auth

Oct 20, 2026

Changes in this version

+ const DefaultResolverTTL

+ const PermAPIKeysManage

+ const PermAgentsDelete

+ const PermAgentsEnroll

+ const PermAgentsRead

+ const PermAgentsWrite

+ const PermAuditRead

+ const PermJobsDelete

+ const PermJobsRead

+ const PermJobsRun

+ const PermJobsWrite

+ const PermKeyringsDelete

+ const PermKeyringsExport

+ const PermKeyringsRead

+ const PermKeyringsWrite

+ const PermRBACManage

+ const PermTargetsCredentials

+ const PermTargetsDelete

+ const PermTargetsRead

+ const PermTargetsWrite

+ const PermTemporalUI

+ const PermTenantsDelete

+ const PermTenantsRead

+ const PermTenantsWrite

+ const RoleAdmin

+ const RoleOperator

+ const RoleViewer

+ var BuiltinDescriptions = map[string]string

+ var Catalog = []PermissionGroup

+ var GlobalOnly = []string

+ func AllPermissions() []string

+ func BuiltinRoles() map[string][]string

+ func CheckGlobalOnly(perms []string, sel db.Selector) error

+ func ClientIP(r *http.Request) string

+ func HasGlobalOnly(perms []string) bool

+ func KnownPermission(p string) bool

+ func Narrower(p *Principal, perms []string, sel db.Selector) error

+ func NewAuditEntry(r *http.Request, action, kind, id, name string, labels db.Labels, details any) *db.AuditEntry

+ func RequireAny(next http.Handler) http.Handler

+ func RequireAnyPerm(perms ...string) func(http.Handler) http.Handler

+ func RequirePerm(perm string) func(http.Handler) http.Handler

type AdminAuth

+ RBAC *Resolver

+ Sessions *SessionChecker

+ type Binding struct

+ Permissions []string

+ Role string

+ Selector db.Selector

+ func AdminBindings() []Binding

+ type BindingStore interface

+ BindingsFor func(ctx context.Context, email string, groups, claims []string) ([]*db.RoleBinding, error)

+ GetRole func(ctx context.Context, name string) (*db.Role, error)

type Identity

+ Claims []string

+ type PermissionGroup struct

+ Permissions []string

+ Resource string

type Principal

+ Bindings []Binding

+ SessionID string

+ func (p *Principal) Allowed(perm string, labels db.Labels) bool

+ func (p *Principal) Can(perm string) bool

+ func (p *Principal) Covers(perm string, sel db.Selector) bool

+ func (p *Principal) Permissions() []string

+ func (p *Principal) Scope(perm string) db.Scope

+ type Resolver struct

+ func NewResolver(store BindingStore, ttl time.Duration) *Resolver

+ func (r *Resolver) APIKey(ctx context.Context, key *db.APIKey) ([]Binding, error)

+ func (r *Resolver) Flush()

+ func (r *Resolver) Session(ctx context.Context, email string, emailUnverified bool, ...) ([]Binding, error)

+ type SessionChecker struct

+ func NewSessionChecker(store SessionStore, ttl time.Duration) *SessionChecker

+ func (c *SessionChecker) Active(ctx context.Context, id string) (bool, error)

+ func (c *SessionChecker) Flush()

+ func (c *SessionChecker) Forget(id string)

type SessionClaims

+ BindingClaims []string

+ EmailUnverified bool

+ type SessionStore interface

+ TouchAdminSession func(ctx context.Context, id string) (bool, error)

Oct 16, 2026

Changes in this version

type AgentClaims

+ Worker bool

type AgentTokenClaims

+ Worker bool

type BackupTicketClaims

+ Issued int64

type Identity

+ EmailUnverified bool

type TokenManager

+ func (tm *TokenManager) CreateWorkerToken(agentID uuid.UUID, taskQueue string, version int, ttl time.Duration) (string, time.Time, error)

Aug 26, 2026

Changes in this version

+ const APIKeyPrefix

+ const AudienceAgent

+ const AudienceBackupTicket

+ const AudienceLoginState

+ const AudienceSession

+ const CSRFHeader

+ const CSRFHeaderValue

+ const DefaultAgentTokenTTL

+ const DefaultSessionTTL

+ const Issuer

+ const LoginStateCookieName

+ const SessionCookieName

+ var ErrAgentRevoked = errors.New("agent has been revoked")

+ var ErrInvalidAPIKey = errors.New("invalid, expired or revoked API key")

+ var ErrInvalidTicket = errors.New("invalid or expired backup ticket")

+ var ErrInvalidToken = errors.New("invalid or expired token")

+ var ErrNotAuthorized = errors.New("identity is not authorized to access this server")

+ func AuthorizeIdentity(cfg OIDCConfig, id *Identity) error

+ func ClearLoginStateCookie(w http.ResponseWriter, opts CookieOptions)

+ func ClearSessionCookie(w http.ResponseWriter, opts CookieOptions)

+ func GenerateSecureToken(length int) (rawToken string, tokenHash string, err error)

+ func HashToken(rawToken string) string

+ func IsAPIKey(value string) bool

+ func LookupAPIKey(ctx context.Context, store APIKeyStore, raw string) (*db.APIKey, error)

+ func NewAPIKey(name, createdBy string, expiresAt *time.Time) (raw string, key *db.APIKey, err error)

+ func NewRandomToken() (string, error)

+ func SetLoginStateCookie(w http.ResponseWriter, token string, opts CookieOptions)

+ func SetSessionCookie(w http.ResponseWriter, token string, expires time.Time, opts CookieOptions)

+ func WithAgent(ctx context.Context, c *AgentClaims) context.Context

+ func WithPrincipal(ctx context.Context, p *Principal) context.Context

+ type APIKeyStore interface

+ CreateAPIKey func(ctx context.Context, key *db.APIKey) error

+ GetAPIKeyByHash func(ctx context.Context, hash string) (*db.APIKey, error)

+ TouchAPIKey func(ctx context.Context, id uuid.UUID) error

+ type AdminAuth struct

+ Insecure bool

+ Keys APIKeyStore

+ LoginPath string

+ TM *TokenManager

+ func NewAdminAuth(tm *TokenManager, keys APIKeyStore, insecure bool) *AdminAuth

+ func (a *AdminAuth) Authenticate(r *http.Request) (*Principal, error)

+ func (a *AdminAuth) RequireAdmin(next http.Handler) http.Handler

+ type AgentAuth struct

+ Verifier *AgentVerifier

+ func (a *AgentAuth) RequireAgent(next http.Handler) http.Handler

+ type AgentClaims struct

+ AgentID uuid.UUID

+ ExpiresAt time.Time

+ TaskQueue string

+ Version int

+ func AgentFrom(ctx context.Context) *AgentClaims

+ type AgentStateStore interface

+ GetAgentAuthState func(ctx context.Context, id uuid.UUID) (*db.AgentAuthState, error)

+ type AgentTokenClaims struct

+ TaskQueue string

+ Version int

+ func (c *AgentTokenClaims) AgentID() (uuid.UUID, error)

+ type AgentVerifier struct

+ func NewAgentVerifier(tm *TokenManager, store AgentStateStore, cacheTTL time.Duration) *AgentVerifier

+ func (v *AgentVerifier) Invalidate(agentID uuid.UUID)

+ func (v *AgentVerifier) Verify(ctx context.Context, bearer string) (*AgentClaims, error)

+ type BackupTicketClaims struct

+ AgentID uuid.UUID

+ BackupID string

+ BackupTime int64

+ BackupType string

+ Datastore string

+ JobID uuid.UUID

+ Namespace string

+ TargetID uuid.UUID

+ type CookieOptions struct

+ Secure bool

+ type Identity struct

+ Email string

+ Groups []string

+ Name string

+ Subject string

+ type LoginStateClaims struct

+ Next string

+ Nonce string

+ State string

+ type OIDC struct

+ func NewOIDC(ctx context.Context, cfg OIDCConfig, redirectURL string) (*OIDC, error)

+ func (o *OIDC) AuthCodeURL(state, nonce string) string

+ func (o *OIDC) Authorize(id *Identity) error

+ func (o *OIDC) Exchange(ctx context.Context, code, nonce string) (*Identity, error)

+ type OIDCConfig = config.OIDCConfig

+ type Principal struct

+ Email string

+ Kind PrincipalKind

+ Name string

+ Subject string

+ func PrincipalFrom(ctx context.Context) *Principal

+ func (p *Principal) Display() string

+ type PrincipalKind string

+ const PrincipalAPIKey

+ const PrincipalInsecure

+ const PrincipalSession

+ type SessionClaims struct

+ Email string

+ Groups []string

+ Name string

+ type TokenManager struct

+ func NewTokenManager(secret string) *TokenManager

+ func (tm *TokenManager) CreateAgentToken(agentID uuid.UUID, taskQueue string, version int, ttl time.Duration) (string, time.Time, error)

+ func (tm *TokenManager) CreateBackupTicket(claims BackupTicketClaims, ttl time.Duration) (string, error)

+ func (tm *TokenManager) CreateLoginState(state, nonce, next string) (string, error)

+ func (tm *TokenManager) CreateSession(id *Identity, ttl time.Duration) (string, time.Time, error)

+ func (tm *TokenManager) ValidateAgentToken(tokenString string) (*AgentTokenClaims, error)

+ func (tm *TokenManager) ValidateBackupTicket(ticketString string) (*BackupTicketClaims, error)

+ func (tm *TokenManager) ValidateLoginState(tokenString string) (*LoginStateClaims, error)

+ func (tm *TokenManager) ValidateSession(tokenString string) (*SessionClaims, error)