Documentation
¶
Overview ¶
Package authn is the authentication boundary of the operator surface (ADR-0021). It defines the one principal every caller of the domain layer acts as, how that principal travels in a context to the domain-function boundary, and the Authenticator interface the surface authenticates through: one verifier per credential form (the password, an operator token, a session) over one session minter.
The implementation over the operator domain is operator.NewAuthenticator. Nothing outside internal/operator depends on how a credential is stored or checked.
Version 1 has one operator and binary authorization: a caller is authenticated or it is not. The principal therefore names the one operator and nothing more; it carries no record of which credential produced it, no role, and no scope.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoPrincipal = errors.New("authn: no authenticated principal")
ErrNoPrincipal is a domain function's refusal of a caller whose context carries no principal: it reached the domain layer without having been authenticated, which only a wiring fault can do.
var ErrUnsupportedForm = errors.New("authn: no verifier accepts this credential form")
ErrUnsupportedForm means no verifier accepts the credential's form.
Functions ¶
Types ¶
type Authenticator ¶
type Authenticator interface {
// Verify resolves a credential to the principal through the verifier
// for its form, or reports ErrUnsupportedForm when there is none.
Verify(ctx context.Context, c Credential) (*Principal, error)
Minter
}
Authenticator is the boundary the operator surface is written against: credential verification by form, over one session minter. The operator domain's implementation is operator.NewAuthenticator; a backend that verifies elsewhere replaces it without touching the surface.
type Chain ¶
Chain is an Authenticator composed from a list of verifiers over one minter. The first verifier whose form matches the credential decides.
type Credential ¶
Credential is one presented credential: its form and its secret.
type Form ¶
type Form int
Form names a credential form. Forms exist only at this boundary: a verifier is chosen by the form presented, and the principal it resolves never records which one it was.
type MintedSession ¶
MintedSession is a session a login minted: the identifier the client holds, returned exactly once, and its fixed lifetime.
type Minter ¶
type Minter interface {
// Mint draws and persists a new session.
Mint(ctx context.Context) (MintedSession, error)
// End revokes a session. An identifier that no longer authenticates
// is not an error: that is the outcome the caller wants.
End(ctx context.Context, id string) error
}
Minter mints sessions and ends them. A session is minted only after a credential has been verified; the minter does not verify.
type Principal ¶
type Principal struct {
DisplayName *string
}
Principal is the authenticated operator as the domain layer sees it. Both operator credential forms resolve to it, and the command line acts as it; it carries no record of which credential, or which transport, produced it. DisplayName is the optional name set with the password; a surface renders a fallback when it is nil.
type Verifier ¶
type Verifier interface {
// Form is the credential form this verifier accepts.
Form() Form
// Verify resolves secret to the principal, or refuses it.
Verify(ctx context.Context, secret string) (*Principal, error)
}
Verifier checks one credential form and resolves it to the principal. A refusal is the verifier's own error, which callers match with errors.Is; a verifier never falls back to another form.
Source Files