Documentation
¶
Overview ¶
Package actionproof signs the human and tenant context of a kcp custom subresource request so a provider can make a narrowly authorized hub REST call without forwarding the caller's bearer token.
Index ¶
Constants ¶
const ( // Header is the ordinary transport header used to carry an action proof. // kcp strips client-supplied X-Remote-* identity headers, so the proof is // deliberately kept outside the requestheader namespace. Header = dataplane.HeaderActionProof )
Variables ¶
This section is empty.
Functions ¶
func AcceptedUntil ¶ added in v0.2.21
AcceptedUntil returns the latest time the verifier could accept claims. Keeping redemption records through the verifier's maximum clock skew avoids a late replay after an entry is swept.
func Sign ¶
func Sign(ctx context.Context, keys serviceaccounts.ProofKeySource, claims Claims, now time.Time) (string, error)
Sign creates a short-lived proof using the hub's shared delegated-identity proof key. The signing domain is distinct from delegated ServiceAccount proofs, and this token is not a ServiceAccount credential.
Types ¶
type Claims ¶
type Claims struct {
UserID string `json:"userID"`
RBACIdentity string `json:"rbacIdentity"`
Groups []string `json:"groups,omitempty"`
Extra map[string][]string `json:"extra,omitempty"`
OrgUUID string `json:"orgUUID"`
WorkspaceUUID string `json:"workspaceUUID"`
ClusterID string `json:"clusterID"`
Provider string `json:"provider"`
ProviderOrgUUID string `json:"providerOrgUUID,omitempty"`
Group string `json:"group"`
Version string `json:"version"`
Resource string `json:"resource"`
ParentName string `json:"parentName"`
Verb string `json:"verb"`
Method string `json:"method"`
// InviteUser binds an App Studio invitation proof to the one email named
// by the original publishing action. Empty for all other sharing intents.
InviteUser string `json:"inviteUser,omitempty"`
// AppAuthUser and AppAuthAppID bind an App Studio authentication-grant
// action to one existing platform account and one production app audience.
AppAuthUser string `json:"appAuthUser,omitempty"`
AppAuthAppID string `json:"appAuthAppID,omitempty"`
// AppAccess* bind an App Studio action to one broker operation and the
// exact Project-owned Infrastructure Instance it may affect.
AppAccessOperation string `json:"appAccessOperation,omitempty"`
AppAccessGroup string `json:"appAccessGroup,omitempty"`
AppAccessResource string `json:"appAccessResource,omitempty"`
AppAccessName string `json:"appAccessName,omitempty"`
AppAccessUID string `json:"appAccessUID,omitempty"`
AppAccessProject string `json:"appAccessProject,omitempty"`
AppAccessProjectUID string `json:"appAccessProjectUID,omitempty"`
AppAccessUser string `json:"appAccessUser,omitempty"`
AppAccessGrant string `json:"appAccessGrant,omitempty"`
ProofVersion int `json:"proofVersion"`
IssuedAt int64 `json:"iat"`
ExpiresAt int64 `json:"exp"`
Nonce string `json:"nonce"`
}
Claims is the hub-authenticated identity and original action coordinate. The hub signs these claims only after authenticating the human and authorizing the addressed tenant workspace. The provider may forward the opaque token, but cannot create or alter these values.
type UseStore ¶ added in v0.2.21
type UseStore interface {
Consume(ctx context.Context, nonce, capability, method, path string, expiresAt time.Time) (bool, error)
}
UseStore durably claims a mutating use of an action proof. Implementations must make Consume atomic across hub replicas; a process-local map is not a valid implementation.
type Verifier ¶
type Verifier struct {
Keys serviceaccounts.ProofKeySource
Authenticate func(context.Context, *http.Request, Claims) error
ValidateScope func(context.Context, Claims) error
Now func() time.Time
}
Verifier validates the hub signature and then delegates provider authentication and live tenant-scope checks to the hub wiring. Both checks are required; a signature by itself never authorizes a request.
Source Files