Documentation
¶
Overview ¶
Package cloudlogin implements the fail-closed enrollment-token gate for kombify Cloud login on a self-hosted instance.
The gate is "fail-closed" by design: SaaS deployments expose Cloud login unconditionally; self-hosted deployments must produce a signed enrollment token that proves the operator has explicitly opted into talking to kombify Cloud. Without the token (or with any signature/origin/audience mismatch) the gate returns Enabled=false plus a machine-readable Reason suitable for surfacing in /readyz, audit logs, or admin telemetry.
Donor: kombify-Techstack/pkg/cloudlogin (lifted 2026-05-03 with the techstack-specific config.DeploymentMode dependency replaced by simple IsSaaS / IsSelfHosted booleans).
Index ¶
Constants ¶
const DefaultAudience = "kombify:selfhosted-cloud-login"
DefaultAudience is the audience claim used when Options.ExpectedAudience is empty. Consumers SHOULD set their own product-specific audience (e.g. "kombify-techstack:selfhosted-cloud-login").
const EnvPrefix = "KOMBIFY"
EnvPrefix is the default env-var prefix used by OptionsFromEnv.
const FeatureKey = "cloud_login"
FeatureKey is the value the enrollment token must carry in its `feature` claim. Mismatched tokens (e.g. issued for a different kombify product) are rejected with Reason "feature_mismatch".
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// IsSaaS short-circuits the gate to Enabled=true. Mutually exclusive
// with IsSelfHosted; if neither is set the gate refuses with reason
// "unsupported_mode".
IsSaaS bool
// IsSelfHosted gates token verification.
IsSelfHosted bool
// PublicOrigin is the canonical https://… origin of the local instance,
// matched against the enrollment token's `origin` claim.
PublicOrigin string
// Token is the signed enrollment JWT issued by kombify Cloud.
Token string
// PublicKeyPEM is the PEM-encoded RSA / ECDSA / Ed25519 public key (or
// X.509 certificate) used to verify Token.
PublicKeyPEM string
// ExpectedIssuer optionally constrains the token's `iss` claim.
ExpectedIssuer string
// ExpectedAudience overrides [DefaultAudience].
ExpectedAudience string
// Now is injectable for tests.
Now func() time.Time
}
Options configures evaluation of the self-hosted cloud-login gate.
func OptionsFromEnv ¶
OptionsFromEnv builds gate options from environment variables under the given prefix. The empty prefix falls back to EnvPrefix.
Read variables (with prefix "X"):
X_DEPLOYMENT_MODE — "saas" | "selfhosted" X_PUBLIC_ORIGIN — canonical origin (also PUBLIC_ORIGIN, APP_URL) X_SELFHOSTED_CLOUD_LOGIN_TOKEN — signed enrollment JWT X_SELFHOSTED_CLOUD_LOGIN_PUBLIC_KEY — PEM key X_SELFHOSTED_CLOUD_LOGIN_ISSUER — optional iss constraint X_SELFHOSTED_CLOUD_LOGIN_AUDIENCE — optional aud override
Source Files