Documentation
¶
Overview ¶
Package tenant resolves the milo project that scopes a conversations apiserver request. Conversations are keyed by project in Postgres (conversations.project_name), so every read must be pinned to exactly one project — never a cross-project view.
The project is the request namespace. When the caller is a milo identity the request also carries the identity's parent-Project in UserInfo.Extra (populated by the milo apiserver front end); when present it must agree with the namespace, so a token minted for project A cannot read project B by aiming the URL at B's namespace. In dev (in-cluster authn against the kind apiserver) there is no milo Extra, so the namespace stands alone.
Index ¶
Constants ¶
const ( // ExtraParentAPIGroup, ExtraParentType, ExtraParentName are the UserInfo.Extra // keys the milo apiserver stamps with the authenticated identity's parent // resource (its owning Project or Organization). ExtraParentAPIGroup = "iam.miloapis.com/parent-api-group" ExtraParentType = "iam.miloapis.com/parent-type" ExtraParentName = "iam.miloapis.com/parent-name" )
Variables ¶
This section is empty.
Functions ¶
func ProjectFromContext ¶
ProjectFromContext resolves the single project a request may read. The namespace is authoritative (conversations are namespaced by project); if the caller's milo identity carries a parent Project it must equal the namespace, otherwise the request is refused so a project-scoped token cannot reach another project's rows. gr scopes the returned Forbidden/BadRequest error.
Types ¶
type Identity ¶
Identity is the milo parent resource of the authenticated caller, extracted from UserInfo.Extra. A zero Identity means "no milo parent" (e.g. a dev in-cluster identity), in which case scoping falls back to the namespace.
func FromContext ¶
FromContext reads the caller's milo parent identity from the request user's Extra. It returns a zero Identity when there is no authenticated user or no parent stamped (dev in-cluster path).
Source Files