Documentation
¶
Overview ¶
Package federation is the optional identity provider surface for other systems (OIDC/OAuth 2.0, SCIM, discovery). See schema.go.
Package federation is the optional identity provider surface this application exposes to other systems (OIDC/OAuth 2.0, SCIM, discovery). It has no mandatory core: it is exactly the features the composition root selects. Remove its registration line to build a pure internal-identity binary.
Index ¶
- Constants
- type APIFeature
- type Feature
- type Module
- func (m *Module) APIRoutes(r chi.Router, g RouteGroups)
- func (m *Module) ClientRPCService() (string, http.Handler)
- func (m *Module) ConsentRPCService() (string, http.Handler)
- func (m *Module) Name() string
- func (m *Module) Routes(r chi.Router)
- func (m *Module) ScimRPCService() (string, http.Handler)
- func (m *Module) Start(ctx context.Context) error
- func (m *Module) Stop(ctx context.Context) error
- type ProviderFeature
- type RPCServiceProvider
- type RootRoutableFeature
- type RouteGroups
- type StartableFeature
Constants ¶
const ModuleName = "federation"
ModuleName identifies the federation module in the registry.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type APIFeature ¶
type APIFeature interface {
Feature
APIRoutes(r chi.Router, g RouteGroups)
}
APIFeature mounts endpoints inside the shared /api group. A feature that serves ConnectRPC exclusively implements RPCServiceProvider instead — the two are mutually exclusive.
type Feature ¶
type Feature interface {
Name() string
}
Feature is one mounted unit chosen at the composition root. A feature left out of New does not exist: no routes, no storage, no lifecycle.
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module is the federation surface: the explicitly wired provider features, mounted in construction order. There is no feature discovery or late registration.
func New ¶
func New(provider ProviderFeature, scim RPCServiceProvider, keys StartableFeature, discovery RootRoutableFeature) *Module
New wires the federation surface. The signing-key service is mandatory; a nil one is a wiring bug.
func (*Module) APIRoutes ¶
func (m *Module) APIRoutes(r chi.Router, g RouteGroups)
APIRoutes mounts the provider feature endpoints inside the shared /api group. The SCIM surface serves ConnectRPC exclusively.
func (*Module) ClientRPCService ¶ added in v0.0.12
ClientRPCService returns the OIDC client administration Connect registration (admin-only surface).
func (*Module) ConsentRPCService ¶ added in v0.0.12
ConsentRPCService returns the consent Connect registration (mixed self/admin visibility).
func (*Module) Routes ¶
Routes mounts the root-router routes (OIDC /authorize, discovery) outside /api.
func (*Module) ScimRPCService ¶ added in v0.0.12
ScimRPCService returns the SCIM provider Connect registration (admin-only surface).
type ProviderFeature ¶
type ProviderFeature interface {
APIFeature
RootRoutableFeature
}
ProviderFeature is the OIDC surface: protocol routes on the root router plus client/token management inside /api.
type RPCServiceProvider ¶ added in v0.0.12
RPCServiceProvider exposes a Connect registration instead of REST routes; the composition root mounts it under /rpc.
type RootRoutableFeature ¶
RootRoutableFeature mounts routes on the root router, outside /api — e.g. the OIDC /authorize endpoint.
type RouteGroups ¶
type RouteGroups struct {
Admin kernel.Guard // session auth + admin requirement
Self kernel.Guard // session auth (cookie)
}
RouteGroups carries the authentication middleware chains a feature applies at mount time; the composition root builds each chain once. A nil group leaves its guarded routes unmounted (fail closed).
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package discovery serves RFC 8615 endpoints: /.well-known/openid-configuration and /.well-known/jwks.json.
|
Package discovery serves RFC 8615 endpoints: /.well-known/openid-configuration and /.well-known/jwks.json. |
|
Package jwks owns signing key material: generation, encrypted storage, rotation with overlap, and the JWKS key provider consumed by token issuance and the discovery endpoints.
|
Package jwks owns signing key material: generation, encrypted storage, rotation with overlap, and the JWKS key provider consumed by token issuance and the discovery endpoints. |
|
Package oidc is the OpenID Connect / OAuth 2.0 provider surface: /authorize + PAR (root router), /api/oidc/token, userinfo, introspect, revoke, end_session.
|
Package oidc is the OpenID Connect / OAuth 2.0 provider surface: /authorize + PAR (root router), /api/oidc/token, userinfo, introspect, revoke, end_session. |
|
Package scimsync provisions users and groups to a remote SCIM server.
|
Package scimsync provisions users and groups to a remote SCIM server. |