migration

package
v0.22.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 24, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ConvertCheckerConfig 

func ConvertCheckerConfig(node *yaml.Node) (string, any)

ConvertCheckerConfig converts a checker config YAML node to a (type, config) pair suitable for JSON storage, transforming any trust_anchors from inline TrustAnchor objects to []string entity-id references.

func ExtractCheckerTrustAnchorIDs 

func ExtractCheckerTrustAnchorIDs(node *yaml.Node) []string

ExtractCheckerTrustAnchorIDs walks a checker config YAML node and extracts all trust_anchor entity IDs found in trust_anchors fields.

func IsValidSection 

func IsValidSection(s Section) bool

IsValidSection checks if a section is valid

func ParseJWKSFile 

func ParseJWKSFile(path string) (*model.JWKS, error)

ParseJWKSFile reads and parses a JWKS file into a model.JWKS.

func ParseJWKSFromAny 

func ParseJWKSFromAny(raw any) (*model.JWKS, error)

ParseJWKSFromAny marshals an arbitrary value to JSON and parses it as a JWKS.

func ParseSkipSections 

func ParseSkipSections(s string) (map[Section]bool, error)

ParseSkipSections parses sections to skip

func StrPtrOrNil 

func StrPtrOrNil(s string) *string

StrPtrOrNil returns a *string for a non-empty s, or nil for empty.

Types

type AuthConf 

type AuthConf struct {
	AllRequireAuth bool              `yaml:"all_require_auth"`
	TrustAnchors   []TrustAnchorConf `yaml:"trust_anchors"`
}

AuthConf holds global endpoint auth config.

type CheckerConfig 

type CheckerConfig struct {
	Type   string         `yaml:"type"`
	Config map[string]any `yaml:"config"`
}

CheckerConfig holds entity checker config for migration

type CollectionDBConfigJSON 

type CollectionDBConfigJSON struct {
	AllowedTrustAnchors []string `json:"allowed_trust_anchors,omitempty"`
	IntervalSeconds     int64    `json:"interval_seconds,omitempty"`
	ConcurrencyLimit    int      `json:"concurrency_limit,omitempty"`
	PaginationLimit     int      `json:"pagination_limit,omitempty"`
}

CollectionDBConfigJSON is the JSON config struct for the entity collection endpoint's type-specific config.

type CollectionEndpointConf 

type CollectionEndpointConf struct {
	Path                string                  `yaml:"path"`
	URL                 string                  `yaml:"url"`
	AuthEnabled         bool                    `yaml:"auth_enabled"`
	AuthTrustAnchors    []string                `yaml:"auth_trust_anchors"`
	AllowedTrustAnchors []string                `yaml:"allowed_trust_anchors"`
	Interval            duration.DurationOption `yaml:"interval"`
	ConcurrencyLimit    int                     `yaml:"concurrency_limit"`
	PaginationLimit     int                     `yaml:"pagination_limit"`
}

CollectionEndpointConf holds entity collection endpoint config.

type Config 

type Config struct {
	Signing    SigningConf    `yaml:"signing"`
	Federation FederationConf `yaml:"federation_data"`
	Endpoints  EndpointsConf  `yaml:"endpoints"`
}

Config is a config struct that can parse both legacy and current config formats for migration purposes. It includes all fields that need to be migrated to the database.

type EndpointsConf 

type EndpointsConf struct {
	Fetch            FetchEndpointConf      `yaml:"fetch"`
	List             SimpleEndpointConf     `yaml:"list"`
	Resolve          ResolveEndpointConf    `yaml:"resolve"`
	TrustMarkStatus  SimpleEndpointConf     `yaml:"trust_mark_status"`
	TrustMarkList    SimpleEndpointConf     `yaml:"trust_mark_list"`
	TrustMark        TrustMarkEndpointConf  `yaml:"trust_mark"`
	HistoricalKeys   SimpleEndpointConf     `yaml:"historical_keys"`
	Enroll           EnrollEndpointConf     `yaml:"enroll"`
	EnrollRequest    SimpleEndpointConf     `yaml:"enroll_request"`
	TrustMarkRequest SimpleEndpointConf     `yaml:"trust_mark_request"`
	EntityCollection CollectionEndpointConf `yaml:"entity_collection"`
	Auth             AuthConf               `yaml:"auth"`
}

EndpointsConf holds endpoint config values that should be migrated to DB.

type EnrollDBConfigJSON 

type EnrollDBConfigJSON struct {
	CheckerType   string `json:"checker_type,omitempty"`
	CheckerConfig any    `json:"checker_config,omitempty"`
}

EnrollDBConfigJSON is the JSON config struct for the enroll endpoint's type-specific config.

type EnrollEndpointConf 

type EnrollEndpointConf struct {
	Path             string    `yaml:"path"`
	URL              string    `yaml:"url"`
	AuthEnabled      bool      `yaml:"auth_enabled"`
	AuthTrustAnchors []string  `yaml:"auth_trust_anchors"`
	Checker          yaml.Node `yaml:"checker"`
}

EnrollEndpointConf holds enroll endpoint config with entity checker.

type FederationConf 

type FederationConf struct {
	AuthorityHints               []string                        `yaml:"authority_hints"`
	TrustAnchors                 []TrustAnchorConf               `yaml:"trust_anchors"`
	Constraints                  *oidfed.ConstraintSpecification `yaml:"constraints"`
	MetadataPolicyCrit           []oidfed.PolicyOperatorName     `yaml:"metadata_policy_crit"`
	MetadataPolicyFile           string                          `yaml:"metadata_policy_file"`
	ConfigurationLifetime        duration.DurationOption         `yaml:"configuration_lifetime"`
	Metadata                     FederationMetadataConf          `yaml:"federation_entity_metadata"`
	ExtraEntityConfigurationData map[string]any                  `yaml:"extra_entity_configuration_data"`

	TrustMarks       []TrustMarkConfig               `yaml:"trust_marks"`
	TrustMarkIssuers oidfed.AllowedTrustMarkIssuers  `yaml:"trust_mark_issuers"`
	TrustMarkOwners  map[string]TrustMarkOwnerConfig `yaml:"trust_mark_owners"`
}

FederationConf holds federation config values that should be migrated to DB

type FederationMetadataConf 

type FederationMetadataConf struct {
	DisplayName      string         `yaml:"display_name"`
	Description      string         `yaml:"description"`
	Keywords         []string       `yaml:"keywords"`
	Contacts         []string       `yaml:"contacts"`
	LogoURI          string         `yaml:"logo_uri"`
	PolicyURI        string         `yaml:"policy_uri"`
	InformationURI   string         `yaml:"information_uri"`
	OrganizationName string         `yaml:"organization_name"`
	OrganizationURI  string         `yaml:"organization_uri"`
	Extra            map[string]any `yaml:"extra"`
}

FederationMetadataConf holds federation entity metadata

func (*FederationMetadataConf) ToOIDFedMetadata 

func (m *FederationMetadataConf) ToOIDFedMetadata() *oidfed.Metadata

ToOIDFedMetadata converts the migration metadata to oidfed.Metadata

type FetchEndpointConf 

type FetchEndpointConf struct {
	Path              string                  `yaml:"path"`
	URL               string                  `yaml:"url"`
	AuthEnabled       bool                    `yaml:"auth_enabled"`
	AuthTrustAnchors  []string                `yaml:"auth_trust_anchors"`
	StatementLifetime duration.DurationOption `yaml:"statement_lifetime"`
}

FetchEndpointConf holds fetch endpoint config

type InvalidSectionError 

type InvalidSectionError struct {
	Section string
}

InvalidSectionError is returned when an invalid section is specified

func (*InvalidSectionError) Error 

func (e *InvalidSectionError) Error() string

type ProactiveResolverConf 

type ProactiveResolverConf struct {
	Enabled          bool `yaml:"enabled"`
	ConcurrencyLimit int  `yaml:"concurrency_limit"`
	QueueSize        int  `yaml:"queue_size"`
	ResponseStorage  struct {
		Dir       string `yaml:"dir"`
		StoreJSON bool   `yaml:"store_json"`
		StoreJWT  bool   `yaml:"store_jwt"`
	} `yaml:"response_storage"`
}

ProactiveResolverConf holds proactive resolver config.

type ProactiveResolverDBConfigJSON 

type ProactiveResolverDBConfigJSON struct {
	Enabled                  bool   `json:"enabled"`
	ConcurrencyLimit         int    `json:"concurrency_limit,omitempty"`
	QueueSize                int    `json:"queue_size,omitempty"`
	ResponseStorageDir       string `json:"response_storage_dir,omitempty"`
	ResponseStorageStoreJSON bool   `json:"response_storage_store_json,omitempty"`
	ResponseStorageStoreJWT  bool   `json:"response_storage_store_jwt,omitempty"`
}

ProactiveResolverDBConfigJSON is the JSON config struct for the proactive resolver sub-config of the resolve endpoint.

type ResolveDBConfigJSON 

type ResolveDBConfigJSON struct {
	AllowedTrustAnchors                    []string                       `json:"allowed_trust_anchors,omitempty"`
	UseEntityCollectionAllowedTrustAnchors bool                           `json:"use_entity_collection_allowed_trust_anchors,omitempty"`
	GracePeriodSeconds                     int64                          `json:"grace_period_seconds,omitempty"`
	TimeElapsedGraceFactor                 float64                        `json:"time_elapsed_grace_factor,omitempty"`
	ProactiveResolver                      *ProactiveResolverDBConfigJSON `json:"proactive_resolver,omitempty"`
}

ResolveDBConfigJSON is the JSON config struct for the resolve endpoint's type-specific config stored in the federation_endpoints table.

type ResolveEndpointConf 

type ResolveEndpointConf struct {
	Path                                   string                  `yaml:"path"`
	URL                                    string                  `yaml:"url"`
	AuthEnabled                            bool                    `yaml:"auth_enabled"`
	AuthTrustAnchors                       []string                `yaml:"auth_trust_anchors"`
	AllowedTrustAnchors                    []string                `yaml:"allowed_trust_anchors"`
	UseEntityCollectionAllowedTrustAnchors bool                    `yaml:"use_entity_collection_allowed_trust_anchors"`
	GracePeriod                            duration.DurationOption `yaml:"grace_period"`
	TimeElapsedGraceFactor                 float64                 `yaml:"time_elapsed_grace_factor"`
	ProactiveResolver                      ProactiveResolverConf   `yaml:"proactive_resolver"`
}

ResolveEndpointConf holds resolve endpoint config.

type Section 

type Section string

Section represents which sections to migrate/configure 

const (
	SectionSigning                     Section = "signing"
	SectionFederation                  Section = "federation"
	SectionTrustMarkSpecs              Section = "trust_mark_specs"
	SectionTrustMarks                  Section = "trust_marks"
	SectionAuthorityHints              Section = "authority_hints"
	SectionMetadata                    Section = "metadata"
	SectionConstraints                 Section = "constraints"
	SectionMetadataPolicyCrit          Section = "metadata_policy_crit"
	SectionMetadataPolicies            Section = "metadata_policies"
	SectionConfigLifetime              Section = "config_lifetime"
	SectionStatementLifetime           Section = "statement_lifetime"
	SectionAlg                         Section = "alg"
	SectionRSAKeyLen                   Section = "rsa_key_len"
	SectionKeyRotation                 Section = "key_rotation"
	SectionTrustMarkIssuers            Section = "trust_mark_issuers"
	SectionTrustMarkOwners             Section = "trust_mark_owners"
	SectionExtraEntityConfigData       Section = "extra_entity_config"
	SectionSubordinateAdditionalClaims Section = "subordinate_additional_claims"
	SectionTrustAnchors                Section = "trust_anchors"
	SectionEndpoints                   Section = "endpoints"
)

func AllSections 

func AllSections() []Section

AllSections returns all available migration/config sections

func ParseSections 

func ParseSections(s string) ([]Section, error)

ParseSections parses a comma-separated list of sections

type SelfIssuanceSpec 

type SelfIssuanceSpec struct {
	Lifetime                 int            `yaml:"lifetime"`
	Ref                      string         `yaml:"ref"`
	LogoURI                  string         `yaml:"logo_uri"`
	AdditionalClaims         map[string]any `yaml:"additional_claims"`
	IncludeExtraClaimsInInfo bool           `yaml:"include_extra_claims_in_info"`
}

SelfIssuanceSpec holds self-issuance specification for trust marks

type SigningConf 

type SigningConf struct {
	Alg       string `yaml:"alg"`
	RSAKeyLen int    `yaml:"rsa_key_len"`

	KeyRotation struct {
		Enabled                             bool                    `yaml:"enabled"`
		Interval                            duration.DurationOption `yaml:"interval"`
		Overlap                             duration.DurationOption `yaml:"overlap"`
		KeyAnnouncementLeadTime             duration.DurationOption `yaml:"key_announcement_lead_time"`
		KeyAnnouncementLeadTimeECMultiplier float64                 `yaml:"key_announcement_lead_time_ec_multiplier"`
	} `yaml:"key_rotation"`

	AutomaticKeyRollover struct {
		Enabled  bool                    `yaml:"enabled"`
		Interval duration.DurationOption `yaml:"interval"`
	} `yaml:"automatic_key_rollover"`
}

SigningConf holds signing config values that should be migrated to DB

type SimpleEndpointConf 

type SimpleEndpointConf struct {
	Path             string   `yaml:"path"`
	URL              string   `yaml:"url"`
	AuthEnabled      bool     `yaml:"auth_enabled"`
	AuthTrustAnchors []string `yaml:"auth_trust_anchors"`
}

SimpleEndpointConf holds path/url/auth for a simple endpoint.

type TrustAnchorConf 

type TrustAnchorConf struct {
	EntityID         string                  `yaml:"entity_id"`
	JWKSFile         string                  `yaml:"jwks_file"`
	JWKS             any                     `yaml:"jwks"`
	EnableJWKSUpdate bool                    `yaml:"enable_jwks_update"`
	KeyPollInterval  duration.DurationOption `yaml:"key_poll_interval"`
}

TrustAnchorConf holds a trust anchor from the old config file.

type TrustMarkConfig 

type TrustMarkConfig struct {
	TrustMarkType      string                  `yaml:"trust_mark_type"`
	TrustMarkIssuer    string                  `yaml:"trust_mark_issuer"`
	TrustMarkJWT       string                  `yaml:"trust_mark_jwt"`
	Refresh            bool                    `yaml:"refresh"`
	MinLifetime        duration.DurationOption `yaml:"min_lifetime"`
	RefreshGracePeriod duration.DurationOption `yaml:"refresh_grace_period"`
	RefreshRateLimit   duration.DurationOption `yaml:"refresh_rate_limit"`
	SelfIssuanceSpec   *SelfIssuanceSpec       `yaml:"self_issuance_spec"`
}

TrustMarkConfig holds entity configuration trust mark config for migration

type TrustMarkEndpointConf 

type TrustMarkEndpointConf struct {
	Path             string              `yaml:"path"`
	URL              string              `yaml:"url"`
	AuthEnabled      bool                `yaml:"auth_enabled"`
	AuthTrustAnchors []string            `yaml:"auth_trust_anchors"`
	TrustMarkSpecs   []TrustMarkSpecConf `yaml:"trust_mark_specs"`
}

TrustMarkEndpointConf holds trust mark endpoint config

type TrustMarkOwnerConfig 

type TrustMarkOwnerConfig struct {
	EntityID string `yaml:"entity_id"`
	JWKS     any    `yaml:"jwks"`
}

TrustMarkOwnerConfig holds trust mark owner config for migration

type TrustMarkSpecConf 

type TrustMarkSpecConf struct {
	TrustMarkType string         `yaml:"trust_mark_type"`
	Lifetime      uint           `yaml:"lifetime"`
	Ref           string         `yaml:"ref"`
	LogoURI       string         `yaml:"logo_uri"`
	DelegationJWT string         `yaml:"delegation_jwt"`
	Extra         map[string]any `yaml:"-"`

	Checker *CheckerConfig `yaml:"checker"`
}

TrustMarkSpecConf holds trust mark spec config for migration

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.