Documentation
¶
Overview ¶
Package chains is the database adapter for delegation grants: it hydrates a stored delegation into the pure delegation.Grant the signer mints from, and records the consent that authorizes a root delegation.
Index ¶
- type ConsentRequest
- type Service
- func (s *Service) GrantConsent(ctx context.Context, req ConsentRequest) (consentID, delegationID string, err error)
- func (s *Service) ListUserDelegations(ctx context.Context, userID string) ([]UserDelegation, error)
- func (s *Service) Redelegate(ctx context.Context, ...) (string, error)
- func (s *Service) ResolveGrantChain(ctx context.Context, agentID, userID string) (*delegation.Grant, string, error)
- func (s *Service) RevokeDelegationTree(ctx context.Context, delegationID, userID string) (int, int64, error)
- type UserDelegation
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ConsentRequest ¶
type ConsentRequest struct {
UserID string
AgentID string
OrgID string
Scopes []string
Constraints delegation.Constraints
Resource string
TTL time.Duration
}
ConsentRequest is a user's approval to delegate to an agent.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func (*Service) GrantConsent ¶
func (s *Service) GrantConsent(ctx context.Context, req ConsentRequest) (consentID, delegationID string, err error)
GrantConsent records a consent receipt and the root delegation it authorizes, in one transaction. Returns the new consent and delegation ids.
func (*Service) ListUserDelegations ¶
ListUserDelegations returns the root delegations a user has granted (most recent first). Re-delegations made by agents are not the user's to manage and are excluded.
func (*Service) Redelegate ¶
func (s *Service) Redelegate(ctx context.Context, parentDelegationID, delegatorAgentID, delegateeAgentID string, scopes []string, c delegation.Constraints, ttl time.Duration) (string, error)
Redelegate lets an agent re-delegate an attenuated slice of a delegation it holds to a sub-agent. It enforces the chain invariants: only the holder may re-delegate, scopes must be a subset of the parent's, constraints are tightened against the parent, depth is bounded, and the sub-agent must not already appear in the chain (no cycles). Returns the new child delegation id.
func (*Service) ResolveGrantChain ¶
func (s *Service) ResolveGrantChain(ctx context.Context, agentID, userID string) (*delegation.Grant, string, error)
ResolveGrantChain resolves the full delegation chain ending at the leaf agent and rooted at userID, returning a delegation.Grant (with its parent chain reconstructed) ready to mint from, plus the leaf delegation id. It supports multi-hop: user -> agent -> sub-agent -> ... -> leaf. Every link must still be active and unexpired, and the chain must be rooted at the given user.
func (*Service) RevokeDelegationTree ¶
func (s *Service) RevokeDelegationTree(ctx context.Context, delegationID, userID string) (int, int64, error)
RevokeDelegationTree revokes a user's root delegation and its entire subtree: every descendant re-delegation is deactivated and every live token minted from any of them is revoked, atomically. Only the user who granted the root may revoke it. Returns the count of delegations and tokens revoked.
type UserDelegation ¶
type UserDelegation struct {
ID string
AgentID string
AgentName string
Scopes []string
Constraints delegation.Constraints
CreatedAt time.Time
ExpiresAt *time.Time
Active bool
}
UserDelegation is a row of a user's granted (root) delegations, for the self-service management UI.
Source Files