server

type APIKeyAuthenticator ¶ added in v0.16.0

type APIKeyAuthenticator struct {
	// contains filtered or unexported fields
}

APIKeyAuthenticator authenticates requests using API keys. API key users have restricted access - they only get GroupAPIKey, not the full authenticated user groups.

func NewAPIKeyAuthenticator(client *client.Client) *APIKeyAuthenticator

func (a *APIKeyAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error)

type DeviceAuthenticator ¶ added in v0.24.0

type DeviceAuthenticator struct {
	// contains filtered or unexported fields
}

DeviceAuthenticator authenticates an enrolled device by a short-lived JWT the device signs itself with its identity key. There is no server-minted token: the JWT is verified against the public key registered at enrollment. The resulting principal is the device (device:<device_id>), scoped to submitting and reading its own device scans, so an unattended device can submit a scan attributed to itself.

func NewDeviceAuthenticator(client *client.Client) *DeviceAuthenticator

func (a *DeviceAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error)

type DeviceEnrollmentAuthenticator ¶ added in v0.24.0

type DeviceEnrollmentAuthenticator struct {
	// contains filtered or unexported fields
}

DeviceEnrollmentAuthenticator authenticates device-enrollment credentials (ode1-<configuration_id>-<key_id>-<secret>).

The resulting principal IS the MDMConfiguration the credential belongs to: its Name/UID is the configuration's namespaced identity (mdm-configuration:<id>) and its capability group is DeviceEnroll, authorizing the enrollment endpoint. The configuration id is stashed in Extra for the enroll handler to record on the device.

This mirrors APIKeyAuthenticator, but yields a non-user principal — there is no gateway user behind an enrollment credential — so it must be placed after the UserDecorator in the authenticator union.

func NewDeviceEnrollmentAuthenticator(client *client.Client) *DeviceEnrollmentAuthenticator

func (a *DeviceEnrollmentAuthenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error)

type Options ¶

type Options struct {
	Hostname   string
	UIHostname string `name:"ui-hostname" env:"OBOT_SERVER_UI_HOSTNAME"`

	DailyUserInputTokenLimit  int `usage:"The maximum number of daily user input tokens to allow, < 0 disables the limit" default:"10000000"` // default is 10 million
	DailyUserOutputTokenLimit int `usage:"The maximum number of daily user output tokens to allow, < 0 disables the limit" default:"100000"`  // default is 100 thousand
}

type Server ¶

type Server struct {
	// contains filtered or unexported fields
}

func New(ctx context.Context, db *db.DB, tokenService *persistent.TokenService, modelProviderDispatcher *dispatcher.Dispatcher, acrHelper *accesscontrolrule.Helper, mapHelper *modelaccesspolicy.Helper, messagePolicyHelper *messagepolicy.Helper, opts Options) (*Server, error)

func (s *Server) AddRoutes(mux *server.Server, tunnelBridge http.Handler)