Documentation
¶
Overview ¶
Package handlerdep decides how an auth handler name maps to a plugin dependency for catalog resolution. It centralizes the precedence rules — config pin, official allowlist, then bare catalog name — used by the auth registry fallback resolver and the CLI auth commands.
Resolve performs NO network or filesystem I/O; it only decides the dependency shape and reports which source produced it. The caller is responsible for actually fetching and registering the plugin.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrOfficialDisabled = errors.New("official auth handlers are disabled")
ErrOfficialDisabled is returned by Resolve when the name matches an official handler but official auth handler resolution is disabled via settings.disableOfficialAuthHandlers.
var ErrThirdPartyDisabled = errors.New("third-party auth handlers are disabled")
ErrThirdPartyDisabled is returned by Resolve when the name resolves to a non-official (catalog or config-pinned) handler but third-party auth handler resolution is disabled via settings.disableThirdPartyAuthHandlers.
Functions ¶
func IsKnown ¶
IsKnown reports whether name is a resolvable official handler or config pin under the current policy. It performs no catalog probe, so a bare catalog name that exists only in a remote catalog returns false. It honors the disable switches: a config pin is not "known" when settings.disableThirdPartyAuthHandlers is set, and an official name is not "known" when settings.disableOfficialAuthHandlers is set -- matching what Resolve would allow. Use this for cheap pre-validation and shell completion, not as an authoritative existence check.
Types ¶
type Source ¶
type Source int
Source records where a handler dependency was resolved from.
const ( // SourceUnknown is the zero value, used when resolution fails. SourceUnknown Source = iota // SourceConfigPin means the dependency came from auth.handlers.<name>.plugin. SourceConfigPin // SourceOfficial means the name matched the official handler allowlist. SourceOfficial // SourceCatalog means the name resolves as a bare catalog artifact name. SourceCatalog )
func Resolve ¶
Resolve maps an auth handler name to the plugin dependency that should be fetched from a configured catalog, and reports the source that produced it.
Precedence:
- Config pin (auth.handlers.<name>.plugin) — explicit user mapping.
- Official allowlist — first-party trust anchor.
- Bare catalog name — resolve the name directly as a catalog artifact.
Resolve honors the disable switches: an official name is rejected with ErrOfficialDisabled when settings.disableOfficialAuthHandlers is set, and a non-official (config-pinned or catalog) name is rejected with ErrThirdPartyDisabled when settings.disableThirdPartyAuthHandlers is set.
Source Files