Documentation
¶
Overview ¶
Package plugin is the compile-time plugin catalog and runtime factory.
Each provider self-registers in its package init() by calling one of the Register* functions. The bootstrap layer blank-imports the adapter packages to trigger registration, then uses the factory functions here to instantiate the correct provider from the config stored in the database.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RegisterAuthProvider ¶
func RegisterAuthProvider(desc Descriptor, factory AuthProviderFactory)
RegisterAuthProvider registers a provider factory in the compile-time catalog. Call this from the adapter package's init() function.
Types ¶
type AuthProvider ¶
type AuthProvider interface {
// Login authenticates a user and returns an OIDC/OAuth2 token set.
Login(ctx context.Context, username, password string) (*Token, error)
// Register creates a new user account in the identity provider.
// Returns the provider-assigned user ID.
Register(ctx context.Context, req RegisterRequest) (userID string, err error)
// Verify validates a raw bearer token and returns its claims.
// This is called by the RequireAuth middleware on every authenticated request.
// The implementation is provider-specific: JWKS validation for JWT-based
// providers (Keycloak, Auth0, Authentik, generic OIDC) and session
// introspection for session-based providers (Ory Kratos).
Verify(ctx context.Context, rawToken string) (*VerifyResult, error)
}
AuthProvider is the single interface satisfied by all auth provider plugins. It is responsible for the full auth lifecycle:
- Login / Register: headless credential operations against the IDP
- Verify: bearer token validation for incoming API requests
Each adapter in core/identity/adapters/idp/ implements this interface and self-registers in its package init() function.
func NewAuthProvider ¶
func NewAuthProvider(provider string, configJSON json.RawMessage) (AuthProvider, error)
NewAuthProvider instantiates an AuthProvider by provider name and JSON config. Returns an error if the provider is unknown or the config is invalid.
type AuthProviderFactory ¶
type AuthProviderFactory func(configJSON json.RawMessage) (AuthProvider, error)
AuthProviderFactory constructs an AuthProvider from a JSON config blob.
type Descriptor ¶
type Descriptor struct {
// Provider is the unique machine-readable identifier, e.g. "keycloak".
Provider string
// DisplayName is the human-readable label shown in the marketplace UI.
DisplayName string
// Description explains what this plugin does.
Description string
// Type is the plugin capability category.
Type Type
// ConfigSchema is a JSON Schema document describing the configuration fields.
// The panel renders a dynamic form from this schema.
ConfigSchema json.RawMessage
}
Descriptor is the compile-time metadata for a plugin provider. Registered via the Register* functions; read by the marketplace API to show operators what providers are available and what config they require.
func ListAuthProviderDescriptors ¶
func ListAuthProviderDescriptors() []Descriptor
ListAuthProviderDescriptors returns all registered auth provider descriptors. Used by the marketplace API to enumerate available providers.
type RegisterRequest ¶
type RegisterRequest struct {
Email string
Username string
Password string
FirstName string
LastName string
}
RegisterRequest carries the data needed to create a new user account.
type Token ¶
type Token struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token,omitempty"`
IDToken string `json:"id_token,omitempty"`
TokenType string `json:"token_type"`
ExpiresIn int `json:"expires_in"`
Scope string `json:"scope,omitempty"`
}
Token is a standard OIDC/OAuth2 token set returned by an auth provider.
Source Files