go-common

module

v0.1.0 Latest Latest Go to latest Published: Aug 15, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kombifyio/go-common

Links

Open Source Insights

README ¶

kombify Go Common

Public, provider-neutral Go utilities used by the kombify TechStack self-hosted runtime and its native clients.

This mirror contains only the Apache-2.0 packages required by the public TechStack source tree. It owns reusable authentication, identity, HTTP, native-client, observability, and runtime-envelope utilities. It does not own provider credentials, provider drivers, hosted commerce, product state, or orchestration policy.

Packages

authflow, authlocal, and authsession — browser and local session flows
cloudlogin — fail-closed optional hosted-login gate
edgeauth, fga, identity, and role — identity and authorization helpers
httputil and servicecall — HTTP envelopes and optional service auth
nativeclient/* and toolauth — device/profile flows used by native clients
oidcclient — provider-neutral OIDC discovery, PKCE, and verification
observability — optional Sentry instrumentation; empty configuration is a no-op
runtimeexecutor — provider-neutral execution envelope validation

Self-hosted callers keep hosted integrations disabled by configuration. This repository contains no deployment workflow, container image, or provider implementation.

Development

go test ./...
go build ./...

The module path is github.com/kombifyio/go-common. Consumers should pin a published version when the public repository is created.

License

Apache-2.0. See LICENSE.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
authflow Package authflow implements the browser-facing OIDC auth-code flow for kombify backend services.	Package authflow implements the browser-facing OIDC auth-code flow for kombify backend services.
authlocal Package authlocal implements username+password authentication for kombify backends backed by a single break-glass admin record.	Package authlocal implements username+password authentication for kombify backends backed by a single break-glass admin record.
authsession Package authsession implements stateless HS256-signed session tokens that kombify backend services issue to their own browser frontends after a successful login (OIDC code-flow via [authflow], or break-glass via [authlocal]).	Package authsession implements stateless HS256-signed session tokens that kombify backend services issue to their own browser frontends after a successful login (OIDC code-flow via [authflow], or break-glass via [authlocal]).
cloudlogin Package cloudlogin implements the fail-closed enrollment-token gate for kombify Cloud login on a self-hosted instance.	Package cloudlogin implements the fail-closed enrollment-token gate for kombify Cloud login on a self-hosted instance.
edgeauth Package edgeauth provides middleware that trusts headers set by the Cloudflare Edge Router after Auth0 JWT validation.	Package edgeauth provides middleware that trusts headers set by the Cloudflare Edge Router after Auth0 JWT validation.
fga Package fga provides a fail-closed fine-grained authorization client for the kombify platform (ADR 0030).	Package fga provides a fail-closed fine-grained authorization client for the kombify platform (ADR 0030).
httputil
identity Package identity provides shared types for edge-injected user identity.	Package identity provides shared types for edge-injected user identity.
internal
referenceid Package referenceid contains the closed grammars shared by otherwise independent provider-free wire packages.	Package referenceid contains the closed grammars shared by otherwise independent provider-free wire packages.
nativeclient
interactiveauth Package interactiveauth implements the two human-interactive native OAuth flows of NATIVE-CLIENT-PLATFORM-STANDARD.md section 4, composed on the transport-pure oidcclient package:	Package interactiveauth implements the two human-interactive native OAuth flows of NATIVE-CLIENT-PLATFORM-STANDARD.md section 4, composed on the transport-pure oidcclient package:
profile Package profile implements the client side of the Kombify ClientConnectionProfile v1 contract: strict fail-closed parsing, validation, and discovery fetching of `GET /.well-known/kombify-client`.	Package profile implements the client side of the Kombify ClientConnectionProfile v1 contract: strict fail-closed parsing, validation, and discovery fetching of `GET /.well-known/kombify-client`.
observability Package observability wires kombify Go services into Sentry for error reporting and performance tracing.	Package observability wires kombify Go services into Sentry for error reporting and performance tracing.
oidcclient Package oidcclient provides a provider-neutral OIDC client used across all kombify Go services (Simulate, StackKits-Server, TechStack).	Package oidcclient provides a provider-neutral OIDC client used across all kombify Go services (Simulate, StackKits-Server, TechStack).
role Role claim extraction from OIDC tokens.	Role claim extraction from OIDC tokens.
runtimeexecutor Package runtimeexecutor defines the provider-neutral v1beta1 contract for executing already-authorized governed runtime targets.	Package runtimeexecutor defines the provider-neutral v1beta1 contract for executing already-authorized governed runtime targets.
servicecall Package servicecall provides authenticated service-to-service HTTP calls within the kombify operator-managed network.	Package servicecall provides authenticated service-to-service HTTP calls within the kombify operator-managed network.
toolauth Package toolauth provides client-side authentication for kombify desktop tools.	Package toolauth provides client-side authentication for kombify desktop tools.