Documentation
¶
Overview ¶
Package auth is the authorization kernel (ADR-0018): the Authorizer port (PDP) every enforcement point (PEP) calls, plus the typed principal/verb/decision model. V1 ships the built-in namespace-RBAC driver (internal/auth/rbac); cedar-go is the deferred V2 driver behind the same port. The control-plane API server is the first PEP; later PEPs (service facades, gateway, bus, egress) call this same port.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Action ¶
type Action string
Action is a Cedar-namespaced action (ADR-0074), e.g. "kv::read" / "kv::write". A Request that sets Action asks the cedar driver a per-object question; the empty Action routes to the coarse RBAC driver (back-compatible).
const ( // ActionKVRead is the Cedar action for a KV get/list (ADR-0074). ActionKVRead Action = "kv::read" // ActionKVWrite is the Cedar action for a KV put/delete (ADR-0074). ActionKVWrite Action = "kv::write" // ActionLinkInvoke is the Cedar action for a synchronous fn→fn invoke (ADR-0075): // principal = the caller Function, resource = the target Function. ActionLinkInvoke Action = "link::invoke" // ActionS3Read is the Cedar action for an S3 get/list/head over the blob substrate (ADR-0080): // a declared spec.blob binding grants it (binding-as-read-grant). Resource = a BlobPrefix. ActionS3Read Action = "s3::read" // ActionS3Write is the Cedar action for an S3 put/delete over the blob substrate (ADR-0080): // single-writer — permitted only when the principal IS the prefix owner. Resource = a BlobPrefix. ActionS3Write Action = "s3::write" // ActionEgressConnect is the Cedar action for an outbound worker connection (ADR-0117, F81): // principal = the caller Function (source-IP resolved), resource = a NetDestination. Default-deny — // a grant comes only from a compiled EgressPolicy; no built-in permit. ActionEgressConnect Action = "egress::connect" // ActionCatalogQuery is the Cedar action for a catalog SQL query over the Quack/DuckLake serving // path (ADR-0137, F102): a declared spec.catalogs binding grants it (binding-as-query-grant), and a // Catalog-scoped RolesAssignment grants it to an external Identity. Resource = a CatalogService. // Read-shaped (a Cedar permit, never a writers entry). The catalog PEP proxy is the enforcement point. ActionCatalogQuery Action = "catalog::query" )
type Authorizer ¶
Authorizer is the single decision point (PDP) every PEP calls. Default-deny.
func NewRoutingAuthorizer ¶
func NewRoutingAuthorizer(rbac, cedar Authorizer) (Authorizer, error)
NewRoutingAuthorizer returns the Authorizer that routes Action-bearing requests to cedar and coarse requests to rbac (ADR-0074). Both are required. If cedar is nil, Action-bearing requests are denied (fail-closed), preserving default-deny.
type EntityRef ¶
type EntityRef struct {
Type v1.Kind
Namespace v1.NamespaceName
Name v1.ObjectName
Path string // optional sub-resource, e.g. a table name; empty for whole-object refs
}
EntityRef names a typed Cedar entity (ADR-0074): a resource kind + its namespace/name, plus an optional sub-resource Path (e.g. a KVTable within a KVStore). It is the per-object principal/resource the cedar driver evaluates.
type Identity ¶
type Identity struct {
Subject string
Role Role
Namespaces []v1.NamespaceName // namespaces a developer/viewer may act in; ignored for admin
// Principal is the Cedar principal (ADR-0074), e.g. Function::"<ns>/<name>", set
// connection-scoped from the sandbox Ref (never client-asserted). nil ⇒ RBAC-only.
Principal *EntityRef
}
Identity is an authenticated principal (resolved by authn from a token / API key).
type NetDestination ¶
type NetDestination struct {
IP netip.Addr
Port uint16
Domains []string // forwarder-attested domains (incl. any matched wildcard token); empty for pure-IP/CIDR
}
NetDestination is the parsed egress destination (ADR-0117, F81): the resolved dst IP:port plus the forwarder-attested domain set. It rides the EntityRef.Path (the KindNetDestination reinterpretation); the codec here is the SINGLE source of truth the egress gateway (producer) and the cedar capability (consumer) share, so the encoded Path and the decoded UID agree byte-for-byte.
func ParseNetDestPath ¶
func ParseNetDestPath(path string) (NetDestination, error)
ParseNetDestPath parses the pinned Path form back into a NetDestination. A malformed prefix is fault.Invalid.
func (NetDestination) Ref ¶
func (d NetDestination) Ref(ns v1.NamespaceName) EntityRef
Ref builds the resource EntityRef for a NetDestination in the caller's namespace (Name unused — the destination rides the Path).
func (NetDestination) UIDString ¶
func (d NetDestination) UIDString() string
UIDString returns the stable "<ip>:<port>" prefix (the part before '#') used verbatim as the NetDestination Cedar entity id — so the resource UID is independent of the (mutable) domain set.
type Request ¶
type Request struct {
Identity Identity
Verb Verb
Kind v1.Kind
Namespace v1.NamespaceName // empty for cluster-scoped kinds
// Action, when set, makes this a Cedar per-object decision (ADR-0074): the routing
// authorizer dispatches it to the cedar driver. Empty ⇒ the coarse RBAC form above.
Action Action
// Resource is the target entity for a Cedar per-object decision (ADR-0074).
Resource *EntityRef
}
Request is one authorization question.
type Role ¶
type Role string
Role is a namespace-scoped RBAC role.
const ( // RoleAdmin is cluster-wide: every verb in every namespace + cluster-scoped kinds. RoleAdmin Role = "admin" // RoleDeveloper may read+write within its bound namespaces. RoleDeveloper Role = "developer" // RoleViewer may only read within its bound namespaces, and never a Secret (ADR-0171). RoleViewer Role = "viewer" )
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package authcontract is the shared conformance suite for the auth.Authorizer port (ADR-0018): Run asserts the default-deny namespace-RBAC guarantee against any driver — admin spans namespaces + cluster-scoped kinds, developer writes only in its namespaces, viewer is read-only and never reads a Secret, and an unknown principal is denied.
|
Package authcontract is the shared conformance suite for the auth.Authorizer port (ADR-0018): Run asserts the default-deny namespace-RBAC guarantee against any driver — admin spans namespaces + cluster-scoped kinds, developer writes only in its namespaces, viewer is read-only and never reads a Secret, and an unknown principal is denied. |
|
Package cedar is the cedar-go authorization driver (ADR-0074) behind the auth.Authorizer port (ADR-0018): it answers per-object, fine-grained data-plane decisions (KV first) that the coarse RBAC driver cannot express.
|
Package cedar is the cedar-go authorization driver (ADR-0074) behind the auth.Authorizer port (ADR-0018): it answers per-object, fine-grained data-plane decisions (KV first) that the coarse RBAC driver cannot express. |
|
Package rbac is the built-in namespace-scoped RBAC Authorizer driver (ADR-0018): admin / developer / viewer roles, default-deny.
|
Package rbac is the built-in namespace-scoped RBAC Authorizer driver (ADR-0018): admin / developer / viewer roles, default-deny. |