Documentation
¶
Index ¶
- Constants
- func AdminClient(socket string) (api.AdminServiceClient, error)
- func AdminSocketFile(sessionID string) string
- func NewAutoAcceptingHostKeyCallback(stdout io.Writer, knownHostsFilename string) (ssh.HostKeyCallback, error)
- func NewPromptingHostKeyCallback(stdin io.Reader, stdout io.Writer, knownHostsFilename string) (ssh.HostKeyCallback, error)
- func ProviderList() string
- func Signers(privateKeys []string) ([]ssh.Signer, func(), error)
- func SignersFromFiles(privateKeys []string) ([]ssh.Signer, error)
- type AuthorizedKey
- type CredentialMode
- type Fetcher
- type Host
- type UserRef
Constants ¶
const (
AdminSockExt = ".sock"
)
Variables ¶
This section is empty.
Functions ¶
func AdminClient ¶
func AdminClient(socket string) (api.AdminServiceClient, error)
func AdminSocketFile ¶
func NewAutoAcceptingHostKeyCallback ¶ added in v0.19.0
func NewAutoAcceptingHostKeyCallback(stdout io.Writer, knownHostsFilename string) (ssh.HostKeyCallback, error)
NewAutoAcceptingHostKeyCallback creates a host key callback that automatically accepts unknown host keys and adds them to the known_hosts file without prompting. This is similar to SSH's StrictHostKeyChecking=accept-new behavior: - Unknown host keys are automatically accepted and added to known_hosts - Known host keys are still validated (preventing MITM attacks on subsequent connections)
func ProviderList ¶ added in v0.27.0
func ProviderList() string
ProviderList names every supported provider and marks the ones that need an explicit host. It is the single source for both parse errors and the --authorized-user flag's help text, so the two cannot drift apart.
Types ¶
type AuthorizedKey ¶ added in v0.13.0
func AuthorizedKeysFromFile ¶ added in v0.13.0
func AuthorizedKeysFromFile(file string) (*AuthorizedKey, error)
func AuthorizedKeysFromUserRefs ¶ added in v0.27.0
func AuthorizedKeysFromUserRefs(ctx context.Context, refs []UserRef, logger *slog.Logger) ([]*AuthorizedKey, error)
AuthorizedKeysFromUserRefs resolves refs using a default Fetcher.
type CredentialMode ¶ added in v0.27.0
type CredentialMode int
CredentialMode describes how a reference selects an authentication token.
const ( // CredentialNone never sends a credential. Every provider but GitHub. CredentialNone CredentialMode = iota // CredentialDefault defers to go-gh's own host and token resolution, // preserving GH_HOST and the enterprise environment variables. Used when a // GitHub reference names no explicit host. CredentialDefault // CredentialHostScoped uses only credentials stored for the named host. // GH_ENTERPRISE_TOKEN and GITHUB_ENTERPRISE_TOKEN are not host-scoped, so // honoring them here would send one instance's token to another. CredentialHostScoped )
type Fetcher ¶ added in v0.27.0
type Fetcher struct {
Logger *slog.Logger
// Transport, when set, is the base round tripper for every request. Tests
// use it to trust httptest certificates; production leaves it nil.
Transport http.RoundTripper
}
Fetcher resolves user references to authorized keys.
func (*Fetcher) AuthorizedKeys ¶ added in v0.27.0
AuthorizedKeys fetches every reference, reporting all failures together. Any failure fails the whole call: continuing with a partial set can, in the limit, degrade "only alice may join" into "anyone may join".
type Host ¶
type Host struct {
Host string
KeepAliveDuration time.Duration
Command []string
ForceCommand []string
Signers []ssh.Signer
HostKeyCallback ssh.HostKeyCallback
AuthorizedKeys []*AuthorizedKey
AdminSocketFile string
SessionCreatedCallback func(context.Context, *api.GetSessionResponse) error
ClientJoinedCallback func(*api.Client)
ClientLeftCallback func(*api.Client)
Logger *slog.Logger
Stdin *os.File
Stdout *os.File
ReadOnly bool
AllowLocalTCPForwarding bool
ForceForwardingInputForTesting bool
// SFTP configuration
SFTPDisabled bool // Disable SFTP subsystem entirely (--no-sftp)
SFTPPermissionChecker sftp.PermissionChecker // Optional: prompts user for SFTP permissions (nil = auto-allow)
}
type UserRef ¶ added in v0.27.0
type UserRef struct {
Provider string // "" for the raw-URL form
User string
Host string // host[:port] as written; "" means "provider default"
URL string // raw-URL form only: the complete .keys URL
Raw string // the original string, for error messages
Mode CredentialMode
}
UserRef is one parsed --authorized-user value.
func ParseUserRef ¶ added in v0.27.0
ParseUserRef parses a reference of the form provider:user, provider:user@host, or an https:// URL. It performs no I/O.
func (UserRef) Display ¶ added in v0.27.0
Display is the resolved identity used as AuthorizedKey.Comment. It names the host actually contacted, which the verbatim input does not when GH_HOST is in play.
func (UserRef) KeysURL ¶ added in v0.27.0
KeysURL returns the endpoint serving this user's authorized_keys body.
func (UserRef) ResolveHost ¶ added in v0.27.0
ResolveHost returns the host[:port] this reference targets.
Source Files
Directories