sessionmanager

package module
v0.18.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 13, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

README

REUSE status

Session Manager

About this project

KCM Session Manager, implementing the OIDC authorization code flow.

Requirements and Setup

Pre-requisites

For the local development, the service requires some tools installed locally:

Running in a local k3d cluster

To start the service, execute the following command:

$ make start

This will start a local k3d cluster, deploy PostgreSQL, perform the database migrations, and deploy the service.

Running and debugging on the host

For the fast inner-loop workflow — running the binary directly on your machine with backing services (Postgres, Valkey, and a mock OIDC provider) in Docker Compose, and attaching a debugger — see docs/local-dev.md:

$ make dev-deps   # start dependencies (waits until healthy)
$ make migrate    # apply DB migrations
$ make run        # run the api-server on the host

Support, Feedback, Contributing

This project is open to feature requests/suggestions, bug reports etc. via GitHub issues. Contribution and feedback are encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our Contribution Guidelines.

Security / Disclosure

If you find any bug that may be a security problem, please follow our instructions at in our security policy on how to report it. Please do not create GitHub issues for security-related doubts or problems.

Code of Conduct

We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone. By participating in this project, you agree to abide by its Code of Conduct at all times.

Licensing

Copyright 2025 SAP SE or an SAP affiliate company and session-manager contributors. Please see our LICENSE for copyright and license information. Detailed information including third-party components and their licensing/copyright information is available via the REUSE tool.

Bundesministerium für Wirtschaft und Klimaschutz (BMWK)-EU funding logo

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func GetModuleAs 

func GetModuleAs[T any](c *Context, id string) (T, error)

GetModuleAs looks up a loaded module by ID and asserts it to the interface T. It is the type-safe replacement for GetModule.

func Modules 

func Modules() iter.Seq[ModuleInfo]

func RegisterDepInterface 

func RegisterDepInterface(key string, t reflect.Type)

RegisterDepInterface associates a dep tag key with the interface type that a dependency named by that key must implement. Call it from a package init(). Duplicate keys panic, mirroring RegisterModule.

func RegisterModule 

func RegisterModule(module Module)

Types

type App 

type App interface {
	Start() error
	Stop() error
}

type Context 

type Context struct {
	//nolint:containedctx
	context.Context
	// contains filtered or unexported fields
}

func NewContext 

func NewContext(ctx context.Context) (*Context, context.CancelCauseFunc)

func (*Context) GetApp 

func (c *Context) GetApp(id string) (App, error)

func (*Context) GetModule 

func (c *Context) GetModule(id string) (Module, error)

func (*Context) LoadAll 

func (c *Context) LoadAll(specs []LoadSpec) error

LoadAll loads a set of module specs through four phases so the dependency graph can be validated before any module is provisioned (before side effects such as opening database pools):

Phase 1: flatten specs into pending nodes, recording app->service edges.

Phase 2: instantiate + UnmarshalExtension each node (NO Provision yet).

Phase 3: read dep-tagged fields via reflection and validate the whole graph (every referenced ID present, satisfies its interface, no cycles), aggregating all errors.

Phase 4: provision each node in dependency order (derived by topological sort over the dep-tagged and app->service edges) and register it into the Context, rolling back on failure.

func (*Context) ValidateAll 

func (c *Context) ValidateAll(specs []LoadSpec) error

ValidateAll runs all phases without provisioning anything. It lets an operator or a test check that every referenced module registered, every dependency satisfying its declared interface, no cycles.

func (*Context) WithValue 

func (c *Context) WithValue(key, val any) *Context

type Database 

type Database interface {
	Exec(ctx context.Context, sql string, args ...any) (pgconn.CommandTag, error)
	Query(ctx context.Context, sql string, args ...any) (pgx.Rows, error)
	QueryRow(ctx context.Context, sql string, args ...any) pgx.Row
	STDAdapter() *sql.DB
}

type ExtensionConfig 

type ExtensionConfig interface {
	Module() string
	UnmarshalExtension(into Module) error
}

type LoadSpec 

type LoadSpec struct {
	Cfg      ExtensionConfig
	IsApp    bool
	Children []LoadSpec
}

LoadSpec describes one module (or app) to load, together with any child modules an app owns (e.g. a grpc server app and its service modules).

type Migrate 

type Migrate interface {
	Migrate(ctx context.Context) error
}

type Module 

type Module interface {
	Module() ModuleInfo
}

type ModuleInfo 

type ModuleInfo struct {
	ID  string
	New func() Module
}

func GetModule 

func GetModule(id string) (ModuleInfo, error)

type Provisioner 

type Provisioner interface {
	Provision(ctx *Context) error
}

type Trust 

type Trust interface {
	// Apply applies and stores the provided Trust.
	Apply(ctx context.Context, trust *trustv1.Trust) error
	// Block sets the Blocked flag to true for the trust associated with the given tenantID.
	// If the trust is already blocked, it does nothing.
	// Returns an error if the trust cannot be retrieved or updated.
	Block(ctx context.Context, tenantID string) error
	// Remove removes the trust for the given tenantID.
	Remove(ctx context.Context, tenantID string) error
	// Unblock sets the Blocked flag to false for the trust associated with the given tenantID.
	// If the trust is not blocked, it does nothing.
	// Returns an error if the trust cannot be retrieved or updated.
	Unblock(ctx context.Context, tenantID string) error
	// Get returns a trust message with optional extensions set.
	Get(ctx context.Context, tenantID string) (*trustv1.Trust, error)
}

Source Files

View all Source files

Directories

Path Synopsis
cmd
session-manager command
session-manager/apiserver
session-manager/housekeeper
session-manager/maincmd
session-manager/migrate
internal
business
business/server
cmdutils
config
Package config defines the necessary types to configure the application.
 Package config defines the necessary types to configure the application.
credentials
dbtest/postgrestest
dbtest/valkeytest
debugtools
Package debugtools contains tools used for debugging the application.
 Package debugtools contains tools used for debugging the application.
middleware
Package middleware provides utilities to inject the response writer and request reader for the original *http.Request into the context and also retrieve it.
 Package middleware provides utilities to inject the response writer and request reader for the original *http.Request into the context and also retrieve it.
openapi
Package openapi provides primitives to interact with the openapi HTTP API.
 Package openapi provides primitives to interact with the openapi HTTP API.
pkce
session
session/mock
session/valkey
sessionwiring
Package sessionwiring centralises the construction of the long-lived session.Manager that the HTTP API server and the housekeeper subcommand share.
 Package sessionwiring centralises the construction of the long-lived session.Manager that the HTTP API server and the housekeeper subcommand share.
modules
app/grpcserver
Package grpcserver provides the app.module.grpcserver app module: a long-running gRPC server that hosts service modules registered through its services: config block.
 Package grpcserver provides the app.module.grpcserver app module: a long-running gRPC server that hosts service modules registered through its services: config block.
credentials/oauth2
Package oauth2 provides the credentials.module.oauth2 module: a credentials.Builder that produces transport credentials for OAuth2/OIDC client authentication.
 Package oauth2 provides the credentials.module.oauth2 module: a credentials.Builder that produces transport credentials for OAuth2/OIDC client authentication.
database/pgxpool
grpc/oidcmapping
Package oidcmapping provides the service.module.grpc.oidcmapping module: a gRPC service module that registers the legacy kms.api.cmk.sessionmanager.oidcmapping.v1.Service proto onto a grpc.ServiceRegistrar supplied by app.module.grpcserver.
 Package oidcmapping provides the service.module.grpc.oidcmapping module: a gRPC service module that registers the legacy kms.api.cmk.sessionmanager.oidcmapping.v1.Service proto onto a grpc.ServiceRegistrar supplied by app.module.grpcserver.
grpc/session
Package session provides the service.module.grpc.session module: a gRPC service module that registers the kms.api.cmk.sessionmanager.session.v1.Service proto onto a grpc.ServiceRegistrar supplied by app.module.grpcserver.
 Package session provides the service.module.grpc.session module: a gRPC service module that registers the kms.api.cmk.sessionmanager.session.v1.Service proto onto a grpc.ServiceRegistrar supplied by app.module.grpcserver.
grpc/trustmapping
Package trustmapping provides the service.module.grpc.trustmapping module: a gRPC service module that registers the kms.api.cmk.sessionmanager.trustmapping.v1.Service proto onto a grpc.ServiceRegistrar supplied by app.module.grpcserver.
 Package trustmapping provides the service.module.grpc.trustmapping module: a gRPC service module that registers the kms.api.cmk.sessionmanager.trustmapping.v1.Service proto onto a grpc.ServiceRegistrar supplied by app.module.grpcserver.
oidctrust
oidctrust/internal/sql
oidctrust/internal/sql/queries
oidctrust/migrations
oidctrust/mocks
sessionstore/valkey
Package valkey provides the sessionstore.module.valkey module: a session.Repository backed by Valkey, configured by the top-level valkey: config block.
 Package valkey provides the sessionstore.module.valkey module: a session.Repository backed by Valkey, configured by the top-level valkey: config block.
standard
pkg
serviceerr

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.