Documentation
¶
Index ¶
- func LoadOrGenerateServerKey(path string) (ed25519.PrivateKey, error)
- func RequireAuth(pubKey ed25519.PublicKey, next http.HandlerFunc) http.HandlerFunc
- func RequireAuthHandler(pubKey ed25519.PublicKey, next http.Handler) http.Handler
- func RequireCapability(pubKey ed25519.PublicKey, perms config.PermissionsConfig, capability string, ...) http.HandlerFunc
- func SignToken(key ed25519.PrivateKey, claims Claims) (string, error)
- func WithUser(ctx context.Context, u UserIdentity) context.Context
- type AuthorizedKeys
- type Claims
- type NonceStore
- type SSHKey
- type UserIdentity
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LoadOrGenerateServerKey ¶
func LoadOrGenerateServerKey(path string) (ed25519.PrivateKey, error)
LoadOrGenerateServerKey loads an ed25519 private key from path, or generates a new one and writes it if the file doesn't exist.
func RequireAuth ¶
func RequireAuth(pubKey ed25519.PublicKey, next http.HandlerFunc) http.HandlerFunc
RequireAuth returns middleware that verifies a Bearer JWT token and injects the authenticated UserIdentity into the request context.
func RequireAuthHandler ¶
RequireAuthHandler wraps an http.Handler with Bearer JWT verification.
func RequireCapability ¶
func RequireCapability(pubKey ed25519.PublicKey, perms config.PermissionsConfig, capability string, next http.HandlerFunc) http.HandlerFunc
RequireCapability wraps a handler with both JWT auth and a capability check against the permissions config. When permissions are not configured it falls through to RequireAuth only.
Types ¶
type AuthorizedKeys ¶
type AuthorizedKeys struct {
// contains filtered or unexported fields
}
AuthorizedKeys holds parsed SSH public keys and their associated identities.
func LoadAuthorizedKeys ¶
func LoadAuthorizedKeys(path string) (*AuthorizedKeys, error)
LoadAuthorizedKeys parses an OpenSSH authorized_keys file. Each line's comment field is parsed as the user identity.
func LoadOrCreateAuthorizedKeys ¶
func LoadOrCreateAuthorizedKeys(path string) (*AuthorizedKeys, error)
LoadOrCreateAuthorizedKeys loads the authorized_keys file, creating it with a comment header if it doesn't exist.
func (*AuthorizedKeys) Len ¶
func (ak *AuthorizedKeys) Len() int
Len returns the number of authorized keys.
func (*AuthorizedKeys) Lookup ¶
func (ak *AuthorizedKeys) Lookup(pubKey ssh.PublicKey) (UserIdentity, bool)
Lookup finds the identity associated with the given public key.
type Claims ¶
type Claims struct {
Sub string `json:"sub"` // "Name <email>" — UserIdentity.Raw
Exp int64 `json:"exp"` // Unix timestamp
Iat int64 `json:"iat"` // Unix timestamp
}
Claims represents the JWT payload.
type NonceStore ¶
type NonceStore struct {
// contains filtered or unexported fields
}
NonceStore is a thread-safe in-memory store for authentication nonces. Nonces are single-use and expire after a configurable TTL.
func NewNonceStore ¶
func NewNonceStore(ttl time.Duration) *NonceStore
NewNonceStore creates a new nonce store with the given TTL.
func (*NonceStore) Generate ¶
func (ns *NonceStore) Generate() (string, error)
Generate creates a new nonce and returns it as a base64-encoded string.
func (*NonceStore) Validate ¶
func (ns *NonceStore) Validate(nonce string) bool
Validate checks whether the nonce is valid (exists and not expired). A valid nonce is consumed (deleted) to prevent replay.
type SSHKey ¶
type SSHKey struct {
Path string // file path, empty for agent keys
Comment string // key comment
Signer ssh.Signer // ready-to-use signer
}
SSHKey represents a discovered SSH key available for authentication.
func DiscoverSSHKeys ¶
DiscoverSSHKeys finds available SSH keys from standard file locations and the ssh-agent.
func FindKeyByType ¶
FindKeyByType returns the first key matching the given SSH key type (e.g. "ssh-ed25519", "ssh-rsa").
func PreferEd25519 ¶
PreferEd25519 returns the ed25519 key if available, otherwise the first key.
type UserIdentity ¶
type UserIdentity struct {
Name string
Email string
Raw string // "Name <email>" — matches the CreatedBy format used in events
}
UserIdentity represents an authenticated user extracted from the authorized_keys comment field.
func ParseIdentity ¶
func ParseIdentity(raw string) UserIdentity
ParseIdentity parses a "Name <email>" string into a UserIdentity. If the string doesn't match that format, the entire string is used as Name.
func UserFromContext ¶
func UserFromContext(ctx context.Context) (UserIdentity, bool)
UserFromContext extracts the user identity from the context.
Source Files