auth

type AccessMode ¶

type AccessMode string

AccessMode is what a gRPC method requires of its caller.

It lives here rather than beside the server because a library consumer registering its own services has to name these, and the server package is internal. AccessPublic skips authentication. AccessRuntime requires the separate workload authenticator; the remaining modes use public identity.

const (
	AccessPublic  AccessMode = "public"
	AccessRuntime AccessMode = "runtime"
	AccessRead    AccessMode = "read"
	AccessCreate  AccessMode = "create"
	AccessUpdate  AccessMode = "update"
	AccessDelete  AccessMode = "delete"
)

type Agent ¶

type Agent struct {
	ID string
}

type AuthProvider ¶

type AuthProvider interface {
	Authenticate(ctx context.Context, reqHeaders http.Header, query url.Values) (Session, error)
	// add auth to upstream requests of a session for upstream service account.
	// For A2A calls, UpstreamMethodFrom(r.Context()) names the outgoing method.
	UpstreamAuth(r *http.Request, session Session, upstreamPrincipal Principal) error
}

Responsibilities: - Authenticate:

• a2a requests from ui/cli (human users)
• api requests from users/agents

- Forward auth credentials to upstream agents

type Authorizer ¶

type Authorizer interface {
	Check(ctx context.Context, principal Principal, verb Verb, resource Resource) error
}

Authz

type CollectionAuthorizer ¶

type CollectionAuthorizer interface {
	Authorizer
	Scope(ctx context.Context, principal Principal, verb Verb, resourceType string) (authorization.AuthorizationScope, error)
}

type ControlPlaneSession ¶

type ControlPlaneSession struct{}

ControlPlaneSession identifies an internal controller call without human credentials. It does not assert a Substrate Actor identity. AuthProvider and Authorizer implementations may explicitly allow, deny, or authenticate these calls; actor credentials for runtime tool calls remain a separate concern.

func (ControlPlaneSession) Principal() Principal

type NoopAuthorizer ¶

type NoopAuthorizer struct{}

NoopAuthorizer permits every action and collection entry.

func (NoopAuthorizer) Check(context.Context, Principal, Verb, Resource) error

func (NoopAuthorizer) Scope(context.Context, Principal, Verb, string) (authorization.AuthorizationScope, error)

type Principal ¶

type Principal struct {
	User   User
	Agent  Agent
	Claims map[string]any // Raw JWT claims (nil for non-JWT auth)
}

Authn

type Resource ¶

type Resource struct {
	Type      string
	Namespace string
	Name      string
}

type Session ¶

type Session interface {
	Principal() Principal
}

func AuthSessionFrom(ctx context.Context) (Session, bool)

type ShareContext ¶

type ShareContext struct {
	Token  string // the raw share token
	UserID string // owner's user ID — used for DB lookups

	// SessionID is the conversation this token grants access to.
	SessionID string
}

ShareContext grants read-only access from a validated X-Share-Token header.

func ShareContextFrom(ctx context.Context) (*ShareContext, bool)

func (s *ShareContext) IsForSession(sessionID string) bool

type User ¶

type User struct {
	ID string
}

type Verb ¶

type Verb string

const (
	VerbList   Verb = "list"
	VerbGet    Verb = "get"
	VerbCreate Verb = "create"
	VerbUpdate Verb = "update"
	VerbDelete Verb = "delete"
)