auth

type Authenticator ¶

type Authenticator interface {
	Authenticate(ctx context.Context, req sdkauth.InboundCallMeta) (sdkauth.Decision, error)
}

Authenticator performs local auth (no-op, API key) using protocol-neutral metadata.

type EventDispatcher ¶

type EventDispatcher struct {
	// contains filtered or unexported fields
}

EventDispatcher delivers auth and session-start events to an EventSink and applies EventFailurePolicy when the sink returns an error.

Event DTO additions remain subject to non-secret classification; see EventSink and sdkauth.AuthDecisionEvent / sdkauth.SessionStartEvent package docs.

func NewEventDispatcher(sink EventSink, policy EventFailurePolicy) *EventDispatcher

func (d *EventDispatcher) DispatchAuthDecision(ctx context.Context, ev sdkauth.AuthDecisionEvent) error

func (d *EventDispatcher) DispatchSessionStart(ctx context.Context, ev sdkauth.SessionStartEvent) error

type EventFailurePolicy ¶

type EventFailurePolicy string

EventFailurePolicy controls whether event sink errors fail the request path.

const (
	EventFailureBestEffort EventFailurePolicy = "best_effort"
	EventFailureFailClosed EventFailurePolicy = "fail_closed"
)

type EventSink ¶

type EventSink interface {
	OnAuthDecision(ctx context.Context, ev sdkauth.AuthDecisionEvent) error
	OnSessionStart(ctx context.Context, ev sdkauth.SessionStartEvent) error
}

EventSink receives non-secret auth and session events. Implementations are wired at the composition root (e.g. structured logging). EventDispatcher serializes calls per dispatcher instance; sinks should still avoid long blocking work because delivery remains on request paths. OnAuthDecision: do not treat sdkauth.AuthDecisionEvent fields as proof of absence of secrets in upstream state; log only stable, operator-approved attributes (the default JSON sink logs sdkauth.AuthDecisionEvent.PrincipalSafeClaims keys only, not map values). New fields on event DTOs require explicit non-secret data classification before use; EventDispatcher.DispatchAuthDecision sanitizes sdkauth.AuthDecisionEvent.ChallengeSummary for every sink including custom implementations.

type LocalAPIKeyAuthenticator ¶

type LocalAPIKeyAuthenticator struct {
	// contains filtered or unexported fields
}

LocalAPIKeyAuthenticator validates bearer API keys against operator-configured records. Records must pass ValidateLocalAPIKeyRecords before construction.

func NewLocalAPIKeyAuthenticator(records []LocalAPIKeyRecord) (*LocalAPIKeyAuthenticator, error)

func (a *LocalAPIKeyAuthenticator) Authenticate(ctx context.Context, req sdkauth.InboundCallMeta) (sdkauth.Decision, error)

type LocalAPIKeyRecord ¶

type LocalAPIKeyRecord struct {
	KeyID       string
	PrincipalID string
	Key         string
	Attribution LocalAttribution
}

LocalAPIKeyRecord is one operator-configured API key for LocalAPIKeyAuthenticator. It mirrors config-layer YAML records without importing internal/core/config.

type LocalAttribution ¶

type LocalAttribution struct {
	DisplayName    string
	AuthMethod     string
	TenantID       string
	OrganizationID string
	WorkspaceID    string
	ProjectID      string
	DepartmentID   string
	CostCenterID   string
	Roles          []string
	SafeClaims     map[string]string
	PolicyLabels   map[string]string
}

LocalAttribution carries optional operator-controlled safe attribution for a local API key record. Zero values mean "not configured" and map to unknown scope fields (no inference). Raw key material, bearer tokens, and transport headers must never be placed here.

type LocalNoOpAuthenticator ¶

type LocalNoOpAuthenticator struct {
	OS OSIdentityProvider
	// OnOSIdentityFallback, if set, is called when the OS provider is nil or [OSIdentityProvider.Current] fails,
	// before a fallback principal ([LocalUnknownOSPrincipalID]) is used. err is non-nil only when
	// Current was invoked; hadProvider is false when OS is nil.
	OnOSIdentityFallback func(ctx context.Context, err error, hadProvider bool)
}

LocalNoOpAuthenticator grants credential-free access with an explicit non-anonymous principal derived from OSIdentityProvider. It must only be wired when access posture validation permits local no-op.

func (a LocalNoOpAuthenticator) Authenticate(ctx context.Context, req sdkauth.InboundCallMeta) (sdkauth.Decision, error)

type OSIdentityProvider ¶

type OSIdentityProvider interface {
	Current(ctx context.Context) (OSIdentitySnapshot, error)
}

OSIdentityProvider resolves the current process identity for local no-op authentication. Implementations live in infrastructure (e.g. os/user + env); core consumes this port only.

type OSIdentitySnapshot ¶

type OSIdentitySnapshot struct {
	PrincipalID  string
	DisplayName  string
	FallbackUsed bool
}

OSIdentitySnapshot is non-secret principal material resolved from the OS or explicit environment hints. FallbackUsed is true when neither OS account nor env hints yielded a stable identity (operator-visible).

type PolicyAuthenticator ¶

type PolicyAuthenticator struct {
	Handler  sdkauth.HandlerKind
	Required sdkauth.RequiredLevel
	Noop     Authenticator
	APIKey   Authenticator
	Remote   RemoteDecider
	// OnRemoteDecideError, if set, is invoked when [RemoteDecider].Decide returns a non-nil error
	// before the policy maps the outcome to deny (err is not returned to the transport). Used for
	// observability at the composition root; [internal/core/auth] does not import logging.
	OnRemoteDecideError func(ctx context.Context, err error)
}

PolicyAuthenticator routes inbound metadata to the configured local handler or RemoteDecider and enforces api_key_sso sequencing (local API key then remote).

func (a PolicyAuthenticator) Authenticate(ctx context.Context, req sdkauth.InboundCallMeta) (sdkauth.Decision, error)

type PrincipalSnapshot ¶

type PrincipalSnapshot struct {
	ID          string
	DisplayName string
}

PrincipalSnapshot is a minimal non-secret identity fragment for core-local audit helpers without depending on pkg/lipsdk/execview in call signatures.

func NewPrincipalSnapshot(id, displayName string) PrincipalSnapshot

type RemoteDecider ¶

type RemoteDecider interface {
	Decide(ctx context.Context, req sdkauth.InboundCallMeta) (sdkauth.Decision, error)
}

RemoteDecider is the consumer-side port for delegated (remote) auth. Implementations are wired at the composition root; this package does not include transport.

type ScopeBuildInput ¶

type ScopeBuildInput struct {
	Decision sdkauth.Decision
}

ScopeBuildInput is the input to BuildScope: a trusted auth decision.

type ScopeBuildResult ¶

type ScopeBuildResult struct {
	Scope     scope.PrincipalScopeView
	Principal execview.PrincipalView
}

ScopeBuildResult is the output of BuildScope: one authoritative scope snapshot and the derived legacy principal projection. The principal is always derived from the scope.

func BuildScope(input ScopeBuildInput) (ScopeBuildResult, error)

type SessionAuditPolicy ¶

type SessionAuditPolicy struct {
	AccessMode    sdkauth.AccessMode
	HandlerKind   sdkauth.HandlerKind
	RequiredLevel sdkauth.RequiredLevel
}

SessionAuditPolicy is a frozen access + auth handler snapshot for operator-visible audit events emitted from the executor (session-start) and should stay aligned with HTTP auth policy snapshots.

type SessionStartBuildInput ¶

type SessionStartBuildInput struct {
	Now                  time.Time
	TraceID              string
	Policy               SessionAuditPolicy
	Frontend             string
	PrincipalID          string
	PrincipalDisplayName string

	AuthoritativeSessionID string
	ClientSessionIDRaw     string
	ALegID                 string
	IsNew                  bool
	// SyntheticLocalPrincipal is true when the composition root supplies a dev-only inferred principal.
	SyntheticLocalPrincipal bool
}

SessionStartBuildInput carries resolved, non-secret session identity inputs for BuildSessionStartEvent.