Documentation
¶
Overview ¶
Package actionproof signs the human and tenant context of a kcp custom subresource request so a provider can make a narrowly authorized hub REST call without forwarding the caller's bearer token.
Index ¶
Constants ¶
const ( // Header is the ordinary transport header used to carry an action proof. // kcp strips client-supplied X-Remote-* identity headers, so the proof is // deliberately kept outside the requestheader namespace. Header = dataplane.HeaderActionProof )
Variables ¶
This section is empty.
Functions ¶
func Sign ¶
func Sign(ctx context.Context, keys serviceaccounts.ProofKeySource, claims Claims, now time.Time) (string, error)
Sign creates a short-lived proof using the hub's shared delegated-identity proof key. The signing domain is distinct from delegated ServiceAccount proofs, and this token is not a ServiceAccount credential.
Types ¶
type Claims ¶
type Claims struct {
UserID string `json:"userID"`
RBACIdentity string `json:"rbacIdentity"`
Groups []string `json:"groups,omitempty"`
Extra map[string][]string `json:"extra,omitempty"`
OrgUUID string `json:"orgUUID"`
WorkspaceUUID string `json:"workspaceUUID"`
ClusterID string `json:"clusterID"`
Provider string `json:"provider"`
ProviderOrgUUID string `json:"providerOrgUUID,omitempty"`
Group string `json:"group"`
Version string `json:"version"`
Resource string `json:"resource"`
ParentName string `json:"parentName"`
Verb string `json:"verb"`
Method string `json:"method"`
// InviteUser binds an App Studio invitation proof to the one email named
// by the original publishing action. Empty for all other sharing intents.
InviteUser string `json:"inviteUser,omitempty"`
ProofVersion int `json:"proofVersion"`
IssuedAt int64 `json:"iat"`
ExpiresAt int64 `json:"exp"`
Nonce string `json:"nonce"`
}
Claims is the hub-authenticated identity and original action coordinate. The hub signs these claims only after authenticating the human and authorizing the addressed tenant workspace. The provider may forward the opaque token, but cannot create or alter these values.
type Verifier ¶
type Verifier struct {
Keys serviceaccounts.ProofKeySource
Authenticate func(context.Context, *http.Request, Claims) error
ValidateScope func(context.Context, Claims) error
Now func() time.Time
}
Verifier validates the hub signature and then delegates provider authentication and live tenant-scope checks to the hub wiring. Both checks are required; a signature by itself never authorizes a request.
Source Files