Documentation
¶
Overview ¶
Package platform implements a multi-tenant platform plugin for Hanzo Base.
Each tenant (org) gets isolated collections with prefix-based namespacing. Authentication is handled via Hanzo IAM (hanzo.id) OAuth2 and secrets via Hanzo KMS (kms.hanzo.ai) Universal Auth.
Example:
platform.MustRegister(app, platform.PlatformConfig{
IAMEndpoint: "https://hanzo.id",
KMSEndpoint: "https://kms.hanzo.ai",
IAMClientID: "my-client-id",
IAMClientSecret: "my-client-secret",
})
Index ¶
- Constants
- func CreateTenantCollections(app core.App, tenantSlug string, templates []CollectionTemplate) error
- func CreateTenantProject(tenantSlug string, config PlatformConfig) (string, error)
- func DeleteTenantCollections(app core.App, tenantSlug string) error
- func ExchangeOAuth2Token(code, redirectURI string, config PlatformConfig) (accessToken, refreshToken string, err error)
- func FetchSecret(path string, config PlatformConfig) (string, error)
- func ListTenantCollections(app core.App, tenantSlug string) ([]string, error)
- func MustRegister(app core.App, config PlatformConfig)
- func Register(app core.App, config PlatformConfig) error
- func ScopedQuery(tenantSlug, collection string) string
- func TenantPrefix(slug string) string
- type AuthProxyConfig
- type CollectionTemplate
- type ComplianceClient
- func (c *ComplianceClient) CreateApplication(givenName, familyName, email, country string) (string, error)
- func (c *ComplianceClient) Enabled() bool
- func (c *ComplianceClient) GetKYCStatus(applicationID string) (*ComplianceStatus, error)
- func (c *ComplianceClient) InitiateKYC(applicationID, provider string) (verificationID, redirectURL string, err error)
- func (c *ComplianceClient) ScreenIndividual(givenName, familyName, country string) (*ScreeningResult, error)
- func (c *ComplianceClient) ValidatePayment(fromID, toID string, amount float64, currency, jurisdiction string) (approved bool, reason string, err error)
- type ComplianceStatus
- type IAMClient
- type IAMUser
- type KMSClient
- type PlatformConfig
- type ScreeningResult
Constants ¶
const ( // Member roles. RoleOwner = "owner" RoleAdmin = "admin" RoleMember = "member" RoleViewer = "viewer" )
Variables ¶
This section is empty.
Functions ¶
func CreateTenantCollections ¶
func CreateTenantCollections(app core.App, tenantSlug string, templates []CollectionTemplate) error
CreateTenantCollections creates prefixed collections for a tenant from the given templates. Each template's Name is prefixed with t_{slug}_.
Collections that already exist are skipped.
func CreateTenantProject ¶
func CreateTenantProject(tenantSlug string, config PlatformConfig) (string, error)
CreateTenantProject creates a KMS project (workspace environment) for a tenant identified by slug. Returns the project/environment ID.
func DeleteTenantCollections ¶
DeleteTenantCollections removes all collections with the tenant's prefix.
func ExchangeOAuth2Token ¶
func ExchangeOAuth2Token(code, redirectURI string, config PlatformConfig) (accessToken, refreshToken string, err error)
ExchangeOAuth2Token exchanges an authorization code for tokens using the IAM OAuth2 token endpoint.
func FetchSecret ¶
func FetchSecret(path string, config PlatformConfig) (string, error)
FetchSecret fetches a secret value from Hanzo KMS at the given path. Uses Universal Auth machine identity (config.IAMClientID / IAMClientSecret).
func ListTenantCollections ¶
ListTenantCollections returns all collection names belonging to a tenant.
func MustRegister ¶
func MustRegister(app core.App, config PlatformConfig)
MustRegister registers the platform plugin to the provided app instance and panics if it fails.
func Register ¶
func Register(app core.App, config PlatformConfig) error
Register registers the platform plugin to the provided app instance.
func ScopedQuery ¶
ScopedQuery returns the prefixed collection name for a tenant. Example: ScopedQuery("acme", "tasks") returns "t_acme_tasks".
func TenantPrefix ¶
TenantPrefix returns the collection name prefix for a tenant slug. Format: t_{slug}_
Types ¶
type AuthProxyConfig ¶
AuthProxyConfig holds the subset of PlatformConfig needed by the auth proxy.
type CollectionTemplate ¶
type CollectionTemplate struct {
// Name is the base collection name (without tenant prefix).
// The actual collection will be created as t_{slug}_{Name}.
Name string
// Type is the collection type: "base", "auth", or "view".
// Defaults to "base" if empty.
Type string
// Fields defines the fields for the collection.
Fields []core.Field
}
CollectionTemplate defines a collection schema that gets cloned per tenant.
type ComplianceClient ¶
type ComplianceClient struct {
// contains filtered or unexported fields
}
ComplianceClient handles communication with the luxfi/compliance service. The compliance service provides KYC/AML, sanctions screening, transaction monitoring, and regulatory validation. This is an optional extension — if ComplianceEndpoint is empty, compliance features are disabled.
func NewComplianceClient ¶
func NewComplianceClient(baseURL, apiKey string) *ComplianceClient
NewComplianceClient creates a client for the compliance service.
func (*ComplianceClient) CreateApplication ¶
func (c *ComplianceClient) CreateApplication(givenName, familyName, email, country string) (string, error)
CreateApplication creates a compliance application for a user.
func (*ComplianceClient) Enabled ¶
func (c *ComplianceClient) Enabled() bool
Enabled returns true if the compliance client is configured.
func (*ComplianceClient) GetKYCStatus ¶
func (c *ComplianceClient) GetKYCStatus(applicationID string) (*ComplianceStatus, error)
GetKYCStatus returns the current KYC status for an application.
func (*ComplianceClient) InitiateKYC ¶
func (c *ComplianceClient) InitiateKYC(applicationID, provider string) (verificationID, redirectURL string, err error)
InitiateKYC starts identity verification for an application.
func (*ComplianceClient) ScreenIndividual ¶
func (c *ComplianceClient) ScreenIndividual(givenName, familyName, country string) (*ScreeningResult, error)
ScreenIndividual runs AML/sanctions screening.
func (*ComplianceClient) ValidatePayment ¶
func (c *ComplianceClient) ValidatePayment(fromID, toID string, amount float64, currency, jurisdiction string) (approved bool, reason string, err error)
ValidatePayment checks payment compliance (travel rule, sanctions, CTR).
type ComplianceStatus ¶
type ComplianceStatus struct {
ApplicationID string `json:"application_id"`
Status string `json:"status"` // draft, pending, pending_kyc, approved, rejected
KYCStatus string `json:"kyc_status"` // not_started, pending, verified, failed
KYCProvider string `json:"kyc_provider,omitempty"`
}
ComplianceStatus represents a user's KYC/compliance status.
type IAMClient ¶
type IAMClient struct {
// contains filtered or unexported fields
}
IAMClient handles authentication against Hanzo IAM with token caching.
func NewIAMClient ¶
NewIAMClient creates a new IAM client pointed at the given base URL.
func (*IAMClient) InvalidateToken ¶
InvalidateToken removes a token from the cache.
type IAMUser ¶
type IAMUser struct {
ID string `json:"id"`
Email string `json:"email"`
Name string `json:"name"`
OrgIDs []string `json:"orgIds"`
}
IAMUser represents an authenticated user from Hanzo IAM.
func ValidateIAMToken ¶
func ValidateIAMToken(token string, config PlatformConfig) (*IAMUser, error)
ValidateIAMToken validates a bearer token against the IAM userinfo endpoint at config.IAMEndpoint/api/userinfo.
This is a convenience function that creates a one-off HTTP request. For production use with caching, use the IAMClient returned by NewIAMClient.
type KMSClient ¶
type KMSClient struct {
// contains filtered or unexported fields
}
KMSClient handles secret operations with caching.
func NewKMSClient ¶
NewKMSClient creates a new KMS client. If baseURL or authToken is empty, operations will return errors but the plugin still functions.
func (*KMSClient) DeleteSecret ¶
DeleteSecret removes a secret.
func (*KMSClient) InvalidateCache ¶
InvalidateCache clears all cached secrets for a tenant.
type PlatformConfig ¶
type PlatformConfig struct {
// IAMEndpoint is the base URL for Hanzo IAM (default: "https://hanzo.id").
IAMEndpoint string
// KMSEndpoint is the base URL for Hanzo KMS (default: "https://kms.hanzo.ai").
KMSEndpoint string
// IAMClientID is the OAuth2 client ID for IAM authentication.
IAMClientID string
// IAMClientSecret is the OAuth2 client secret for IAM authentication.
IAMClientSecret string
// IAMOrg is the IAM organization identifier (optional, used by auth proxy).
IAMOrg string
// IAMApp is the IAM application identifier (optional, used by auth proxy).
IAMApp string
// ComplianceEndpoint is the base URL for Lux Compliance service (optional).
// If set, enables KYC/AML screening and payment compliance for tenants.
ComplianceEndpoint string
// ComplianceAPIKey is the API key for the compliance service.
ComplianceAPIKey string
// DefaultTemplates defines collection schemas cloned per tenant on creation.
// If nil, no default tenant collections are created.
DefaultTemplates []CollectionTemplate
}
PlatformConfig defines the configuration for the platform plugin.
type ScreeningResult ¶
type ScreeningResult struct {
RiskLevel string `json:"risk_level"` // low, medium, high, critical
Matches int `json:"matches"`
Cleared bool `json:"cleared"`
}
ScreeningResult from AML/sanctions screening.