auth

Oct 25, 2026

Changes in this version

+ const DefaultRevalidateInterval

+ const SessionContextKey

+ var ErrCredentialRevoked = errors.New("credential revoked")

+ var ErrIdentityConflict = errors.New("external identity ownership conflict")

+ var ErrIdentityNotBound = errors.New("external identity is not bound")

+ var ErrUserNotFound = errors.New("user account not found")

+ func ContextWithSession(ctx context.Context, token *SessionToken) context.Context

+ func CreateSessionTokenWithProvenance(email, displayName, role string, groups []string, signingKey []byte, ...) (string, error)

+ func LocalCredentialVersion(uid, secretName, key, passwordHash string) string

+ func RevalidateCredential(ctx context.Context, provider *ConfigProvider) error

+ func WatchCredentialRevocation(ctx context.Context, revalidate func(context.Context) error, ...) func()

type ConfigProvider

+ func (p *ConfigProvider) BindIdentity(ctx context.Context, name, uid string, id ExternalIdentity) error

+ func (p *ConfigProvider) CreateOwnedPasswordSecret(ctx context.Context, user *unstructured.Unstructured, hash, password string) (string, error)

+ func (p *ConfigProvider) GetUserByIdentity(ctx context.Context, id ExternalIdentity) (*unstructured.Unstructured, error)

+ func (p *ConfigProvider) HandleIdentityInventory(w http.ResponseWriter, r *http.Request)

+ func (p *ConfigProvider) InventoryIdentities(ctx context.Context) (*IdentityInventory, error)

+ func (p *ConfigProvider) UpdateUserSpec(ctx context.Context, original *unstructured.Unstructured, ...) (*unstructured.Unstructured, error)

+ type ExternalIdentity struct

+ Issuer string

+ Subject string

+ type IdentityInventory struct

+ Issues []IdentityInventoryIssue

+ Users []IdentityInventoryUser

+ type IdentityInventoryIssue struct

+ Kind string

+ Resource string

+ Users []string

+ type IdentityInventoryUser struct

+ Email string

+ External []ExternalIdentity

+ LocalEnabled bool

+ Name string

+ PasswordSecret string

+ UID string

type OIDCDiscovery

+ Issuer string

type OIDCHandler

+ func (h *OIDCHandler) HandleCreateIdentityAdoption(w http.ResponseWriter, r *http.Request)

+ func (h *OIDCHandler) HandleIdentityAdoption(w http.ResponseWriter, r *http.Request)

+ func (h *OIDCHandler) HandleLinkIdentity(w http.ResponseWriter, r *http.Request)

+ func (h *OIDCHandler) HandleUnlinkIdentity(w http.ResponseWriter, r *http.Request)

+ type SessionProvenance struct

+ AuthMethod string

+ CredentialVersion string

+ Issuer string

+ Subject string

type SessionToken

+ func SessionFromContext(ctx context.Context) *SessionToken

type UserInfo

+ AuthMethod string

+ CanChangePassword bool

+ LocalPasswordEnabled bool

+ OIDCLinked bool

Oct 20, 2026

Changes in this version

+ func BrowserOriginAllowed(r *http.Request, allowed []string) bool

+ func BrowserRequestGuard(allowed []string) func(http.Handler) http.Handler

+ func HasExecutionPermission(user *UserInfo, namespace, workspace string, permission ExecutionPermission, ...) bool

+ func WebSocketOriginAllowed(r *http.Request) bool

type ConfigProvider

+ func (p *ConfigProvider) AuthorizeExecution(ctx context.Context, token, namespace, workspace string, ...) (*UserInfo, error)

+ type ExecutionGrant struct

+ ExpiresAt *time.Time

+ Namespace string

+ Permissions []ExecutionPermission

+ Workspaces []string

+ func ParseExecutionGrants(raw interface{}) ([]ExecutionGrant, error)

+ type ExecutionPermission string

+ const PermissionElevated

+ const PermissionExec

+ const PermissionManage

+ const PermissionReadRecordings

+ const PermissionShell

type SessionToken

+ UserUID string

type UserInfo

+ ExecutionGrants []ExecutionGrant

+ UID string

+ func ExecutionPrincipal(ctx context.Context) *UserInfo

Sep 23, 2026

Changes in this version

+ const DeviceTokenType

+ func CreateDeviceToken(email, displayName, role string, groups []string, deviceName, jti string, ...) (string, error)

+ type CodeStore interface

+ Close func()

+ Issue func(code string, entry nativeAuthCode) error

+ Redeem func(code string) (nativeAuthCode, bool)

+ func NewK8sCodeStore(dyn dynamic.Interface) CodeStore

type Config

+ DeviceTokenExpiry time.Duration

type ConfigProvider

+ func (p *ConfigProvider) DynamicClient() dynamic.Interface

+ type DeviceHandler struct

+ func NewDeviceHandler(provider *ConfigProvider, devices *DeviceStore) *DeviceHandler

+ func (h *DeviceHandler) HandleDeviceCreate(w http.ResponseWriter, r *http.Request)

+ func (h *DeviceHandler) HandleDeviceList(w http.ResponseWriter, r *http.Request)

+ func (h *DeviceHandler) HandleDeviceRevoke(w http.ResponseWriter, r *http.Request)

+ type DeviceInfo struct

+ CreatedAt int64

+ DeviceID string

+ ExpiresAt int64

+ Name string

+ type DeviceStore struct

+ func NewDeviceStore(dyn dynamic.Interface) *DeviceStore

+ func (s *DeviceStore) List(ctx context.Context, email string, isAdmin bool) ([]DeviceInfo, error)

+ func (s *DeviceStore) Register(ctx context.Context, email, name, jti string, createdAt, expiresAt time.Time) error

+ func (s *DeviceStore) Revoke(ctx context.Context, jti string) error

+ func (s *DeviceStore) Revoked(ctx context.Context, jti, email string) bool

type OIDCHandler

+ func NewOIDCHandlerWithCodes(provider *ConfigProvider, codes CodeStore) *OIDCHandler

type SessionToken

+ JTI string

+ Type string

Sep 17, 2026

Changes in this version

type OIDCHandler

+ func (h *OIDCHandler) Close()

+ func (h *OIDCHandler) HandleBrowserSessionGrant(w http.ResponseWriter, r *http.Request)

+ func (h *OIDCHandler) HandleBrowserSessionRedeem(w http.ResponseWriter, r *http.Request)

+ func (h *OIDCHandler) HandleNativeToken(w http.ResponseWriter, r *http.Request)

Sep 11, 2026

Changes in this version

type Config

+ PreviousSigningKey []byte

+ func (c *Config) SessionSigningKeys() [][]byte

type SessionToken

+ func ValidateSessionTokenWithKeys(tokenStr string, signingKeys [][]byte) (*SessionToken, error)

Aug 25, 2026

Changes in this version

+ const LocalAuthSystemNamespace

+ func GeneratePassword() (string, error)

+ func GetPasswordHash(secret *unstructured.Unstructured) (string, error)

+ func HashPassword(password string) (string, error)

+ func ProvisionLocalUser(ctx context.Context, provider *ConfigProvider, ...) (string, string, error)

+ func ResetLocalUserPassword(ctx context.Context, provider *ConfigProvider, userName string) (string, error)

+ func ValidatePasswordComplexity(password string) error

type Config

+ LocalAuthEnabled bool

type ConfigProvider

+ func (p *ConfigProvider) CreatePasswordSecret(ctx context.Context, name, passwordHash, plaintextPassword string) error

+ func (p *ConfigProvider) DeletePasswordSecret(ctx context.Context, name string) error

+ func (p *ConfigProvider) GetPasswordSecret(ctx context.Context, name string) (*unstructured.Unstructured, error)

+ func (p *ConfigProvider) UpdatePasswordHash(ctx context.Context, name, newHash string) error

+ type LocalAuthHandler struct

+ func NewLocalAuthHandler(provider *ConfigProvider) *LocalAuthHandler

+ func (h *LocalAuthHandler) HandleChangePassword(w http.ResponseWriter, r *http.Request)

+ func (h *LocalAuthHandler) HandleLocalLogin(w http.ResponseWriter, r *http.Request)

type UserInfo

+ MustChangePassword bool

Jul 24, 2026

Changes in this version

+ const SessionCookieName

+ const UserContextKey

+ func AuthEnabled(ctx context.Context) bool

+ func ContextWithUser(ctx context.Context, user *UserInfo) context.Context

+ func CreateSessionToken(email, displayName, role string, groups []string, signingKey []byte, ...) (string, error)

+ func FilterNamespaces(ctx context.Context, namespaces []string) []string

+ func FilterWorkspaces(ctx context.Context, workspaces []map[string]interface{}) []map[string]interface

+ func HasMinimumRole(userRole, minRole string) bool

+ func IsAdmin(ctx context.Context) bool

+ func Middleware(provider *ConfigProvider) func(http.Handler) http.Handler

+ func ProvisionUser(ctx context.Context, provider *ConfigProvider, email, displayName, role string, ...) error

+ func RequireNamespaceAccess(getNamespace func(*http.Request) string) func(http.Handler) http.Handler

+ func RequireRole(minRole string) func(http.Handler) http.Handler

+ func UserHasNamespaceAccess(user *UserInfo, namespace string) bool

+ type Config struct

+ AdminEmails []string

+ ClientID string

+ ClientSecret string

+ Enabled bool

+ GroupsClaim string

+ IssuerURL string

+ PersonalNamespaces PersonalNamespacesConfig

+ RefreshExpiry time.Duration

+ Registration RegistrationConfig

+ RestrictNamespaceAccess bool

+ Scopes []string

+ SigningKey []byte

+ TokenExpiry time.Duration

+ UsernameClaim string

+ type ConfigProvider struct

+ func NewConfigProvider(dynamicClient dynamic.Interface) *ConfigProvider

+ func (p *ConfigProvider) CreateUser(ctx context.Context, user *unstructured.Unstructured) (*unstructured.Unstructured, error)

+ func (p *ConfigProvider) DeleteUser(ctx context.Context, name string) error

+ func (p *ConfigProvider) GetAuthConfig(ctx context.Context) (*unstructured.Unstructured, error)

+ func (p *ConfigProvider) GetConfig(ctx context.Context) (*Config, error)

+ func (p *ConfigProvider) GetUser(ctx context.Context, name string) (*unstructured.Unstructured, error)

+ func (p *ConfigProvider) GetUserByEmail(ctx context.Context, email string) (*unstructured.Unstructured, error)

+ func (p *ConfigProvider) InvalidateCache()

+ func (p *ConfigProvider) ListUsers(ctx context.Context) (*unstructured.UnstructuredList, error)

+ func (p *ConfigProvider) UpdateAuthConfig(ctx context.Context, obj *unstructured.Unstructured) (*unstructured.Unstructured, error)

+ func (p *ConfigProvider) UpdateUser(ctx context.Context, user *unstructured.Unstructured) (*unstructured.Unstructured, error)

+ func (p *ConfigProvider) UpdateUserStatus(ctx context.Context, user *unstructured.Unstructured) (*unstructured.Unstructured, error)

+ type IDTokenClaims struct

+ Email string

+ EmailVerified bool

+ Groups []string

+ Name string

+ Picture string

+ Sub string

+ type OIDCDiscovery struct

+ AuthorizationEndpoint string

+ JwksURI string

+ TokenEndpoint string

+ UserinfoEndpoint string

+ type OIDCHandler struct

+ func NewOIDCHandler(provider *ConfigProvider) *OIDCHandler

+ func (h *OIDCHandler) HandleAuthConfig(w http.ResponseWriter, r *http.Request)

+ func (h *OIDCHandler) HandleCallback(w http.ResponseWriter, r *http.Request)

+ func (h *OIDCHandler) HandleLogin(w http.ResponseWriter, r *http.Request)

+ func (h *OIDCHandler) HandleLogout(w http.ResponseWriter, r *http.Request)

+ func (h *OIDCHandler) HandleMe(w http.ResponseWriter, r *http.Request)

+ type PersonalNamespacesConfig struct

+ Enabled bool

+ Template string

+ type RegistrationConfig struct

+ AllowedDomains []string

+ AllowedEmails []string

+ AutoProvision bool

+ DefaultRole string

+ RequireApproval bool

+ type SessionToken struct

+ DisplayName string

+ Email string

+ ExpiresAt int64

+ Groups []string

+ IssuedAt int64

+ Role string

+ func ValidateSessionToken(tokenStr string, signingKey []byte) (*SessionToken, error)

+ type TokenResponse struct

+ AccessToken string

+ ExpiresIn int

+ IDToken string

+ RefreshToken string

+ TokenType string

+ type UserInfo struct

+ AvatarURL string

+ DisplayName string

+ Email string

+ Groups []string

+ Namespaces []string

+ PersonalNamespace string

+ Role string

+ func UserFromContext(ctx context.Context) *UserInfo