Documentation
¶
Overview ¶
Package authn is the edge authentication PEP (ADR-0113, F77): for a data-plane request whose target has an `authenticated` stance, it extracts a bearer token, resolves it to a connection-scoped Identity (never client-asserted), and DELEGATES the allow/deny decision to the existing auth.Authorizer (RBAC namespace-scope in V1; fine-grained Cedar edge policy in V2). It enforces, never decides. It is invoked INSIDE the data-plane serving path — the first action, after the target (ns, function) resolves and before store.Get + the activator — so a 401/403 never wakes a sandbox and never leaks whether a function exists.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Credentials ¶
Credentials resolves an opaque bearer token / API key to an Identity — a local one-method interface (structurally satisfied by the control-plane static store) so the edge does not import internal/controlplane.
type Deps ¶
type Deps struct {
Creds Credentials // token → Identity (ADR-0018 scheme)
Authz auth.Authorizer // the routing PDP (RBAC now, Cedar later)
}
Deps are the Enforcer's dependencies.
type Enforcer ¶
type Enforcer struct {
// contains filtered or unexported fields
}
Enforcer authenticates + authorizes a data-plane request for a resolved target function.
func (*Enforcer) Enforce ¶
func (e *Enforcer) Enforce(ctx context.Context, r *http.Request, target activator.FunctionRef, stance v1.AuthMode) error
Enforce returns nil to proceed, or a fault (Unauthorized→401 / Forbidden→403) to reject. For an `open` stance it is a no-op (anonymous). For `authenticated` it authenticates the bearer and delegates the namespace-scope decision to the Authorizer.
Source Files