Documentation
¶
Overview ¶
Package auth issues and validates the "limited sessions" an installed application receives (vision document, section 15.4): a session is scoped to exactly the permissions its application's manifest declares and never carries the rest of the public API's default access.
This is the minimal first slice (ADR-0026): sessions live only in memory, are never persisted, never expire, and cannot be revoked before the agent restarts. That was an explicit, temporary scope cut when written, on the grounds that there was no admin-level authentication anywhere else in the agent either — ADR-0036 has since added one, so a session's blast radius is now bounded by its own permissions (never more than one application's declared workflows_run) rather than by "nothing else is protected today either". Expiry/revocation before restart remain unimplemented; a leaked session token is a smaller, scoped risk than a leaked admin token, not a nonexistent one.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrInvalidSession = errors.New("invalid app session")
ErrInvalidSession is returned by Store.Validate when the token is unknown.
var ErrInvalidToken = errors.New("invalid admin token")
ErrInvalidToken is returned by ValidateToken when the token is unknown (never created, mistyped, or already revoked).
Functions ¶
func AnyTokensExist ¶
AnyTokensExist reports whether at least one admin token has ever been created. internal/api's admin-auth middleware only starts requiring one once this is true — an opt-in flipped by data, not by which address `patchcord serve` binds to (CLAUDE.md's non-negotiable #2 forbids branching core behavior on local-vs-server deployment) — so a fresh agent stays exactly as open as it was before this feature existed, until an operator deliberately creates a first token (`patchcord auth token create`). See ADR-0036.
Types ¶
type AdminToken ¶
AdminToken is one issued admin credential: full, unscoped access to the public API (ADR-0036) — unlike a Session, which is limited to one installed application's declared permissions. Its plaintext value is never stored or returned again after CreateToken; only its hash is kept.
func CreateToken ¶
func CreateToken(ctx context.Context, db *sql.DB, name string) (plaintext string, token AdminToken, err error)
CreateToken generates a new random admin token, records its hash under name, and returns the plaintext once — the only time it is ever available. There is no recovery for a lost token, only creating another one and revoking it (RevokeToken).
func ListTokens ¶
ListTokens returns every recorded admin token, most recently created first — never their plaintext or hash, which ValidateToken never exposes either.
func ValidateToken ¶
ValidateToken reports whether plaintext matches a currently recorded admin token, returning ErrInvalidToken otherwise (unknown or already revoked — indistinguishable on purpose, same as an invalid Session).
type Session ¶
type Session struct {
Token string
AppID string
Permissions apps.AppPermissions
IssuedAt time.Time
}
Session is a credential granted to one installed application, limited to that application's declared permissions.
func (Session) CanRunWorkflow ¶
CanRunWorkflow reports whether this session's application declared permission to run the workflow identified by id.
Source Files