Help us shape the future of Go! Take the 2026 Go Developer Survey

server

package
v0.11.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 12, 2026 License: Apache-2.0 Imports: 42 Imported by: 0

README

Server Implementation

This is where the API interfaces are handled.

Form Marshaler for RFC 8693 Compliance

Overview

The token exchange endpoint must support application/x-www-form-urlencoded per RFC 8693. Since grpc-gateway defaults to JSON, we implement a custom marshaler.

Implementation: form_marshaler.go

The FormMarshaler implements grpc-gateway's runtime.Marshaler interface to handle form-encoded requests.

Key Design Decisions

  1. Request Decoding: Form-encoded → Map → JSON → Proto

    • Parse form data using url.ParseQuery
    • Convert to flat map
    • Marshal to JSON as intermediate format
    • Use protojson to unmarshal into proto message

    Why? Proto unmarshaling expects structured data. Going through JSON avoids reimplementing proto field mapping.

  2. Response Encoding: Always JSON

    • OAuth 2.0 responses are JSON by spec
    • Clients expect Content-Type: application/json in responses
    • Even form-encoded requests get JSON responses

  3. Dual Content-Type Support

    • Form-encoded: RFC 8693 OAuth clients
    • JSON: gRPC-style clients, testing tools
    • Registered via runtime.WithMarshalerOption
Known Limitations

  1. Nested Fields: Form encoding is flat; nested proto messages won't work correctly

    • Not an issue for RFC 8693 (all fields are flat strings)

  2. Array Fields: Form encoding can have repeated keys, but our implementation uses url.Values which handles this

    • Currently takes the first value if multiple present

  3. Type Conversion: All form values are strings

    • For ExchangeRequest, this is correct (per RFC 8693)
    • Numeric fields like expires_in in responses are handled by JSON marshaler
Testing
# Run unit tests
go test -v ./internal/server/

# Run integration tests
go test -v ./test/integration/
Example Usage

Form-encoded request (RFC 8693):

curl -X POST http://localhost:8080/v1/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
  -d "subject_token=eyJhbGciOiJIUzI1NiJ9..." \
  -d "subject_token_type=urn:ietf:params:oauth:token-type:jwt" \
  -d "audience=https://api.example.com"

JSON request (also supported):

curl -X POST http://localhost:8080/v1/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
    "subject_token": "eyJhbGciOiJIUzI1NiJ9...",
    "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
    "audience": "https://api.example.com"
  }'

Unsigned JSON subject token (draft-ietf-oauth-transaction-tokens §11.2.2). subject_token is the JSON object as a form string (percent-encode {…} in production clients):

curl -X POST http://localhost:8080/v1/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
  -d 'subject_token={"sub":"redhat:user:sso:123"}' \
  -d "subject_token_type=urn:ietf:params:oauth:token-type:unsigned_json" \
  -d "requested_token_type=urn:redhat:params:oauth:token-type:rh-identity"

Meaning of sub is issuance policy (CEL), not the token type. Production must ForActor-filter the unsigned_json_validator so only trusted actors can use it.

Both JWT and unsigned JSON produce a JSON response:

{
  "access_token": "...",
  "issued_token_type": "urn:ietf:params:oauth:token-type:txn_token",
  "token_type": "Bearer",
  "expires_in": 300
}
References
Future Improvements
  1. Performance: Consider caching the JSON intermediate step
  2. Validation: Add RFC 8693 field validation (required vs optional)
  3. Error Messages: Improve error messages for malformed form data
  4. Streaming: Currently doesn't support streaming (not needed for token exchange)

Documentation

Index

Constants

View Source 
const (
	CredentialSourceTypeBearer              = "authorization_bearer_opaque"
	CredentialSourceTypeCookie              = "cookie_bearer_opaque"
	CredentialSourceTypeBasicAuth           = "authorization_basic_auth"
	CredentialSourceTypeHeader              = "header"
	CredentialSourceTypeForwardedClientCert = "forwarded_client_cert_auth"
)

Credential source type strings used in config.

Variables

This section is empty.

Functions

func CompilePathPatterns added in v0.3.0 

func CompilePathPatterns(patterns []string) ([]*regexp.Regexp, error)

CompilePathPatterns compiles a list of RE2 regex strings into anchored regexps suitable for full-path matching. Each pattern is wrapped in ^(?:...)$ to enforce full-match semantics.

Types

type AuthzCheckAction added in v0.2.0 

type AuthzCheckAction string

AuthzCheckAction is the outcome an AuthzCheckPolicy selects. 

const (
	// AuthzCheckIssue means the server should build an IssueRequest and call
	// TokenService.IssueTokens.
	AuthzCheckIssue AuthzCheckAction = "issue"

	// AuthzCheckAllowWithoutIssue means the server should return OK without
	// issuing tokens. Credential headers are still sanitized when present.
	AuthzCheckAllowWithoutIssue AuthzCheckAction = "allow_without_issue"

	// AuthzCheckDeny means the server should return an authorization denial
	// without calling token issuers or datasources.
	AuthzCheckDeny AuthzCheckAction = "deny"
)

type AuthzCheckDecision added in v0.2.0 

type AuthzCheckDecision struct {
	Action     AuthzCheckAction
	TokenTypes []TokenTypeSpec
	Scope      string
	Reason     string
}

AuthzCheckDecision is the result of evaluating an AuthzCheckPolicy. For Issue decisions, TokenTypes and Scope control the shape of the token request. For Deny decisions, Reason is included in the denial response.

type AuthzCheckPolicy added in v0.2.0 

type AuthzCheckPolicy interface {
	Decide(ctx context.Context, in AuthzCheckPolicyInput) (AuthzCheckDecision, error)
}

AuthzCheckPolicy decides, given the ext_authz inputs, the shape of the token request and whether to invoke issuance at all.

Implementations must use the returned error only for evaluation failures (e.g. a CEL compilation error), not for policy denials. Deny is a normal policy outcome expressed via AuthzCheckDeny. The server fails closed on both, but observability must distinguish "policy denied this request" from "policy failed to evaluate."

type AuthzCheckPolicyInput added in v0.2.0 

type AuthzCheckPolicyInput struct {
	Subject Principal
	Actor   Principal
	Request *request.RequestAttributes
}

AuthzCheckPolicyInput carries the principals and request context that the authz check policy uses to make its decision.

type AuthzServer 

type AuthzServer struct {
	authv3.UnimplementedAuthorizationServer
	// contains filtered or unexported fields
}

AuthzServer implements Envoy's ext_authz Authorization service

func NewAuthzServer 

func NewAuthzServer(trustStore trust.Store, tokenService *service.TokenService, policy AuthzCheckPolicy, credentialSources CredentialSources, observer service.AuthzCheckObserver) *AuthzServer

NewAuthzServer creates a new ext_authz server. policy decides, for each request, whether to issue tokens, allow without issue, or deny. If nil, a StaticAuthenticatedPolicy with default token types is used (preserving pre-policy behavior). credentialSources defines where credentials are extracted from for both subject and actor authentication.

func (*AuthzServer) Check 

func (s *AuthzServer) Check(ctx context.Context, req *authv3.CheckRequest) (*authv3.CheckResponse, error)

Check implements the ext_authz check endpoint

type BasicAuthCredentialSource added in v0.3.0 

type BasicAuthCredentialSource struct {
	SourceName string
}

BasicAuthCredentialSource extracts HTTP Basic Auth credentials from the Authorization header. It decodes the base64 value and splits it into username:password, returning a trust.BasicAuthCredential.

When the Authorization header is absent or uses a non-Basic scheme, Extract returns (nil, nil), allowing coexistence with other credential sources in the same chain.

func NewBasicAuthCredentialSource added in v0.3.0 

func NewBasicAuthCredentialSource(name string) (*BasicAuthCredentialSource, error)

NewBasicAuthCredentialSource returns a BasicAuthCredentialSource with the given name. The name is required.

func (*BasicAuthCredentialSource) Extract added in v0.3.0 

func (s *BasicAuthCredentialSource) Extract(_ context.Context, cc CredentialContext) (*CredentialExtraction, error)

type BearerCredentialSource added in v0.2.0 

type BearerCredentialSource struct {
	SourceName string
}

BearerCredentialSource extracts a bearer token from the Authorization header.

func NewBearerCredentialSource added in v0.2.0 

func NewBearerCredentialSource(name string) (*BearerCredentialSource, error)

NewBearerCredentialSource returns a BearerCredentialSource with the given name. The name is required.

func (*BearerCredentialSource) Extract added in v0.2.0 

func (s *BearerCredentialSource) Extract(_ context.Context, cc CredentialContext) (*CredentialExtraction, error)

type CacheRefreshProbe 

type CacheRefreshProbe interface {
	CacheRefreshFailed(err error)
	KeyConversionFailed(keyID string, err error)
	End()
}

CacheRefreshProbe tracks a single JWKS cache refresh invocation. Implementations should embed NoOpCacheRefreshProbe for forward compatibility.

type ClaimsFilterRegistry 

type ClaimsFilterRegistry interface {
	// GetFilter returns the ClaimsFilter for the given actor
	// The filter determines which request_context claims the actor is allowed to provide
	GetFilter(actor *trust.Result) (claims.ClaimsFilter, error)
}

ClaimsFilterRegistry determines which request_context claims an actor is allowed to provide This is a policy enforcement mechanism - different actors may be trusted to tell us about different aspects of the request

type Config 

type Config struct {
	GRPCListener net.Listener
	HTTPListener net.Listener

	// GRPCDialOptions are extra dial options appended when the grpc-gateway
	// dials the gRPC server. Use this to supply a custom dialer for
	// in-memory transports (e.g. bufconn).
	GRPCDialOptions []grpc.DialOption

	AuthzServer    *AuthzServer
	ExchangeServer *ExchangeServer
	JWKSServer     *JWKSServer

	// Observer for server lifecycle events. Defaults to NoOpServerObserver{} if nil.
	Observer LifecycleObserver

	// MuxConfigurer, when non-nil, is applied to the HTTP mux during Start
	// to register additional handlers (e.g. /metrics for Prometheus scraping).
	MuxConfigurer MuxConfigurer
}

Config contains server configuration. Callers must supply pre-created listeners; the server itself has no concept of port numbers.

type CookieCredentialSource added in v0.2.0 

type CookieCredentialSource struct {
	SourceName string
	CookieName string
}

CookieCredentialSource extracts a bearer token from a named cookie.

func NewCookieCredentialSource added in v0.2.0 

func NewCookieCredentialSource(name, cookieName string) (*CookieCredentialSource, error)

NewCookieCredentialSource returns a CookieCredentialSource with the given source name and cookie name. Both are required.

func (*CookieCredentialSource) Extract added in v0.2.0 

func (s *CookieCredentialSource) Extract(_ context.Context, cc CredentialContext) (*CredentialExtraction, error)

type CredentialContext added in v0.2.0 

type CredentialContext struct {
	Headers map[string]string // normalized lowercase header keys
	Cookies []*http.Cookie    // parsed from the cookie header; nil when absent
	TLSPeer *TLSPeerInfo      // mTLS client cert info; nil when absent
}

CredentialContext holds the normalized context needed by CredentialSource implementations to extract credentials. Callers build a CredentialContext from their specific transport (Envoy CheckRequest, gRPC context, etc.) before credential extraction.

func CredentialContextFromCheckRequest added in v0.2.0 

func CredentialContextFromCheckRequest(req *authv3.CheckRequest) (CredentialContext, error)

CredentialContextFromCheckRequest builds a CredentialContext from an Envoy ext_authz CheckRequest's HTTP attributes.

func CredentialContextFromGRPC added in v0.2.0 

func CredentialContextFromGRPC(ctx context.Context) (CredentialContext, error)

CredentialContextFromGRPC builds a CredentialContext from a gRPC server context, extracting metadata headers and TLS peer certificate info.

type CredentialExtraction added in v0.2.0 

type CredentialExtraction struct {
	Credential  trust.Credential
	HeadersUsed []string
	CookiesUsed []string
	SourceName  string
}

CredentialExtraction is the result of extracting a credential from a request. HeadersUsed lists whole headers that carried the credential (e.g. "authorization"). CookiesUsed lists individual cookie names that carried the credential. Callers decide what to do with this information (e.g. strip the headers, rewrite the Cookie header, etc.).

type CredentialSource added in v0.2.0 

type CredentialSource interface {
	// Returns (nil, nil) when no credential is found for this source.
	Extract(ctx context.Context, cc CredentialContext) (*CredentialExtraction, error)
}

CredentialSource extracts a credential from a transport-neutral context. Implementations handle specific credential presentation protocols (bearer header, cookie, etc.).

type CredentialSources added in v0.2.0 

type CredentialSources struct {
	// contains filtered or unexported fields
}

CredentialSources is an ordered collection of CredentialSource instances. It iterates sources in priority order, returning the first successful extraction. This encapsulates the ordering and fallback semantics so callers don't manage slices directly.

func DefaultCredentialSources added in v0.2.0 

func DefaultCredentialSources() CredentialSources

DefaultCredentialSources returns the default credential sources (authorization bearer only).

func NewCredentialSources added in v0.2.0 

func NewCredentialSources(sources ...CredentialSource) CredentialSources

NewCredentialSources creates a CredentialSources from individual sources.

func (CredentialSources) Extract added in v0.2.0 

func (cs CredentialSources) Extract(ctx context.Context, cc CredentialContext) (*CredentialExtraction, error)

Extract iterates the configured sources in order and returns the first successful extraction. Returns (nil, nil) when no source finds a credential. Errors from individual sources are collected and returned as a joined error when no source succeeds.

type ExchangeServer 

type ExchangeServer struct {
	parsecv1.UnimplementedTokenExchangeServiceServer
	// contains filtered or unexported fields
}

ExchangeServer implements the TokenExchange gRPC service

func NewExchangeServer 

func NewExchangeServer(trustStore trust.Store, tokenService *service.TokenService, claimsFilterRegistry ClaimsFilterRegistry, callerCredentialSources CredentialSources, observer service.TokenExchangeObserver) *ExchangeServer

NewExchangeServer creates a new token exchange server. callerCredentialSources defines where caller (actor) credentials are extracted from.

func (*ExchangeServer) Exchange 

func (s *ExchangeServer) Exchange(ctx context.Context, req *parsecv1.ExchangeRequest) (*parsecv1.ExchangeResponse, error)

Exchange implements the token exchange endpoint (RFC 8693)

type FormMarshaler 

type FormMarshaler struct {
	// contains filtered or unexported fields
}

FormMarshaler implements runtime.Marshaler for application/x-www-form-urlencoded This is needed for RFC 8693 OAuth 2.0 Token Exchange compatibility

func NewFormMarshaler 

func NewFormMarshaler() *FormMarshaler

NewFormMarshaler creates a new form marshaler

func (*FormMarshaler) ContentType 

func (m *FormMarshaler) ContentType(_ any) string

ContentType returns the content type for this marshaler

func (*FormMarshaler) Delimiter 

func (m *FormMarshaler) Delimiter() []byte

Delimiter is not used for form encoding

func (*FormMarshaler) Marshal 

func (m *FormMarshaler) Marshal(v any) ([]byte, error)

Marshal converts a proto message to form-urlencoded format Note: This is used for responses, which should still be JSON for our use case

func (*FormMarshaler) NewDecoder 

func (m *FormMarshaler) NewDecoder(r io.Reader) runtime.Decoder

NewDecoder creates a decoder for form-urlencoded data

func (*FormMarshaler) NewEncoder 

func (m *FormMarshaler) NewEncoder(w io.Writer) runtime.Encoder

NewEncoder creates an encoder (returns JSON encoder for responses)

func (*FormMarshaler) Unmarshal 

func (m *FormMarshaler) Unmarshal(data []byte, v any) error

Unmarshal converts form-urlencoded data to a proto message

type ForwardedClientCertCredentialSource added in v0.7.0 

type ForwardedClientCertCredentialSource struct {
	SourceName    string
	SubjectHeader string
	IssuerHeader  string
}

ForwardedClientCertCredentialSource extracts certificate authentication credentials from proxy-forwarded headers. A TLS-terminating proxy (e.g., Akamai CDN) validates the client certificate and forwards the subject and issuer as headers. The header names are configurable.

When neither header is present, Extract returns (nil, nil), allowing coexistence with other credential sources in the same chain.

func NewForwardedClientCertCredentialSource added in v0.7.0 

func NewForwardedClientCertCredentialSource(name, subjectHeader, issuerHeader string) (*ForwardedClientCertCredentialSource, error)

func (*ForwardedClientCertCredentialSource) Extract added in v0.7.0 

func (s *ForwardedClientCertCredentialSource) Extract(_ context.Context, cc CredentialContext) (*CredentialExtraction, error)

type HeaderCredentialSource added in v0.7.0 

type HeaderCredentialSource struct {
	SourceName string
	Headers    []HeaderSpec
}

HeaderCredentialSource extracts a configurable set of headers from a request and passes them to validators as a generic HeaderCredential.

When none of the configured headers are present, Extract returns (nil, nil), allowing coexistence with other credential sources in the same chain.

func NewHeaderCredentialSource added in v0.7.0 

func NewHeaderCredentialSource(name string, headers []HeaderSpec) (*HeaderCredentialSource, error)

func (*HeaderCredentialSource) Extract added in v0.7.0 

func (s *HeaderCredentialSource) Extract(_ context.Context, cc CredentialContext) (*CredentialExtraction, error)

type HeaderSpec added in v0.7.0 

type HeaderSpec struct {
	Name string
}

HeaderSpec configures a single header for extraction.

type InitPopulationProbe 

type InitPopulationProbe interface {
	InitialCachePopulationFailed(err error)
	End()
}

InitPopulationProbe tracks the initial JWKS cache population in Start. Implementations should embed NoOpInitPopulationProbe for forward compatibility.

type JWKSObserver 

type JWKSObserver interface {
	// InitPopulationStarted is called when the initial JWKS cache population begins in Start.
	InitPopulationStarted(ctx context.Context) (context.Context, InitPopulationProbe)
	// CacheRefreshStarted is called when a JWKS cache build or refresh begins.
	CacheRefreshStarted(ctx context.Context) (context.Context, CacheRefreshProbe)
}

JWKSObserver is called at key points during JWKS cache operations. Implementations should embed NoOpJWKSObserver for forward compatibility with new methods added to this interface.

type JWKSServer 

type JWKSServer struct {
	parsecv1.UnimplementedJWKSServiceServer
	// contains filtered or unexported fields
}

JWKSServer implements the JWKS gRPC service It serves JSON Web Key Sets containing public keys from all configured issuers The response is cached and periodically refreshed for efficiency

func NewJWKSServer 

func NewJWKSServer(cfg JWKSServerConfig) *JWKSServer

NewJWKSServer creates a new JWKS server with caching.

func (*JWKSServer) GetJWKS 

func (s *JWKSServer) GetJWKS(ctx context.Context, req *parsecv1.GetJWKSRequest) (*parsecv1.GetJWKSResponse, error)

GetJWKS implements the JWKS service Returns a cached JSON Web Key Set containing all public keys from all configured issuers

func (*JWKSServer) Start 

func (s *JWKSServer) Start(ctx context.Context) error

Start begins the background cache refresh

func (*JWKSServer) Stop 

func (s *JWKSServer) Stop()

Stop stops the background cache refresh

type JWKSServerConfig 

type JWKSServerConfig struct {
	// IssuerRegistry provides access to all issuers
	IssuerRegistry service.Registry

	// RefreshInterval is how often to refresh the cached JWKS
	// If zero, defaults to 1 minute
	RefreshInterval time.Duration

	// Clock is used for time operations (defaults to system clock)
	Clock clock.Clock

	// Observer for JWKS cache events. Defaults to NoOpServerObserver{} if nil.
	Observer JWKSObserver
}

JWKSServerConfig configures the JWKS server

type LifecycleObserver 

type LifecycleObserver interface {
	// GRPCServeFailed is a fire-and-forget event from an async goroutine.
	GRPCServeFailed(err error)
	// HTTPServeFailed is a fire-and-forget event from an async goroutine.
	HTTPServeFailed(err error)
	// StopStarted is called when graceful shutdown begins.
	StopStarted(ctx context.Context) (context.Context, StopProbe)
}

LifecycleObserver is called at key points during server lifecycle. Implementations should embed NoOpLifecycleObserver for forward compatibility with new methods added to this interface.

type MuxConfigurer 

type MuxConfigurer func(*http.ServeMux)

MuxConfigurer registers HTTP handlers on the server's mux during startup. Use this to add endpoints like /metrics or /debug/pprof without coupling the server to specific subsystem types.

type NoOpCacheRefreshProbe 

type NoOpCacheRefreshProbe struct{}

NoOpCacheRefreshProbe is a no-op implementation of CacheRefreshProbe. Embed this in concrete probe types for forward compatibility.

func (NoOpCacheRefreshProbe) CacheRefreshFailed 

func (NoOpCacheRefreshProbe) CacheRefreshFailed(error)

func (NoOpCacheRefreshProbe) End 

func (NoOpCacheRefreshProbe) End()

func (NoOpCacheRefreshProbe) KeyConversionFailed 

func (NoOpCacheRefreshProbe) KeyConversionFailed(string, error)

type NoOpInitPopulationProbe 

type NoOpInitPopulationProbe struct{}

NoOpInitPopulationProbe is a no-op implementation of InitPopulationProbe. Embed this in concrete probe types for forward compatibility.

func (NoOpInitPopulationProbe) End 

func (NoOpInitPopulationProbe) End()

func (NoOpInitPopulationProbe) InitialCachePopulationFailed 

func (NoOpInitPopulationProbe) InitialCachePopulationFailed(error)

type NoOpJWKSObserver 

type NoOpJWKSObserver struct{}

NoOpJWKSObserver is a no-op implementation of JWKSObserver. Embed this in concrete observer types for forward compatibility.

func (NoOpJWKSObserver) CacheRefreshStarted 

func (NoOpJWKSObserver) CacheRefreshStarted(ctx context.Context) (context.Context, CacheRefreshProbe)

func (NoOpJWKSObserver) InitPopulationStarted 

func (NoOpJWKSObserver) InitPopulationStarted(ctx context.Context) (context.Context, InitPopulationProbe)

type NoOpLifecycleObserver 

type NoOpLifecycleObserver struct{}

NoOpLifecycleObserver is a no-op implementation of LifecycleObserver. Embed this in concrete observer types for forward compatibility.

func (NoOpLifecycleObserver) GRPCServeFailed 

func (NoOpLifecycleObserver) GRPCServeFailed(error)

func (NoOpLifecycleObserver) HTTPServeFailed 

func (NoOpLifecycleObserver) HTTPServeFailed(error)

func (NoOpLifecycleObserver) StopStarted 

func (NoOpLifecycleObserver) StopStarted(ctx context.Context) (context.Context, StopProbe)

type NoOpServerObserver 

type NoOpServerObserver struct {
	NoOpJWKSObserver
	NoOpLifecycleObserver
}

NoOpServerObserver satisfies both JWKSObserver and LifecycleObserver with empty probes. Useful in tests that don't care about observer events.

type NoOpStopProbe 

type NoOpStopProbe struct{}

NoOpStopProbe is a no-op implementation of StopProbe. Embed this in concrete probe types for forward compatibility.

func (NoOpStopProbe) End 

func (NoOpStopProbe) End()

type Principal added in v0.2.0 

type Principal struct {
	Result           *trust.Result
	Anonymous        bool
	CredentialType   trust.CredentialType
	CredentialSource string
}

Principal wraps a trust.Result with an explicit anonymous flag and credential metadata. This avoids representing anonymous identity as an empty trust.Result, which is too implicit for policy decisions.

type Server 

type Server struct {
	// contains filtered or unexported fields
}

Server manages the gRPC and HTTP servers

func New 

func New(cfg Config) *Server

New creates a new server with the given configuration.

func (*Server) SetNotReady 

func (s *Server) SetNotReady()

SetNotReady transitions all per-service and the aggregate readiness health statuses to NOT_SERVING.

func (*Server) SetReady 

func (s *Server) SetReady()

SetReady transitions all per-service and the aggregate readiness health statuses to SERVING. Call this after all components have been successfully initialized.

func (*Server) Start 

func (s *Server) Start(ctx context.Context) error

Start starts both the gRPC and HTTP servers

func (*Server) Stop 

func (s *Server) Stop(ctx context.Context) error

Stop gracefully stops both servers

type ServerObserver 

type ServerObserver interface {
	JWKSObserver
	LifecycleObserver
}

ServerObserver is the per-package aggregate for all server observer interfaces.

type StaticAuthenticatedOption added in v0.3.0 

type StaticAuthenticatedOption func(*staticAuthenticatedConfig)

StaticAuthenticatedOption configures optional behavior for NewStaticAuthenticatedPolicy.

func WithAllowAnonymousWithoutIssuePaths added in v0.3.0 

func WithAllowAnonymousWithoutIssuePaths(patterns []*regexp.Regexp) StaticAuthenticatedOption

WithAllowAnonymousWithoutIssuePaths configures path patterns that allow anonymous access without issuing tokens. Patterns must be pre-compiled via CompilePathPatterns.

type StaticAuthenticatedPolicy added in v0.2.0 

type StaticAuthenticatedPolicy struct {
	// contains filtered or unexported fields
}

StaticAuthenticatedPolicy is an AuthzCheckPolicy that denies anonymous subjects and issues a statically configured set of token types for authenticated subjects. Optionally, configured path patterns allow anonymous access without issuing tokens on matching URL paths.

func NewStaticAuthenticatedPolicy added in v0.2.0 

func NewStaticAuthenticatedPolicy(tokenTypes []TokenTypeSpec, opts ...StaticAuthenticatedOption) *StaticAuthenticatedPolicy

NewStaticAuthenticatedPolicy creates a policy that denies anonymous subjects and issues the given token types for authenticated subjects. If tokenTypes is empty, DefaultTokenTypeSpecs is used. Use WithAllowAnonymousWithoutIssuePaths to allow anonymous access on specific URL path patterns.

func (*StaticAuthenticatedPolicy) Decide added in v0.2.0 

func (p *StaticAuthenticatedPolicy) Decide(_ context.Context, in AuthzCheckPolicyInput) (AuthzCheckDecision, error)

Decide denies anonymous subjects and issues the configured token types for authenticated subjects. When allow-anonymous path patterns are configured, anonymous requests on matching paths are allowed without issuing tokens.

type StopProbe 

type StopProbe interface {
	End()
}

StopProbe tracks server graceful shutdown. Implementations should embed NoOpStopProbe for forward compatibility.

type StubClaimsFilterRegistry 

type StubClaimsFilterRegistry struct {
	// contains filtered or unexported fields
}

StubClaimsFilterRegistry is a simple stub implementation that allows all claims This is useful for testing and initial development

func NewStubClaimsFilterRegistry 

func NewStubClaimsFilterRegistry() *StubClaimsFilterRegistry

NewStubClaimsFilterRegistry creates a new stub registry By default, it uses a passthrough filter that allows all claims

func NewStubClaimsFilterRegistryWithFilter 

func NewStubClaimsFilterRegistryWithFilter(filter claims.ClaimsFilter) *StubClaimsFilterRegistry

NewStubClaimsFilterRegistryWithFilter creates a stub registry with a custom filter

func (*StubClaimsFilterRegistry) GetFilter 

func (r *StubClaimsFilterRegistry) GetFilter(actor *trust.Result) (claims.ClaimsFilter, error)

GetFilter implements ClaimsFilterRegistry

type TLSPeerInfo added in v0.2.0 

type TLSPeerInfo struct {
	Certificates []*x509.Certificate
}

TLSPeerInfo holds mTLS client certificate information extracted from the transport layer.

type TokenTypeSpec 

type TokenTypeSpec struct {
	// Type is the token type to issue
	Type service.TokenType

	// HeaderName is the HTTP header to use for this token
	// e.g., "Transaction-Token", "Authorization", "X-Custom-Token"
	HeaderName string
}

TokenTypeSpec specifies a token type to issue and how to deliver it

func DefaultTokenTypeSpecs added in v0.2.0 

func DefaultTokenTypeSpecs() []TokenTypeSpec

DefaultTokenTypeSpecs returns the default token types issued when none are configured: a single transaction token delivered via the Transaction-Token header.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.