Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var AllScopes = []string{
"hosts:read",
"templates:read",
"templates:write",
"instances:read",
"instances:write",
"secrets:read",
"secrets:write",
"jobs:read",
}
AllScopes is the complete set of bearer-token scopes recognised by the API.
var ErrTokenIDExists = errors.New("token id already exists")
var ErrTokenNotFound = errors.New("token id not found")
var ErrTokenScopesRequired = errors.New("at least one scope is required")
Functions ¶
func KeyIDFromContext ¶
KeyIDFromContext returns the authenticated key id, or "" if unauthenticated.
func New ¶
New returns middleware that requires a Bearer token matching one of the keys currently held by store, AND that the matching key has the requiredScope. The store snapshot is read per request, so a SIGHUP-triggered reload takes effect on the next inbound request.
On failure: 401 (no/invalid token) or 403 (missing scope), with a JSON body.
Types ¶
type KeyStore ¶
type KeyStore struct {
// contains filtered or unexported fields
}
KeyStore is an atomically-swappable snapshot of the bearer-key list. It is safe for concurrent Load() and Store() — readers see either the previous snapshot or the new one, never a partial mix.
The middleware reads the snapshot per-request, so a SIGHUP reload in main is reflected on the next inbound request without restarting the process or interrupting any in-flight stream.
func NewKeyStore ¶
NewKeyStore returns a store seeded with the initial key list.
type TokenManager ¶ added in v1.0.16
type TokenManager struct {
// contains filtered or unexported fields
}
TokenManager manages the on-disk keys.yaml and the live KeyStore atomically. All mutating methods hold mu, rewrite the file, then reload the store.
func NewTokenManager ¶ added in v1.0.16
func NewTokenManager(path string, store *KeyStore) *TokenManager
func (*TokenManager) Create ¶ added in v1.0.16
func (m *TokenManager) Create(id, description string, scopes []string) (string, error)
Create generates a random token, hashes it, appends the entry to keys.yaml, reloads the KeyStore, and returns the plaintext token (shown once; never stored).
func (*TokenManager) List ¶ added in v1.0.16
func (m *TokenManager) List() ([]config.APIKey, error)
List returns all keys with SecretHash redacted.
func (*TokenManager) Reload ¶ added in v1.0.16
func (m *TokenManager) Reload() error
Reload reads keys.yaml from disk and replaces the live KeyStore. Skipped (returns error) if the file parses to zero keys, to avoid lockout.
func (*TokenManager) Revoke ¶ added in v1.0.16
func (m *TokenManager) Revoke(id string) error
Revoke removes the key with the given id from keys.yaml and reloads the KeyStore.
func (*TokenManager) Store ¶ added in v1.0.16
func (m *TokenManager) Store() *KeyStore
Store returns the underlying KeyStore (for tests and UI wiring).
Source Files