facts

type Actor ¶ added in v0.41.0

type Actor struct {
	UserName     string
	ID           string
	Active       bool
	Groups       []string
	UserType     string
	Department   string
	Organization string
}

Actor carries the directory identity used for public administrative grants. Its field names preserve the private actor-snapshot JSON contract; it includes inactive identities so the public service can reject them explicitly.

type ActorSnapshot ¶ added in v0.41.0

type ActorSnapshot struct {
	User *Actor `json:"user"`
}

ActorSnapshot includes inactive users for administrative authorization checks.

type AdminClient ¶ added in v0.41.0

type AdminClient struct {
	// contains filtered or unexported fields
}

AdminClient sends public directory and inventory administration requests using the caller's bearer credential. Private provider requests signed with control's service key belong to pkg/facts/control.

func NewAdminClient(endpoint string, cfg tlsconfig.Config) (*AdminClient, error)

func (c *AdminClient) Capabilities(ctx context.Context) (Capabilities, error)

func (c *AdminClient) Control(ctx context.Context, bearer string, request ControlRequest) (*ControlResponse, int, error)

func (c *AdminClient) ListGroups(ctx context.Context, bearer string, start int) (*SCIMPage, int, error)

func (c *AdminClient) ListUsers(ctx context.Context, bearer string, start int) (*SCIMPage, int, error)

type AuditPage ¶ added in v0.43.0

type AuditPage[T any] struct {
	Events []T    `json:"events"`
	Next   string `json:"next,omitempty"`
}

AuditPage contains events and a backend-owned continuation cursor. Empty Next means there is no further page. Clients pass nonempty Next back unchanged.

type Capabilities ¶ added in v0.41.0

type Capabilities struct {
	Version      int      `json:"version"`
	Capabilities []string `json:"capabilities"`
}

Capabilities distinguishes host enrollment from directory-only administration. An unavailable or malformed endpoint is an error, never static fallback.

type ControlEnvelope ¶ added in v0.41.0

type ControlEnvelope struct {
	Request ControlRequest `json:"request"`
}

ControlEnvelope carries a private backend request. Control owns the sender; providers decode this envelope at the boundary.

type ControlRequest ¶ added in v0.41.0

type ControlRequest struct {
	After           string          `json:"after,omitempty"`
	Limit           int             `json:"limit,omitempty"`
	Pending         bool            `json:"pending,omitempty"`
	AuditCursor     string          `json:"audit-cursor,omitempty"`
	AuditLimit      int             `json:"audit-limit,omitempty"`
	Action          string          `json:"action"`
	ID              string          `json:"id,omitempty"`
	ExpectedVersion string          `json:"expected-version,omitempty"`
	Host            *InventoryInput `json:"host,omitempty"`
	Token           string          `json:"token,omitempty"`
	LifetimeSeconds int64           `json:"lifetime-seconds,omitempty"`
}

ControlRequest is one operation at the complete advertised inventory URL. An optional single-use token preapproves enrollment. Admin authentication is the OIDC bearer header. ExpectedVersion binds review/edit to the displayed record when the provider supports versioning. Host lists use exclusive After IDs and Limit (0 defaults to 100, maximum 1000); Pending filters host lists. Audits use opaque AuditCursor values and AuditLimit with the same bounds. Cursor fields survive JSON as exact values.

type ControlResponse ¶ added in v0.41.0

type ControlResponse struct {
	DirectoryAudit *AuditPage[DirectoryAuditEvent] `json:"directory-audit,omitempty"`
	Host           *HostRecord                     `json:"host,omitempty"`
	Hosts          []HostRecord                    `json:"hosts,omitempty"`
	Token          *EnrollmentToken                `json:"token,omitempty"`
	Audit          *AuditPage[HostAuditEvent]      `json:"audit,omitempty"`
	Error          string                          `json:"error,omitempty"`
}

ControlResponse carries the result of one ControlRequest. Only the fields relevant to the requested action are set; Error accompanies a non-2xx status.

type DataClient ¶ added in v0.41.0

type DataClient struct {
	// contains filtered or unexported fields
}

DataClient supplies validated authorization facts. It exposes only lookups; caller identity and management operations belong to pkg/facts/control.

func NewDataClient(directoryURL, inventoryURL string, key sshcert.RawPrivateKey, cfg tlsconfig.Config) (*DataClient, error)

func (c *DataClient) Host(ctx context.Context, name string) (*wire.Host, error)

func (c *DataClient) User(ctx context.Context, id string) (*User, error)

type DirectoryAuditEvent ¶ added in v0.41.0

type DirectoryAuditEvent struct {
	Time       time.Time `json:"time"`
	Actor      string    `json:"actor"`
	Action     string    `json:"action"`
	ID         string    `json:"id"`
	Alias      string    `json:"alias,omitempty"`
	PreviousID string    `json:"previous-id,omitempty"`
}

DirectoryAuditEvent records one directory mutation with its supplied timestamp.

type EnrollmentToken ¶ added in v0.41.0

type EnrollmentToken struct {
	ID        string    `json:"id"`
	ExpiresAt time.Time `json:"expires-at"`
	UsedBy    string    `json:"used-by,omitempty"`
	Revoked   bool      `json:"revoked"`
}

EnrollmentToken is a single-use preapproval for host enrollment.

type HostAuditEvent ¶ added in v0.41.0

type HostAuditEvent struct {
	At       time.Time `json:"at"`
	Actor    string    `json:"actor"`
	Action   string    `json:"action"`
	Resource string    `json:"resource"`
}

HostAuditEvent records one administrative change to host inventory.

type HostRecord ¶ added in v0.41.0

type HostRecord struct {
	ID        string         `json:"id"`
	Version   string         `json:"version,omitempty"`
	Status    string         `json:"status"`
	Host      InventoryInput `json:"host"`
	CreatedAt time.Time      `json:"created-at"`
	UpdatedAt time.Time      `json:"updated-at"`
}

HostRecord is one managed inventory record as administrators see it.

type InventoryCreate ¶ added in v0.43.0

type InventoryCreate struct {
	Host  *InventoryHost `json:"host"`
	Token string         `json:"token,omitempty"`
}

type InventoryHost ¶ added in v0.43.0

type InventoryHost struct {
	Name       []string           `json:"name,omitempty"`
	Attributes map[string]string  `json:"attributes"`
	Accounts   []string           `json:"accounts"`
	Principal  InventoryPrincipal `json:"principal"`
}

InventoryHost uses the fact vocabulary while retaining the managed store's string-valued attributes. Accounts must be explicit, including null or [].

func (p *InventoryHost) UnmarshalJSON(data []byte) error

type InventoryInput ¶ added in v0.43.0

type InventoryInput struct {
	Names         []string          `json:"names"`
	Labels        map[string]string `json:"labels"`
	Accounts      []string          `json:"accounts"`
	PrincipalMode string            `json:"principal-mode"`
	Realm         string            `json:"realm,omitempty"`
}

InventoryInput is the editable control-protocol payload for a host. Admission and ownership are server-owned metadata, never fields a host can approve for itself. Accounts nil means unrestricted; an empty list permits no accounts.

func (p *InventoryInput) UnmarshalJSON(data []byte) error

type InventoryPrincipal ¶ added in v0.43.0

type InventoryPrincipal struct {
	Mode  string `json:"mode"`
	Realm string `json:"realm,omitempty"`
}

type InventoryRecord ¶ added in v0.43.0

type InventoryRecord struct {
	ID        string         `json:"id"`
	Status    string         `json:"status"`
	Host      *InventoryHost `json:"host"`
	CreatedAt time.Time      `json:"createdAt"`
	UpdatedAt time.Time      `json:"updatedAt"`
}

InventoryRecord is the GET/PUT document. Version belongs exclusively in ETag and If-Match. Every stored record contains host facts.

type InventoryToken ¶ added in v0.43.0

type InventoryToken struct {
	Token     string    `json:"token"`
	ExpiresAt time.Time `json:"expiresAt"`
}

type InventoryTokenCreate ¶ added in v0.43.0

type InventoryTokenCreate struct {
	LifetimeSeconds int64 `json:"lifetimeSeconds"`
}

type Revision ¶ added in v0.41.0

type Revision struct {
	// contains filtered or unexported fields
}

Revision is optional opaque logging metadata, never a concurrency token.

func (r Revision) IsZero() bool

func (r Revision) MarshalJSON() ([]byte, error)

func (r Revision) String() string

func (r *Revision) UnmarshalJSON(data []byte) error

type SCIMPage ¶ added in v0.43.0

type SCIMPage struct {
	Schemas      []string          `json:"schemas"`
	TotalResults int               `json:"totalResults"`
	StartIndex   int               `json:"startIndex"`
	ItemsPerPage int               `json:"itemsPerPage"`
	Resources    []json.RawMessage `json:"Resources"`
}

SCIMPage is one bounded SCIM ListResponse. Resources retain their original attributes, including extensions; callers must process a page before fetching the next one rather than accumulate the directory in memory.

type ServiceError ¶ added in v0.41.0

type ServiceError struct {
	Status  int
	Message string
}

ServiceError preserves a rejected operation's message and protocol status for the public HTTP adapter. Callers can use errors.Is for domain error categories.

func (e *ServiceError) Error() string

func (e *ServiceError) Is(target error) bool

type User ¶

type User struct {
	ID         string            `json:"id"`
	Names      object.Strings    `json:"name"`
	UserName   string            `json:"userName,omitempty"`
	Attributes object.Attributes `json:"attributes,omitempty"`
	Groups     []object.Object   `json:"groups"`
	Revision   Revision          `json:"revision,omitzero"`
}

func (u User) PolicyUser() wire.User