempty"`
}

AuthConfig tells a client how to authenticate: OIDC issuer and client credentials. This is the only auth mechanism epithet supports, so there is no type discriminator.

type Authentication ¶ added in v0.35.0

type Authentication struct {
	ID        string    `json:"id"`
	ExpiresAt time.Time `json:"expiresAt"`
}

Authentication contains CA's verified identity and session bound. It deliberately contains no bearer credentials or provider-specific claims.

func (a Authentication) Validate() error

type Connection ¶ added in v0.35.0

type Connection struct {
	RemoteHost string         `json:"remoteHost"`
	RemoteUser string         `json:"remoteUser"`
	Port       uint           `json:"port"`
	ProxyJump  string         `json:"proxyJump"`
	Hash       ConnectionHash `json:"hash"` // %C - hash of connection tuple
}

Connection represents the SSH connection parameters epithet actually uses. These come from OpenSSH's Match exec via %h/%p/%r/%j; local hostname (%l) was transmitted here too but never read anywhere downstream, so it was dropped (spec §13) along with the os.Hostname() call that populated it. The Hash field contains the %C hash value computed by OpenSSH from the full connection tuple (including local host), so it still uniquely identifies the connection even without LocalHost as a separate field.

type ConnectionHash ¶ added in v0.35.0

type ConnectionHash string

ConnectionHash is the OpenSSH %C hash value that uniquely identifies a connection. This is computed by OpenSSH from the connection parameters (local host, remote host, port, user, ProxyJump).

type CreateCertRequest ¶ added in v0.35.0

type CreateCertRequest struct {
	PublicKey  sshcert.RawPublicKey `json:"publicKey"`
	Connection Connection           `json:"connection"`
}

CreateCertRequest asks the CA for a signed cert. Both fields are required.

type CreateCertResponse ¶ added in v0.35.0

type CreateCertResponse struct {
	Certificate sshcert.RawCertificate `json:"certificate"`
}

CreateCertResponse is the CA's response to a CreateCertRequest.

type Discovery ¶

type Discovery struct {
	Auth *AuthConfig `json:"auth,omitempty"`

	// CacheControl controls login discovery caching; never serialized.
	CacheControl string `json:"-"`
}

Discovery is the discovery document: the anonymous bootstrap endpoint's entire payload. It carries only auth config — no server-advertised match patterns, since gating on those was removed.

type Host ¶ added in v0.35.0

type Host struct {
	HostResource
	Principal Principal `json:"principal"`
}

Host is one resolved inventory host: the policy-facing resource plus the principal metadata the CA needs and policy never sees.

func (h *Host) UnmarshalJSON(data []byte) error

func (h Host) Validate(target string) error

type HostResource ¶ added in v0.35.0

type HostResource struct {
	Names  []string          `json:"names"`
	Labels map[string]string `json:"labels"`
	// Nil means ungrounded; a non-nil slice restricts accounts to its members.
	// An empty slice permits no accounts. JSON decoding rejects omission.
	Accounts []string `json:"accounts"`
}

func (h *HostResource) UnmarshalJSON(data []byte) error

func (h HostResource) Validate() error

type PolicyError ¶

type PolicyError struct {
	StatusCode int
	Message    string
}

PolicyError is a policy-server error with its HTTP status.

func (e *PolicyError) Error() string

type PolicyFacts ¶ added in v0.30.0

type PolicyFacts struct {
	Authentication Authentication `json:"authentication"`
	Target         string         `json:"target"`
	User           *User          `json:"user"`
	Host           *HostResource  `json:"host"`
}

PolicyFacts is CA's normalized input for one requested target. CA validates that inventory host names include the target before projecting Host. Host.Names lists the equivalent host names, independent of principal metadata; Target binds the request. Principal construction data, revisions, and protocol versions remain at CA.

func (f *PolicyFacts) UnmarshalJSON(data []byte) error

func (f *PolicyFacts) Validate(requestedHost string) error

type PolicyResponse ¶

type PolicyResponse struct {
	// TTLSeconds is a positive whole-second lifetime, measured from CA signing.
	TTLSeconds int64             `json:"ttlSeconds"`
	Extensions map[string]string `json:"extensions"`
	// NotAfter optionally tightens the TTL and authentication-expiry bounds.
	NotAfter time.Time `json:"notAfter,omitzero"`
	PolicyID string    `json:"policyId,omitempty"`
}

PolicyResponse authorizes one connection with evaluator-owned limits. CA constructs identity and principal from facts and enforces login expiry.

type Principal ¶ added in v0.35.0

type Principal struct {
	Mode   string `json:"mode"`
	Domain string `json:"domain,omitempty"`
}

Principal tells the CA how the resolved host expects its certificate principal to be constructed.

type User ¶ added in v0.35.0

type User struct {
	ID           string   `json:"id"`
	UserName     string   `json:"userName"`
	Active       *bool    `json:"active"`
	Groups       []string `json:"groups"`
	UserType     string   `json:"userType,omitempty"`
	Department   string   `json:"department,omitempty"`
	Organization string   `json:"organization,omitempty"`
}

User contains the directory attributes used by policy. External directory protocols are translated into facts by the directory service.

func (u *User) Validate(authenticatedID string) error