config

package
v1.19.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 18, 2026 License: MIT Imports: 6 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Compile 

func Compile(configuration Configuration) (*security.CompiledConfiguration, error)

Compile turns a Configuration into the compiled form the runtime reads. The argument is the thing to know about this door: Configuration carries only unexported fields and no constructor, and Builder never hands one out, so no caller outside this package can build a non-empty one — a composition root calling Compile from outside gets the empty configuration's answer, which is a nil compiled configuration and a nil error, meaning "no security was declared". That is the ordinary case and not a hidden failure: the application installs security through the module hook, which is the only writer of the field the runtime reads, and a nil there simply means no module registered any. The public path from a declaration to the runtime is Builder.BuildAndCompile.

Types

type AccessControlBuilder 

type AccessControlBuilder struct {
	// contains filtered or unexported fields
}

func NewAccessControlBuilder 

func NewAccessControlBuilder() *AccessControlBuilder

func (*AccessControlBuilder) AllowAnonymous 

func (instance *AccessControlBuilder) AllowAnonymous(pathPrefix string) *AccessControlBuilder

func (*AccessControlBuilder) Build 

func (instance *AccessControlBuilder) Build() *security.AccessControl

func (*AccessControlBuilder) Require 

func (instance *AccessControlBuilder) Require(pathPrefix string, attributes ...string) *AccessControlBuilder

type AccessControlMergeStrategy 

type AccessControlMergeStrategy string

AccessControlMergeStrategy orders the merged rule LIST — it does not decide which rule answers a request. The matcher resolves by category first (an exact path beats every prefix, a longer prefix beats a shorter one, every prefix beats every regex, the empty-prefix fallback answers last), so a local /admin prefix rule is still beaten by a global /admin/reports rule under localFirst. List position decides only what the categories leave tied: which of two equal-length prefixes, which regex, which exact duplicate and which fallback wins. A rule that must beat a longer or more exact sibling needs a more specific path, not an earlier position. 

const (
	AccessControlMergeLocalFirst   AccessControlMergeStrategy = "localFirst"
	AccessControlMergeGlobalFirst  AccessControlMergeStrategy = "globalFirst"
	AccessControlMergeOverrideOnly AccessControlMergeStrategy = "overrideOnly"
)

type Builder 

type Builder struct {
	// contains filtered or unexported fields
}

func NewBuilder 

func NewBuilder() *Builder

func (*Builder) AddFirewall 

func (instance *Builder) AddFirewall(
	name string,
	matcher securitycontract.Matcher,
	rules []securitycontract.Rule,
	tokenSource securitycontract.TokenSource,
	loginPath string,
	logoutPath string,
	loginHandler securitycontract.LoginHandler,
	logoutHandler securitycontract.LogoutHandler,
	override FirewallOverrideConfiguration,
) *Builder

func (*Builder) AddStatefulFirewall added in v1.3.0 

func (instance *Builder) AddStatefulFirewall(
	name string,
	matcher securitycontract.Matcher,
	rules []securitycontract.Rule,
	tokenSource securitycontract.TokenSource,
	loginPath string,
	logoutPath string,
	loginHandler securitycontract.LoginHandler,
	logoutHandler securitycontract.LogoutHandler,
	override FirewallOverrideConfiguration,
) *Builder

func (*Builder) AddStatelessFirewall added in v1.3.0 

func (instance *Builder) AddStatelessFirewall(
	name string,
	matcher securitycontract.Matcher,
	rules []securitycontract.Rule,
	tokenSource securitycontract.TokenSource,
	override FirewallOverrideConfiguration,
) *Builder

func (*Builder) BuildAndCompile 

func (instance *Builder) BuildAndCompile() *security.CompiledConfiguration

func (*Builder) SetGlobal 

func (instance *Builder) SetGlobal(
	accessControl *security.AccessControl,
	roleHierarchy *security.RoleHierarchy,
	accessDecisionManager securitycontract.AccessDecisionManager,
	entryPoint securitycontract.EntryPoint,
	accessDeniedHandler securitycontract.AccessDeniedHandler,
) *Builder

type Configuration 

type Configuration struct {
	// contains filtered or unexported fields
}

type FirewallConfiguration 

type FirewallConfiguration struct {
	// contains filtered or unexported fields
}

type FirewallOverrideConfiguration 

type FirewallOverrideConfiguration struct {
	// contains filtered or unexported fields
}

FirewallOverrideConfiguration starts from the constructor defaults wherever it is built: the fields are unexported, so outside this package the only writes are the With setters, and a setter called on the exact zero value first reads the receiver as NewFirewallOverrideConfiguration before applying its own field. Without that reading, a zero value plus WithInheritGlobalAccessControl(false) carried an empty merge strategy, which the builder reads as an unconfigured override and repairs by writing the inheritance back to true — so the one field the caller set was the one field that never arrived. A firewall that inherits nothing and declares no rules of its own enforces nothing behind it: the compiled access control is empty, no rule matches, and every request reaches its handler.

func NewFirewallOverrideConfiguration 

func NewFirewallOverrideConfiguration() FirewallOverrideConfiguration

func (FirewallOverrideConfiguration) WithAccessControl added in v1.19.0 

func (instance FirewallOverrideConfiguration) WithAccessControl(accessControl *security.AccessControl) FirewallOverrideConfiguration

func (FirewallOverrideConfiguration) WithAccessDecisionManager added in v1.19.0 

func (instance FirewallOverrideConfiguration) WithAccessDecisionManager(accessDecisionManager securitycontract.AccessDecisionManager) FirewallOverrideConfiguration

func (FirewallOverrideConfiguration) WithAccessDeniedHandler added in v1.19.0 

func (instance FirewallOverrideConfiguration) WithAccessDeniedHandler(accessDeniedHandler securitycontract.AccessDeniedHandler) FirewallOverrideConfiguration

func (FirewallOverrideConfiguration) WithEntryPoint added in v1.19.0 

func (instance FirewallOverrideConfiguration) WithEntryPoint(entryPoint securitycontract.EntryPoint) FirewallOverrideConfiguration

func (FirewallOverrideConfiguration) WithInheritGlobalAccessControl added in v1.19.0 

func (instance FirewallOverrideConfiguration) WithInheritGlobalAccessControl(inheritGlobalAccessControl bool) FirewallOverrideConfiguration

WithInheritGlobalAccessControl turns the global policy off for this firewall. A firewall that inherits nothing and declares no access control of its own enforces nothing: pair it with WithAccessControl.

func (FirewallOverrideConfiguration) WithMergeStrategy added in v1.19.0 

func (instance FirewallOverrideConfiguration) WithMergeStrategy(mergeStrategy AccessControlMergeStrategy) FirewallOverrideConfiguration

WithMergeStrategy refuses a value that is none of the three by name: the merge reads the strategy by equality, so an unrecognised one behaved as localFirst in silence and an authorization policy the caller believed they had chosen was never applied. The empty string is refused with the rest, because it is the value the builder reads as an unconfigured override.

func (FirewallOverrideConfiguration) WithRoleHierarchy added in v1.19.0 

func (instance FirewallOverrideConfiguration) WithRoleHierarchy(roleHierarchy *security.RoleHierarchy) FirewallOverrideConfiguration

func (FirewallOverrideConfiguration) WithStateless added in v1.3.0 

func (instance FirewallOverrideConfiguration) WithStateless(stateless bool) FirewallOverrideConfiguration

type GlobalConfiguration 

type GlobalConfiguration struct {
	// contains filtered or unexported fields
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.