Documentation
¶
Overview ¶
Package profile implements the client side of the Kombify ClientConnectionProfile v1 contract: strict fail-closed parsing, validation, and discovery fetching of `GET /.well-known/kombify-client`.
The wire contract is owned by kombify-Core/standards/client-connection-profile.v1.schema.json and CLIENT-CONNECTION-PROFILE-STANDARD.md; behavior rules come from NATIVE-CLIENT-PLATFORM-STANDARD.md section 3. This package carries no product-specific branches: every Kombify native client consumes it unchanged.
Registry membership of capability identifiers is a server/workspace-side gate (client-capability-registry.v1.json); clients validate capability syntax only and never infer availability from unregistered names.
Index ¶
Constants ¶
const ( ModeCloud = "cloud" ModeSelfHosted = "self_hosted" ModeLocal = "local" )
Deployment modes of ClientConnectionProfile v1.
const ( FlowAuthorizationCodePKCE = "authorization_code_pkce" FlowDeviceAuthorization = "device_authorization" FlowLocalBootstrap = "local_bootstrap" )
Native auth flows advertised by ClientConnectionProfile v1.
const ( OfflineWriteDisabled = "disabled" OfflineWriteOutbox = "outbox" )
Offline write policies of the sync block.
const WellKnownPath = "/.well-known/kombify-client"
WellKnownPath is the discovery route every Kombify server publishes.
Variables ¶
var ( // ErrInvalidProfile wraps every validation failure. The error text lists // each violated rule with its JSON location. ErrInvalidProfile = errors.New("profile: invalid client connection profile") // ErrFetchFailed wraps discovery transport failures. ErrFetchFailed = errors.New("profile: discovery fetch failed") )
Errors returned by this package.
Functions ¶
This section is empty.
Types ¶
type OIDC ¶
type OIDC struct {
Issuer string `json:"issuer"`
ClientID string `json:"client_id"`
Audience string `json:"audience,omitempty"`
Scopes []string `json:"scopes"`
Flow string `json:"flow"`
}
OIDC is the public identity metadata block. It never carries secrets; client_id is public metadata by contract.
type Profile ¶
type Profile struct {
Version string `json:"version"`
DeploymentMode string `json:"deployment_mode"`
BaseURL string `json:"base_url"`
InstanceID string `json:"instance_id"`
WorkspaceID string `json:"workspace_id,omitempty"`
OIDC OIDC `json:"oidc"`
Capabilities []string `json:"capabilities"`
APIVersions map[string]string `json:"api_versions"`
Sync Sync `json:"sync"`
}
Profile is the parsed ClientConnectionProfile v1 document.
func Fetch ¶
Fetch retrieves and validates the connection profile from `<baseURL>/.well-known/kombify-client`. A nil client defaults to a 10 s timeout. The response is limited to 1 MiB.
func Parse ¶
Parse validates raw against the full v1 contract and returns the typed profile. Validation is fail-closed: unknown fields anywhere, secret-bearing key names anywhere, insecure remote URLs, and mode/flow mismatches all reject the document.
func (*Profile) HasCapability ¶
HasCapability reports whether the profile advertises the capability id. Capabilities describe availability, not authorization: protected actions still handle a fail-closed entitlement denial.
Source Files