Documentation
¶
Index ¶
- type AuthCache
- func (c *AuthCache) Clear()
- func (c *AuthCache) Enabled() bool
- func (c *AuthCache) Stats() (int64, int64, int)
- func (c *AuthCache) VerifyKey(ctx context.Context, keyID, plainKey, storedHash string) (bool, error)
- func (c *AuthCache) VerifyPassword(ctx context.Context, userID, password, storedHash string) (bool, error)
- type AuthCacheConfig
- type RevocationHandle
- type RevocationRegistry
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AuthCache ¶
type AuthCache struct {
// contains filtered or unexported fields
}
AuthCache provides caching for password verification results to avoid expensive argon2id re-computation on every request.
func NewAuthCache ¶
func NewAuthCache(cfg AuthCacheConfig) *AuthCache
NewAuthCache creates a new authentication cache.
type AuthCacheConfig ¶
AuthCacheConfig holds configuration for the auth cache.
type RevocationHandle ¶ added in v0.16.0
type RevocationHandle struct {
// contains filtered or unexported fields
}
RevocationHandle is held by a live proxy session for as long as it relies on a particular grant. Its flag is flipped to true the instant that grant is revoked, so the session's per-command check and its limit watchdog observe the revocation without a database round-trip on every query.
All methods are nil-safe: a session that could not obtain a handle (e.g. a nil registry in a test) treats itself as never-revoked.
func (*RevocationHandle) Flag ¶ added in v0.16.0
func (h *RevocationHandle) Flag() *atomic.Bool
Flag exposes the underlying atomic flag so a limit watchdog can poll it cheaply (a single atomic load) alongside the byte/time checks. Returns nil for a nil handle, which downstream guards treat as "no revocation to watch".
func (*RevocationHandle) Revoked ¶ added in v0.16.0
func (h *RevocationHandle) Revoked() bool
Revoked reports whether the grant backing this handle has been revoked.
type RevocationRegistry ¶ added in v0.16.0
type RevocationRegistry struct {
// contains filtered or unexported fields
}
RevocationRegistry is an in-process fan-out from the API's grant-revoke path to the live proxy sessions that authenticated under those grants. It lets a revocation take effect on already-established connections — blocking their next query and tearing the session down — instead of only being consulted at connect time.
It carries no database state: it maps a grant UID to the set of live session handles depending on it. Revoke flips their flags; the sessions' existing LimitGuard watchdog and checkQuotas paths do the rest.
func NewRevocationRegistry ¶ added in v0.16.0
func NewRevocationRegistry() *RevocationRegistry
NewRevocationRegistry creates an empty registry.
func (*RevocationRegistry) Deregister ¶ added in v0.16.0
func (r *RevocationRegistry) Deregister(grantUID uuid.UUID, h *RevocationHandle)
Deregister drops a handle previously returned by Register. Safe to call with a nil registry/handle or a handle that was never registered.
func (*RevocationRegistry) Register ¶ added in v0.16.0
func (r *RevocationRegistry) Register(grantUID uuid.UUID) *RevocationHandle
Register records a live session that relies on grantUID and returns its handle. Deregister must be called when the session ends. Calling on a nil registry, or with uuid.Nil, still returns a usable (never-revoked) handle so callers never have to nil-check the result.
func (*RevocationRegistry) Revoke ¶ added in v0.16.0
func (r *RevocationRegistry) Revoke(grantUID uuid.UUID) int
Revoke flips the revoked flag on every live session bound to grantUID and returns the number of sessions signaled. Safe to call for a grant with no live sessions (returns 0). It does not deregister the handles — the sessions tear themselves down and Deregister on the way out.
Source Files