Help us shape the future of Go! Take the 2026 Go Developer Survey

operatorauth

package
v0.4.25 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 15, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	EnvIssuer       = "BASEHARBOR_OPERATOR_OIDC_ISSUER"
	EnvClientID     = "BASEHARBOR_OPERATOR_OIDC_CLIENT_ID"
	EnvScopes       = "BASEHARBOR_OPERATOR_OIDC_SCOPES"
	EnvCallbackPort = "BASEHARBOR_OPERATOR_OIDC_CALLBACK_PORT"
)
View Source 
const AuthorizationContractVersion = "v1"

Variables

View Source 
var (
	ErrConfigurationRequired  = errors.New("operator OIDC configuration is required for managed environments")
	ErrAuthenticationRequired = errors.New("authenticated BaseHarbor operator session is required")
)

Functions

func ClearSession 

func ClearSession(target, environment string) error

func EnforcementEnabled 

func EnforcementEnabled(ctx context.Context) bool

func Ensure 

func Ensure(ctx context.Context, target, environment string, cfg Config) (context.Context, error)

func LocalWorkloadOperation added in v0.4.25 

func LocalWorkloadOperation(operation string) bool

func Login 

func Login(ctx context.Context, target, environment string, cfg Config, out io.Writer) (*identity.Principal, error)

func ManagedEnvironment 

func ManagedEnvironment(environment string) bool

func PrincipalFromContext 

func PrincipalFromContext(ctx context.Context) (*identity.Principal, bool)

func SaveSession 

func SaveSession(session Session) error

func SessionPath 

func SessionPath(target, environment string) (string, error)

func VerifySession 

func VerifySession(ctx context.Context, target, environment string, cfg Config) (*identity.Principal, error)

func WithEnforcement 

func WithEnforcement(ctx context.Context) context.Context

func WithInteractive 

func WithInteractive(ctx context.Context, in io.Reader, out, errOut io.Writer) context.Context

func WithVerifiedLocalRuntimeAuthority added in v0.4.25 

func WithVerifiedLocalRuntimeAuthority(ctx context.Context, authority LocalRuntimeAuthority) context.Context

func WithVerifiedPrincipal added in v0.4.22 

func WithVerifiedPrincipal(ctx context.Context, principal *identity.Principal) context.Context

func WithoutLocalRuntimeAuthority added in v0.4.25 

func WithoutLocalRuntimeAuthority(ctx context.Context) context.Context

Types

type AuthorizationDecision added in v0.4.22 

type AuthorizationDecision struct {
	ContractVersion      string              `json:"contract_version"`
	Allowed              bool                `json:"allowed"`
	Operation            string              `json:"operation"`
	Safety               machine.SafetyClass `json:"safety"`
	PolicyRequired       bool                `json:"policy_required"`
	ConfirmationRequired bool                `json:"confirmation_required"`
	Actor                MachineActorRef     `json:"actor"`
	Context              OperationContext    `json:"context"`
	ReasonCode           string              `json:"reason_code,omitempty"`
	Reason               string              `json:"reason,omitempty"`
}

func AuthorizationDecisionFromContext added in v0.4.22 

func AuthorizationDecisionFromContext(ctx context.Context) (AuthorizationDecision, bool)

func AuthorizeMachineOperation added in v0.4.22 

func AuthorizeMachineOperation(ctx context.Context, request AuthorizationRequest) (AuthorizationDecision, error)

type AuthorizationRequest added in v0.4.22 

type AuthorizationRequest struct {
	Operation machine.Operation
	Context   OperationContext
}

type Config 

type Config struct {
	Provider     string
	Issuer       string
	ClientID     string
	Scopes       []string
	CallbackPort int
}

func ConfigFromEnv 

func ConfigFromEnv() (Config, error)

func (Config) Validate 

func (c Config) Validate() error

type Interactive 

type Interactive struct {
	In     io.Reader
	Out    io.Writer
	ErrOut io.Writer
}

func InteractiveFromContext 

func InteractiveFromContext(ctx context.Context) (Interactive, bool)

type LocalRuntimeAuthority added in v0.4.25 

type LocalRuntimeAuthority struct {
	Operation   string
	Target      string
	Environment string
	Runtime     string
}

LocalRuntimeAuthority is invocation evidence supplied by a trusted adapter after observing its local runtime binding and explicit authentication policy. It is not a principal, persisted identity, or machine-request input. One operation on one Target/environment is covered; tenant/Core operations are never authorized through this authority.

type MachineActorRef added in v0.4.22 

type MachineActorRef = machine.ActorRef

type OperationContext added in v0.4.22 

type OperationContext = machine.OperationContext

type Session 

type Session struct {
	Target      string    `json:"target"`
	Environment string    `json:"environment"`
	Issuer      string    `json:"issuer"`
	Subject     string    `json:"subject"`
	ClientID    string    `json:"client_id"`
	IDToken     string    `json:"id_token"`
	ExpiresAt   time.Time `json:"expires_at"`
}

func LoadSession 

func LoadSession(target, environment string) (Session, error)

func (Session) ValidAt 

func (s Session) ValidAt(now time.Time) bool

type SessionObservation 

type SessionObservation struct {
	Present     bool      `json:"present"`
	Valid       bool      `json:"valid"`
	Target      string    `json:"target,omitempty"`
	Environment string    `json:"environment,omitempty"`
	Issuer      string    `json:"issuer,omitempty"`
	Subject     string    `json:"subject,omitempty"`
	ClientID    string    `json:"client_id,omitempty"`
	ExpiresAt   time.Time `json:"expires_at,omitempty"`
}

func ObserveSession 

func ObserveSession(target, environment string, cfg Config) (SessionObservation, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.