auth

package
v0.99.17 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: GPL-3.0 Imports: 7 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	ScopeAdmin        = "admin:*"
	ScopeAdminMetrics = "admin:metrics"

	ScopeHubAppsRead         = "hub:apps:read"
	ScopeHubAppsStatus       = "hub:apps:status"
	ScopeHubAppsLogs         = "hub:apps:logs"
	ScopeHubAppsStart        = "hub:apps:start"
	ScopeHubAppsStop         = "hub:apps:stop"
	ScopeHubAppsRestart      = "hub:apps:restart"
	ScopeHubAppsPull         = "hub:apps:pull"
	ScopeHubAppsUpdate       = "hub:apps:update"
	ScopeHubCapabilitiesRead = "hub:capabilities:read"
	ScopeHubHealthRead       = "hub:health:read"

	ScopeServiceKarakeepRead      = "service:karakeep:read"
	ScopeServiceKarakeepWrite     = "service:karakeep:write"
	ScopeServiceMinifluxRead      = "service:miniflux:read"
	ScopeServiceMinifluxWrite     = "service:miniflux:write"
	ScopeServiceKanboardRead      = "service:kanboard:read"
	ScopeServiceKanboardWrite     = "service:kanboard:write"
	ScopeServiceTriliumRead       = "service:trilium:read"
	ScopeServiceTriliumWrite      = "service:trilium:write"
	ScopeServiceMemosRead         = "service:memos:read"
	ScopeServiceMemosWrite        = "service:memos:write"
	ScopeServiceFireflyiiiRead    = "service:fireflyiii:read"
	ScopeServiceFireflyiiiWrite   = "service:fireflyiii:write"
	ScopeServiceTransmissionRead  = "service:transmission:read"
	ScopeServiceTransmissionWrite = "service:transmission:write"
	ScopeServiceEmailRead         = "service:email:read"
	ScopeServiceEmailWrite        = "service:email:write"
	ScopeServiceNocodbRead        = "service:nocodb:read"
	ScopeServiceNocodbWrite       = "service:nocodb:write"
	ScopeServiceGiteaRead         = "service:gitea:read"
	ScopeServiceGiteaWrite        = "service:gitea:write"
	ScopeServiceGithubRead        = "service:github:read"
	ScopeServiceGithubWrite       = "service:github:write"
	ScopeServiceTrelloRead        = "service:trello:read"
	ScopeServiceTrelloWrite       = "service:trello:write"
	ScopeServiceConfluenceRead    = "service:confluence:read"
	ScopeServiceConfluenceWrite   = "service:confluence:write"
	ScopeServiceDevopsRead        = "service:devops:read"
	ScopeServiceDevopsWrite       = "service:devops:write" // reserved for future mutations
	ScopeServiceExampleRead       = "service:example:read"
	ScopeServiceExampleWrite      = "service:example:write"

	// Legacy Go constant aliases (same string as provider scopes). Prefer provider-scoped constants.
	ScopeServiceBookmarkRead  = ScopeServiceKarakeepRead
	ScopeServiceBookmarkWrite = ScopeServiceKarakeepWrite
	ScopeServiceReaderRead    = ScopeServiceMinifluxRead
	ScopeServiceReaderWrite   = ScopeServiceMinifluxWrite
	ScopeServiceKanbanRead    = ScopeServiceKanboardRead
	ScopeServiceKanbanWrite   = ScopeServiceKanboardWrite
	ScopeServiceNoteRead      = ScopeServiceTriliumRead
	ScopeServiceNoteWrite     = ScopeServiceTriliumWrite
	ScopeServiceMemoRead      = ScopeServiceMemosRead
	ScopeServiceMemoWrite     = ScopeServiceMemosWrite
	ScopeServiceForgeRead     = ScopeServiceGiteaRead
	ScopeServiceForgeWrite    = ScopeServiceGiteaWrite
	ScopeServiceArchiveRead   = "service:archive:read"
	ScopeServiceArchiveWrite  = "service:archive:write"
	ScopeServiceInfraRead     = "service:infra:read"
	ScopeServiceShellRead     = "service:shell-history:read"

	ScopePipelineRead  = "pipeline:read"
	ScopePipelineRun   = "pipeline:run"
	ScopeFunctionRead  = "function:read"
	ScopeFunctionRun   = "function:run"
	ScopeWorkflowRead  = "workflow:read"
	ScopeWorkflowRun   = "workflow:run"
	ScopeChatAgentChat = "chatagent:chat"
	// ScopeGatewayWorker authorizes cmd/gateway claim/result/heartbeat APIs.
	ScopeGatewayWorker = "gateway:worker"
	// ScopeAgentHeadless authorizes flowbot-agent LLM proxy (OpenAI-compatible completions).
	ScopeAgentHeadless = "agent:headless"
	// ScopeLineageRead allows reading event correlation and causation links.
	ScopeLineageRead = "lineage:read"
	// ScopeAuditRead allows reading the caller's own audit rows. admin:* reads every row.
	ScopeAuditRead = "audit:read"
)

Variables

This section is empty.

Functions

func CanGrantScopes 

func CanGrantScopes(callerScopes, requested []string) bool

CanGrantScopes reports whether callerScopes may mint every scope in requested. admin:* may grant any scope; otherwise each requested scope must already be held.

func ExtractBearerToken 

func ExtractBearerToken(authorization string) string

func HasAnyScope added in v0.96.0 

func HasAnyScope(scopes []string) bool

HasAnyScope reports whether scopes is non-empty after trimming blank entries.

func HasMinimumServiceScope added in v0.96.0 

func HasMinimumServiceScope(scopes []string, group, method string) bool

HasMinimumServiceScope reports whether scopes satisfy the default /service/{group} gate. Write scopes satisfy read for the same provider group; pipeline:run satisfies pipeline:read; function:run satisfies function:read; workflow:run satisfies workflow:read.

func HasScope 

func HasScope(scopes []string, required string) bool

HasScope reports whether scopes includes the required scope or admin:*. Legacy domain scope strings (e.g. service:bookmark:read) match their provider equivalents.

func HashToken 

func HashToken(token string) string

func MCPReadScopes 

func MCPReadScopes() []string

MCPReadScopes is the MCP wizard read-only preset. It is the hub read scopes used by MCP, every service:*:read scope, and the automate read scopes.

func MCPRunScopes 

func MCPRunScopes() []string

MCPRunScopes is the read preset plus pipeline, function, and workflow run. Those three run scopes also authorize apply and delete on the automate HTTP API.

func MinimumServiceScope added in v0.96.0 

func MinimumServiceScope(group, method string) string

MinimumServiceScope returns the default minimum scope for /service/{group} routes. Web UI routes require admin:* (full browser sessions). Automate REST groups map to function:*/pipeline:*/workflow:*; hub module routes map to hub:capabilities:read; provider modules use service:{group}:read|write.

func NewToken 

func NewToken() (string, error)

func ServiceScope added in v0.96.0 

func ServiceScope(group, action string) string

ServiceScope builds the canonical service:{group}:{action} scope string.

func TokenPrefix 

func TokenPrefix(token string) string

Types

type Context 

type Context struct {
	SubjectType SubjectType `json:"subject_type"`
	SubjectID   string      `json:"subject_id"`
	UID         types.Uid   `json:"uid"`
	Topic       string      `json:"topic"`
	Scopes      []string    `json:"scopes"`
	IPAddress   string      `json:"ip_address,omitempty"`
	UserAgent   string      `json:"user_agent,omitempty"`
}

func SystemCronContext 

func SystemCronContext() Context

func SystemPipelineContext 

func SystemPipelineContext() Context

func SystemWorkflowContext 

func SystemWorkflowContext() Context

func (Context) HasScope 

func (c Context) HasScope(scope string) bool

type ScopeInfo 

type ScopeInfo struct {
	Value       string
	Description string
}

ScopeInfo describes an available scope for token creation.

func AllScopes 

func AllScopes() []ScopeInfo

AllScopes returns all scopes available for CLI token creation.

func MCPWizardScopes 

func MCPWizardScopes() []ScopeInfo

MCPWizardScopes returns scopes the MCP wizard may grant. admin:* is omitted.

type SubjectType 

type SubjectType string
const (
	SubjectUser     SubjectType = "user"
	SubjectToken    SubjectType = "token"
	SubjectCron     SubjectType = "cron"
	SubjectPipeline SubjectType = "pipeline"
	SubjectWorkflow SubjectType = "workflow"
	SubjectAgent    SubjectType = "agent"
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.